Bitcoin users are moving funds out of Coldcard wallets at an increasing pace after estimated losses linked to a recently disclosed security flaw climbed to nearly $114 million. Blockchain data shows a sharp rise in small Bitcoin transfers as thousands of users create new wallets and move their holdings before attackers can access them.
The latest figures suggest the number of affected wallets could be larger than first thought. While investigators continue tracking suspicious transactions, security researchers say much of the recent activity is being driven by users taking precautionary steps rather than by new thefts.
How the Coldcard incident began
Coldcard is one of the best-known hardware wallets used to store Bitcoin offline. Hardware wallets are designed to keep private keys away from internet-connected devices, making them one of the safest ways to hold cryptocurrency.
The current incident began after security researchers discovered that some Coldcard wallets generated recovery phrases with a weakness that made them less secure than they should have been. A recovery phrase is a list of words that allows a wallet owner to recover access to their Bitcoin if the device is lost or damaged. If an attacker can recreate that recovery phrase, they can gain control of the funds stored in the wallet.
After the flaw was identified, blockchain investigators started examining Bitcoin addresses linked to affected wallets. Their analysis showed that attackers had already drained funds from hundreds of wallets. As more addresses were reviewed, the estimated losses continued to increase.
Earlier estimates placed the stolen Bitcoin at a much lower level. However, additional analysis uncovered more compromised wallets, pushing the estimated losses to nearly $114 million worth of Bitcoin at current market prices.
The discovery prompted Coldcard to alert users and advise anyone who created a wallet using the affected setup to generate a completely new wallet and transfer their Bitcoin immediately. Security experts also warned that simply updating the wallet’s software is not enough if the original recovery phrase was created using the vulnerable process. A new wallet with a new recovery phrase is required.
Why Bitcoin transfers are increasing
Since the warning was issued, blockchain analysts have recorded a noticeable increase in Bitcoin transfers involving relatively small amounts. Unlike large institutional transactions, these transfers appear to be coming mainly from individual users moving their personal holdings to newly created wallets.
Researchers say this explains why the number of transactions has risen even though not all of the transferred Bitcoin has been stolen. Many users are simply acting before attackers have an opportunity to exploit vulnerable wallets.
The incident has also reminded Bitcoin holders that hardware wallets are only as secure as the process used to generate and protect their recovery phrases. While hardware wallets remain one of the safest storage options available, users still need to verify that their wallets have been set up correctly and follow security recommendations when vulnerabilities are discovered.
What next?
Investigators are continuing to monitor blockchain activity to determine whether additional wallets have been compromised. The estimated losses may change as more addresses are identified and analysed.
For Coldcard users, the advice remains straightforward. Anyone who believes they may have created a wallet using the affected setup should generate a new wallet, move their Bitcoin to the new address and stop using the original recovery phrase.
The incident has become one of the biggest hardware wallet security stories in recent years. It also serves as a reminder that while Bitcoin itself has not been compromised, the tools used to store it can still become targets, making careful wallet management just as important as protecting private keys.