The $130M Coldcard Hack: How a 2021 Firmware Bug Broke Bitcoin's Safest Wallets and Fueled an ETF Boom

The consequence: Seed entropy collapsed. A secure hardware-generated seed offers a 128-bit key space — meaning 2¹²⁸ possible values, which is astronomically large and impractical to brute-force. The software fallback reduced that to as little as 40 bits, or roughly 4 billion possible values . For a sufficiently determined attacker armed with the right information, that key space was small enough to enumerate remotely.

Attackers could reconstruct wallet seed phrases by combining device serial numbers, clock readings, and other publicly observable data with the constrained key space . They then generated candidate seeds on their own machines, derived addresses, and checked those addresses against the Bitcoin blockchain to find wallets with balances. The entire attack required no physical access to any victim's device .

The Attack Waves Timeline

The exploit unfolded in multiple waves, with the most aggressive action happening in the first hours.

• Wave 1 (July 30, ~10 minutes): The primary attacker prioritized the largest wallets and swept roughly $30 million in Bitcoin .
• Wave 1 extended (25 minutes): Within 25 minutes, $38 million+ had been drained from approximately 500 wallets .
• Wave 1 full (41 minutes): Galaxy Research mapped the first sweep as 1,082.65 BTC (about $70.2 million at the time) drained from 1,196 addresses in 41 minutes .
• Subsequent waves: By early August, Galaxy confirmed three major attack waves and 14 smaller incidents, with at least a dozen different hackers actively targeting Coldcard users . The total grew to over 5,200 affected addresses, with some estimates reaching 7,300 .

As of August 4, Galaxy Research had high confidence that 1,596 BTC had been stolen, with unconfirmed losses adding another $30 million . The total damage settled around $130 million .

On-Chain Fallout: A Rush Off Coldcard

The hack triggered an immediate migration. Bitcoin logged 2.27 million new wallets and 751,000 active wallets in the first week of August — the strongest on-chain activity in months — as holders raced to move funds off Coldcard devices .

Crucially, updating firmware could not fix an affected seed. The only remedy was generating a new seed on patched firmware and carefully migrating funds . This meant every wallet whose seed was created on vulnerable firmware versions (4.0.1 through 5.0.3, affecting Mk2 and Mk3 models) was permanently at risk until the user manually moved coins .

The ETF Inflow Surge: $853.5 Million in One Week

In the first week of August 2026, U.S. spot Bitcoin ETFs posted $853.5 million in net inflows — their best weekly performance since April 2026 . The inflows were broad-based but concentrated at the top:

• Daily breakdown: $170 million on Monday, $211.5 million on Tuesday, $244.4 million on Wednesday, $128.7 million on Thursday, $98.9 million on Friday .
• Leader: BlackRock's iShares Bitcoin Trust (IBIT) accounted for roughly $693 million of the weekly total, or about 81% of all inflows .
• Fidelity's FBTC came in second with $116.5 million .

The ETF surge followed an eight-week stretch of outflows that had drained $8.26 billion through the start of July . The reversal was sharp and sudden — and its coincidence with the Coldcard hack fueled immediate speculation.

The Debate: Hack vs. Macro — Which Drove the Flows?

The timing was striking. The Coldcard attack became public on July 30-31. The ETF inflow run began on Monday, August 3. But that same week, on Friday August 7, the U.S. Bureau of Labor Statistics released a shockingly weak July jobs report. Both events could have driven ETF buying, and analysts remain divided on which was the primary cause.

Case for the Hack as the Driver

• Direct timing: ETF inflows began just days after the Coldcard exploit became widely known .
• Custody crisis of confidence: The hack directly undermined trust in self-custody. The old crypto mantra "not your keys, not your coins" was inverted — in this case, holding your own keys led to losses. A Bloomberg analyst noted the incident "fueled debate" about whether some investors were reconsidering self-custody and shifting to regulated custodians like ETF providers .
• On-chain evidence of migration: The spike in new wallet creation and fund movement away from Coldcard devices was consistent with a "flight to custody" .

Case for Macro as the Driver

• The July jobs shock: The U.S. nonfarm payrolls report showed a loss of 23,000 jobs, against a consensus forecast of an 80,000 gain. Prior months were revised down by an additional 103,000 jobs .
• Fed rate path repricing: The odds of a September Fed rate hike collapsed from 55% to 20% . Markets immediately priced in a policy pause, which is a strongly bullish catalyst for risk assets including Bitcoin.
• Bitcoin price reaction: Bitcoin jumped above $65,000 on the jobs miss .
• Prior macro sensitivity: The eight-week ETF outflow streak had already reversed in early July, following the weak June jobs report (57,000 jobs, well below expectations) which also triggered a $221.7 million inflow day . This suggested ETF flows had already become re-sensitized to macro conditions before the Coldcard exploit.

Where the Evidence Lands

Most analysts surveyed across major outlets concluded the ETF surge was likely driven by both forces acting in the same direction . The hack provided a micro-level "flight to custody" rationale — a concrete reason for self-custody holders to reconsider their security setup. The weak jobs report provided a macro-level "risk-on" catalyst — the kind of broad monetary policy shift that drives institutional capital into all risky assets, Bitcoin included.

As one Bloomberg analyst put it, the causal link between the hack and the ETF inflows is "unclear," but the coincidence has "fueled debate" . An MSN Money analysis concluded the hack provided a "convenient narrative" for a shift that may have been macro-driven, but noted that the custody debate was now "front and center" for the first time since the early days of Bitcoin ETFs .

What is clear: the $853.5 million inflow week was the strongest since April, and two major events — a once-in-a-generation hardware wallet failure and a shock jobs report — converged in the same window. Both the custody question and the macro outlook are now more uncertain than they were before that week. That uncertainty, rather than a clean answer, is the real takeaway.