You had one job. That, no doubt, is what Coldcard customers are thinking about the company now. If you’re not familiar, Coldcard makes devices to store crypto in an offline wallet—and is now notorious for a security lapse that let thieves plunder at least $100 million of Bitcoin from unsuspecting customers. Most times, news of a crypto hack is met with a “well, that’s what happens” shrug, but this one stands out because it affects a group of security-conscious Bitcoin owners who did everything right. Or so they thought.
Ordinarily, hardware wallets like Coldcard provide top-notch security, since they store crypto offline, and a wallet owner is the only one who knows the seed phrase that will unlock it. This should make the wallets virtually unhackable. Unfortunately, the company behind Coldcard made a colossal screw-up by failing to provide a randomized process for creating seed phrases. Instead, that process was based on a predictable pattern, allowing hackers who possessed a sample seed phrase to use trial-and-error to guess others—and clean out Coldcard owners in the process. (You can read a full technical breakdown here.)
The question is how much this hack matters. On one hand, you can say it doesn’t matter much since, compared to Ledger or Trezor, Coldcard is an obscure brand that accounts for less than 2% of the hardware wallet market. And while the hack is a devastating event for those who got robbed, the episode affected only a relative handful of Bitcoin owners, which is likely why the broader crypto market barely moved.
