Coldcard urgently warns: Wallet vulnerability caused $114 million to be stolen, and users need to im

The Bitcoin hardware wallet ecosystem is facing a rare and dangerous moment. Coldcard makers have confirmed that an exploit that is still stealing money from specific devices has now caused approximately $114 million in losses and that as of Tuesday, the vulnerability remained unfixed. According to original reports, the company is telling users to move Bitcoin away from vulnerable hardware.

This warning comes after several weeks of escalating anxiety among Coldcard users. The exploit appears to target specific firmware versions and hardware configurations, bypassing the normal security checks on which hardware wallets rely as a cornerstone of self-hosting. Unlike phishing attacks or seed phrase leaks, this is a direct attack on the device layer that makes the general recommendation to "keep private keys offline" less reliable. The vulnerability may be related to firmware, which explains why some devices are not affected, while others have funds stolen.

Scale and silence

The Bitcoin security community-often active on forums and social media-responded with a mixture of vigilance and pragmatism. Long-time Coldcard users are sharing experiences of the stolen balance, while others are debating whether the device's open source firmware could have discovered the vulnerability earlier. Coldcard has not publicly disclosed which models are vulnerable, how exploit works, or whether a fix is imminent. This confidentiality may be due to operational considerations: disclosing technical details may provide a template for attackers. However, this also leaves users in anxious uncertainty.

For years, Coldcard has been a favorite among Bitcoin extremists, who cherish its air-gap design and bitcoin-only firmware. The device is promoted as a "fortress" for the most paranoid owners. Today, cracks are appearing in the fortress, and manufacturers 'silence about the patch schedule has sparked speculation that the root cause may be deep and may be related to supply chain vulnerabilities or flaws introduced during firmware updates months ago.

The broader self-hosting dilemma

Hardware wallet exploits are not new-Ledger and Trezor's devices have encountered them before-but the scale of this is noteworthy. The Coldcard incident highlights a persistent contradiction: Self-hosting is widely advertised as an antidote to exchange risks, but it also focuses technical responsibility on individual users, who may lack the expertise to assess device integrity. The industry has long assumed that a correctly manufactured hardware wallet updated to the latest version can withstand remote attacks. This assumption is now being seriously challenged.

The recommendation to immediately transfer funds to another wallet, usually a hot wallet on a smartphone, introduces another set of risks. Users fleeing compromised hardware devices may expose their private keys to less secure environments. This is a trade-off between known threats and unknown threats, and security practitioners can only weigh this decision based on factors that are difficult for ordinary users to judge.

Factors still uncertain

It is unclear whether the exploit can be triggered remotely, whether it requires physical contact, or whether it exploits vulnerabilities in supporting software used in the transaction signing process. The lack of clarity complicates defensive measures. In addition to full migration funds, if the hardware itself has been compromised at the boot loader level, even firmware updates may not be enough. Once the threat is contained, Coldcard needs to release a comprehensive technical post-mortem analysis report-for now, this may take days or weeks.

Whether affected users can recover some of the stolen funds through on-chain tracking or legal intervention remains an open issue. Bitcoin's transparent ledger helps track the flow of funds, but its pseudonym nature makes law enforcement difficult. Historically, individual victims of hardware wallet exploits have rarely received compensation. The broader impact on hardware wallet sales, especially for Bitcoin native users, may depend entirely on Coldcard's response speed.

The manufacturer's message was straightforward, although silent on the details: If you have one of the vulnerable devices, assume it has been compromised and transfer your Bitcoin before you become the next victim in this growing loss case.