The 1,367 BTC Drain: Coldcard Addresses, Target Selection, and the Limits of Device-Level Self-Custody

Galaxy Research has identified 1,367 BTC drained from addresses associated with Coldcard hardware wallets. At the price levels that have prevailed through much of 2025, that figure lands somewhere north of $130 million. Depending on the actual execution window of the withdrawals, it could be as low as $82 million if the coins moved during a $60,000 excursion, or as high as $137 million at $100,000 per bitcoin. The report, notably, provides no timestamp to anchor the valuation. The number matters less than the mechanism. Coldcard is the hardware wallet that bitcoiners recommend to people who want to sleep at night. It generates seeds offline. It signs transactions without ever exposing a private key to a networked computer. It has been marketed for years as the most paranoid option in an already paranoid ecosystem. If 1,367 BTC exited Coldcard-controlled addresses, either the paranoia was misdirected, or the attacker never needed to break the device at all. The code didn't move those coins. Someone did. The gap between those two statements is the entire story. Let me establish what Coldcard actually is, because the word 'hardware wallet' obscures more than it reveals. Coldcard is a product line manufactured by Coinkite, a hardware company that has occupied an outsized role in Bitcoin self-custody since the Mk1 shipped in 2017. It is not the easiest wallet to use, and it is not the sleekest. Its interface is a monochrome screen and a five-button navigation array, and that is precisely the point. The device is built around a single doctrine: the private key never leaves the hardware. Seeds are generated on-device. Transactions are prepared on a computer as unsigned PSBTs, signed physically by button presses, then exported back for broadcast. The firmware is open source and reproducible. The enclosure carries tamper-evident seals. The hardware carries attestation data that can be verified against Coinkite's public keys. This design philosophy earned Coldcard a specific kind of customer base. The brand is not for the average consumer. It is the tool of choice for the bitcoin-maximalist security crowd: people who use coinjoin, who refuse to type seed phrases into anything digital, who know what BIP85 is and use it. It is also the hardware layer underneath a growing stack of collaborative custody services. Companies like Unchained and Casa have built their multisig products around the assumption that a Coldcard in the hands of a careful user is a trustworthy root of custody. That assumption is now under direct examination. Galaxy Research is the research arm of Galaxy Digital, the financial services firm founded by Mike Novogratz. When Galaxy says it has identified a drain across Coldcard addresses, it means its chain-analysis team has clustered a set of outputs, followed the flow of funds, and reached a conclusion about who controlled the source keys. That is not a casual claim. It requires infrastructure, time, and a large body of on-chain data. What the public fragments of the report do not include is more interesting than what they include. No attack window. No address list. No wallet model. No mention of whether funds were recovered. No Coinkite acknowledgment. The information diet here is one hard number and two soft media interpretations. The first interpretation tells us that the event 'exposes critical vulnerabilities in hardware wallet security.' The second tells us that investors are reassessing their digital asset protection strategies. Both are narratives, not evidence. That gap is itself a data point. In my experience reading security disclosures for a living, from the DAO post-mortem to the BZOptimism bridge autopsy, the shape of a report tells you as much as its content. An institution that can identify 1,367 BTC of theft across a hardware wallet brand has already done the forensic work. It has clustered addresses. It has watched the funds move. It has likely identified exchange deposit addresses. The decision not to publish those details may be legal, protective of victims, or simply a matter of continuing surveillance. All three possibilities should change how we price the information we have. History is a Merkle tree, not a narrative. We know 1,367 BTC is gone. We do not yet know why. That distinction is not academic; it determines whether the correct response is a firmware patch, a supply-chain audit, a user-education campaign, or a fundamentally different self-custody architecture. WHAT 'COLDCCARD ADDRESSES' ACTUALLY MEANS Let me be precise about a phrase that has been doing a lot of work in the headlines. Bitcoin addresses do not carry device labels. There is no byte in a taproot output that says 'signed by a Coldcard.' If Galaxy Research has identified an address as Coldcard-associated, it