Coldcard Wallet Hack: What Happened and What to Do Now

— A seed-generation vulnerability in Coldcard hardware wallets has exposed some users to theft, with wallets being swept over the past 24 hours.

— The vulnerability stems from weak entropy in Coldcard's default seed-phrase generation process; users who added dice-roll entropy or passphrases are better protected.

— Bitcoin's private-key-to-address cryptography explained: seed phrases are 12–24-word representations of a master number (BIP39 standard) from which all private keys derive.

— Users who employed additional entropy sources (dice rolls, passphrases) or multi-signature setups remain secure; those using only default seed generation face risk.

— Bitcoin ETF holders (IBIT, BlackRock, Fidelity) are not affected because custody is managed by qualified custodians like Coinbase Custody with insurance coverage.

— The hosts recommend diversified storage—splitting Bitcoin across exchange holdings, self-custody wallets, and multi-signature schemes rather than relying on a single cold-storage method.

— Check your Coldcard now: If you generated a seed phrase using Coldcard's default process without adding dice-roll entropy or a passphrase, verify your wallet balance immediately and prepare to move funds to a secure alternative.

— Adopt diversified storage: Rather than keeping all self-custody Bitcoin in one hardware wallet, split holdings across multiple self-custody wallets, a Bitcoin-only exchange, and/or multi-signature setups to mitigate single-point-of-failure risk.

— Understand your seed generation method: For any self-custody wallet, document exactly how your seed phrase was generated (entropy source, passphrase use, version/firmware). A technical security expert interview will follow next week for deeper guidance.