Galaxy Research said weak seed generation let an attacker recreate likely private keys offline, sweep more than 1,000 BTC from nearly 1,200 wallets and continue searching without ever accessing the devices.

Bitcoin security experts said the unexplained $38 million wallet drain may involve flawed seed-generation entropy, though the cause and any Coldcard link remain unconfirmed.

A hardware wallet randomness bug turned “impossible to guess” seeds into guessable ones, and $38 million is already gone.

Over $70 million in Bitcoin has been pinched. Coldcard has since urged its users to take precautions.