Coldcard urges users to move bitcoin as exploit drains up to $114M

Coldcard developers are warning users to move their bitcoin immediately, saying an active exploit is still draining funds and may have taken as much as $114 million from self-custodied wallets. The issue affects certain Mk3 units configured on firmware 4.0.1 or later, along with Mk4, Mk5 and Q devices running older firmware. Coldcard said wallets created using the device's dice-roll seed option are not impacted. Galaxy Research, in an updated tally, said a potential fourth "sweep" involved about 449 BTC taken from 709 addresses. Coldcard advised potentially affected users to follow the model-specific security advisory, upgrade the device, generate a new seed and move funds carefully. The incident is weighing on sentiment around self-custody, as a live exploit can force users into urgent migrations to limit theft risk. Market tone is bearish and stress-driven, centered on the immediate security threat. The episode echoes past noncustodial wallet breaches. In June 2023, Atomic Wallet reported that fewer than 0.1% of its roughly 5 million users were affected; Elliptic later estimated stolen funds exceeded $100 million and said about $1 million was frozen across exchanges. The Coldcard case differs in that it is linked to specific hardware wallet firmware and Bitcoin seed generation. Spillover effects may include users moving funds from vulnerable devices into newly generated wallets while the exploit remains active, and increased demand for clearer disclosure around firmware risks and seed-generation guidance. If migration steps curb further drains, the damage may remain concentrated among affected Coldcard setups. Opportunities and risks: For owners of impacted models, following the advisory and migrating funds is the most direct way to reduce exposure. If Coldcard confirms the threat is contained, confidence in unaffected configurations may stabilize. Delays in manual migration could leave wallets exposed to additional sweeps, while hurried moves without careful seed handling could introduce operational errors and further losses.