did so through inference. The question is what that inference was built on. The most likely bases, in descending order of probability, are these. First, derivation-path fingerprints. Coldcard's default account structure follows standard BIP44, BIP49, BIP84, and BIP86 paths, and those structures are detectable in PSBTs when a user exports a partially signed transaction to software like Electrum, Sparrow, or Specter. But 'uses m/84'/0'/0'' is not a Coldcard marker. It is a Bitcoin ecosystem marker. That alone would not differentiate a Coldcard user from a Specter user or a Trezor user. A competent analyst would need more signal. Second, descriptor exports. Coldcard supports wallet descriptors, and a meaningful subset of users publish descriptors or xpubs in forums, in multisig coordination spreadsheets, or in backup strategies. An xpub from a known Coldcard setup can be used to enumerate every address across the entire account. This route is attractive because it requires no compromise on the attacker's side. It only requires that the user's public key material leaked somewhere: a coordination document, a support ticket, a decade-old YouTube tutorial on multisig setup. Third, behavioral heuristics. Coldcard users skew toward a particular operational profile. They use coinjoin at higher rates. They keep fee rates low. They practice coin control and avoid address reuse. They migrated to taproot outputs after BIP86 support matured. A clustering algorithm can build a behavioral vector from these features and flag addresses that fit the Coldcard-type profile. This is not a fingerprint. It is a statistical profile, and statistical profiles carry false positives and false negatives. Fourth, external linkage: the user's own identity. Purchase records, shipping manifests, resale listings, forum posts, social media photographs of a Mk4 sitting next to a coffee cup. If the attacker matched device-associated xpubs or addresses to specific identities, the labeling becomes trivial. I cannot verify which method Galaxy used, because the report does not say. That uncertainty matters. 'Coldcard addresses' sounds like a technical category; it is actually a clustering label, and clustering labels carry error bars. Galaxy could be right. Galaxy could also be partially wrong, with serious collateral damage in the attribution. The absence of methodology is not disqualifying. Research desks regularly hold methodology back for legal or tactical reasons. But it is a reminder to treat the aggregate figure as directional rather than forensic. THE FOUR HYPOTHESES If we accept the core claim, that bitcoin tied to Coldcard devices was stolen, the next question is how. There are four plausible mechanisms, and they have very different implications. Hypothesis A: the operational envelope broke. The seed phrase was exposed at some point outside the device. It was typed into a compromised computer, photographed, emailed to a 'safe place,' entered into a fake wallet application, or exhumed from an unsecured backup. This is the most common cause of hardware wallet theft in the historical record. The device's cryptography is never touched; the seed is captured before it reaches the hardware or after it leaves it. In my own audit work, including a code-level review of TheDAO in 2017 that identified the recursive call vulnerability before the fork debate, the pattern was consistent: the interesting bug lives at the interface between components, not inside a single component. The DAO's flaw was in the interaction between its state-update logic and its external call mechanics. A hardware wallet's equivalent interface is the human sitting in front of it. That interface does not ship with a patch. Hypothesis B: supply-chain compromise. Coinkite goes to unusual lengths to secure the journey from factory to customer. Tamper-evident seals, signed firmware, attestation checks. But those defenses are defeated by a sufficiently organized adversary at the manufacturing tier or the logistics tier. If a batch of devices was intercepted, flashed with malicious firmware, repackaged, and delivered, the attack would look exactly like this event: a broad, silent drain of users who did everything right. No mass production-level hardware wallet supply-chain attack of this scale has ever been publicly confirmed across the industry, but the threat model is real, and it is the scenario that most worries serious Bitcoin OPSEC practitioners. I rate it at low-to-moderate confidence, precisely because no evidence has surfaced so far. Hypothesis C: physical side-channel extraction. Academics have demonstrated that certain hardware signing implementations leak secrets through power consumption, electromagnetic emanation, or timing. Coldcard's implementation was designed against those classes of attack. A physical side-channel attack in the wild, against a product with