Updated

Updated · Inshorts · Aug 3

Jonathan Goodman Loses ₹15.24 Crore in 7 Minutes as Coldcard Hack Tops ₹850 Crore

Updated

Updated · Inshorts · Aug 3

Jonathan Goodman Loses ₹15.24 Crore in 7 Minutes as Coldcard Hack Tops ₹850 Crore

Q: How many more Coldcard wallets could still be vulnerable if patched firmware cannot fix old seeds already created with weak entropy?

Potentially thousands more Coldcard wallets could still be vulnerable, but there is no reliable public total yet. What is known is that observed thefts have already hit about 4,585 addresses across three waves, and researchers say the attacker appears to be moving from larger wallets to smaller ones rather than running out of targets. That matters because patched firmware only protects wallets created after the fix; it does not repair old recovery seeds generated with weak entropy. The exposed population is broader than the wallets already swept. Coinkite’s advisory covers seeds created on affected firmware across multiple models: Mk2/Mk3 versions 4.0.1–4.1.9, Mk4/Mk5 before 5.6.0, and Q before 1.5.0Q, with edge builds also affected. Any wallet created on those versions and not protected by substantial outside entropy or a strong passphrase may still be at risk. Researchers have not published a count of all vulnerable devices or seeds in the wild, so the remaining number cannot be calculated from current evidence. It is also not one-wallet-equals-one-address: a single seed can control many addresses, and some victims may not yet know they are exposed because they are inactive holders. The practical answer is that the attack surface likely extends well beyond the 4,585 addresses already drained. Owners who created seeds on affected firmware should assume risk persists until they generate a brand-new seed on patched firmware and migrate funds.

3 articles · Updated · Inshorts · Aug 3

Jonathan Goodman said attackers drained ₹15.24 crore from his Bitcoin holdings in seven minutes, even though his Coldcard device was stored offline in a safety deposit box.
Goodman said the wallet had never been connected to the internet, underscoring how the Coldcard breach is hitting users who believed their coins were protected by cold storage.
₹850 crore has now been drained from Coldcard accounts in the first wave of attacks, according to the latest report, extending losses from a flaw previously tied to predictable recovery phrases.
Coldcard maker Coinkite had already issued a software update and urged users to generate new recovery phrases after earlier thefts hit more than 1,200 addresses and later spread to 4,585.