A firmware flaw in older Coldcard hardware wallets let attackers drain tens of millions of dollars in Bitcoin during late July, and spot Bitcoin ETFs saw a wave of inflows in the days that followed. Bitcoin's price barely moved, but ETF flows jumped, though a direct link between the two events remains unconfirmed.
Coinkite, the company behind the Coldcard hardware wallet, disclosed on July 30 a firmware flaw in older models, including the Mk3 series, that weakened the randomness used to generate seed phrases. Galaxy Research estimated that between 1,367 and 1,816 BTC were drained from more than 5,200 wallet addresses in the days that followed. At prices prevailing around the breach, that translates to roughly $89 million to $116 million in losses.
How the flaw exposed private keys
The flaw cut the entropy behind seed-phrase generation to about 40 bits, which made it mathematically feasible to reconstruct private keys from scratch. Newer Coldcard units saw only a partial reduction in entropy, which limited but did not eliminate their exposure relative to older hardware. Coinkite CEO Rodolfo Novak urged affected users to move their funds immediately on July 31, a day after the disclosure.
Bitcoin's price barely moved, but ETF flows jumped
Despite the breach, Bitcoin dipped only about 3% before stabilizing near its prior level.
The bigger reaction showed up in spot Bitcoin ETFs, which posted combined daily inflows of $620 million across funds including IBIT, FBTC, and ARKB in the days after the disclosure. Individual sessions in that window ranged from $91.84 million on the lower end to between $170 million and $244 million on stronger days. Available research has not confirmed a direct link between the hack and the inflows, though the timing suggests a possible flight toward regulated products among self-custody holders. Because the $620 million spans multiple funds, no single ETF absorbed one outsized order.
The episode leaves holders on older Coldcard hardware with one practical question: whether their own seed phrase was generated before the flaw came to light.
Source: Crypto Briefing
Trading involves risk.
Risk Disclaimer
