Since 30 July, roughly 2,000 BTC — about $130 million at current prices — has been drained out of Coldcard hardware wallets. No phishing, no malware, no stolen laptop. These devices never touch the internet, and nobody touched them. The attackers simply worked out the private keys.
One sweep took $70 million in 41 minutes. Galaxy Research confirms 1,596 BTC from around 7,300 addresses across three waves plus fourteen smaller incidents; with a suspected fourth wave the total reaches about 2,055 BTC. The manufacturer counts at least fifteen separate attackers — once the hole was known, everyone piled in.
What follows is not a chronicle of the theft. It is an account of why the reviews missed it, because they did not miss it through negligence. They missed it exactly the way reviews are built to work today.
One preprocessor directive
In March 2021, Coinkite moved Coldcard's cryptography onto libsecp256k1, the same library Bitcoin Core uses. That was a sound call: rolling your own crypto is worse than sharing everyone else's. The integration is where it came apart.