countermeasures, would be exceptional. It would target a single high-value device at close physical range, not a 1,367 BTC blanket drain across what appears to be multiple users. I discount this hypothesis almost entirely. Hypothesis D: address targeting plus off-device extraction. This is the hypothesis I find most probable, and the one the coverage has almost entirely missed. An attacker who can identify Coldcard-controlled addresses can also identify high-value storage locations. They do not need to break the hardware. They need to break the user. A target list enables phishing tailored to the wallet's workflow. A fake 'firmware update' that instructs the user to export their seed for 'migration.' A malicious PSBT that the user is convinced to sign. A customer-support social-engineering attempt. At the extreme, physical burglary targeting a known holder. The theft then registers on-chain as an outflow from Coldcard addresses, and the industry reads 'Coldcard hacked.' In reality, the device may have performed exactly as designed. The user was socially engineered out of their own key custody. Tracing the bleed through the gateway: the exit route determines the lesson. If coins moved from cold addresses to known exchange hot wallets in small, staggered tranches, that is the signature of a coordinated campaign, likely Hypothesis A or D. If coins were consolidated into a single fresh address and held, that is a different profile. It could be an insider, a targeted heist, or a law enforcement seizure that is being framed as theft. Each read requires a different response. I have seen this pattern before. In 2021, after the BZOptimism bridge exploit, the community narrative focused on the horror of a $16 million loss. I spent three weeks reconstructing the transaction tree. The money was not lost to user error, and it was not lost to a generic infrastructure failure. It went out through a signature-verification flaw in the sequencer's handling of a specific message type. The on-chain signature of that flaw was unambiguous once you traced it. The same discipline applies here. We cannot judge the vector without the tree, but we can enumerate the candidate vectors and rank them by prior probability. That ranking tells users where to look and what to fix. WHAT THE INVESTIGATION SHOULD LOOK LIKE If I were running this investigation, and I have run similar ones, the first step would be to define the full set of addresses in scope. That requires obtaining from Galaxy Research, or reconstructing independently, the clustering methodology. Without an xpub or a known seed-derived branch, an independent verification would start from any publicly identified Coldcard wallet and walk forward: identify the account structure, derive the address space, then check whether the drained addresses match. The second step is temporal correlation. Each drained address gets a time-of-first-spend and a time-of-theft. If the thefts cluster into a narrow window, that suggests an event-driven compromise, perhaps a single exploited tool or a single point of failure. If the thefts are distributed across many months, that suggests a persistent campaign, an ongoing profile-scraping operation, or a slowly exploited batch of compromised seeds. The third step is counterparty analysis. Where did the stolen coins go? In the Terra/Luna analysis I ran in 2022, the crucial evidence was not the crash narrative; it was the on-chain distribution pattern of LUNA in the final hours, which showed coordinated whale exits that were incompatible with the 'market sentiment' story. Funds that move to exchange deposit addresses quickly get laundered or liquidated. Funds that sit idle are either being held for later or are unsellable for legal reasons. The Galaxy report's silence on this point is conspicuous. If a $130 million theft had already hit exchange inflows, a research desk would normally say so. The silence may mean the coins are still out there, under surveillance. The fourth step is the user-side data. Which software was used to construct transactions? Which firmware versions were installed? Were there common support-ticket patterns, common resellers, or common imports? The answer to 'how were the addresses clustered to Coldcard' interacts with 'how were the users compromised.' A single infected companion app would show up as a correlation across victims. A supply-chain interception would show up as a correlation across device serial numbers. I have no access to that data from here, but Galaxy, Coinkite, and any law enforcement body with a view into the case does. The public report will be judged by how much of that trail it exposes. THE MATH OF 1,367 BTC Let me put the number in its market context. The amount is large against a salary and small against a network. At steady state, bitcoin trade volume across centralized spot markets runs in the tens of billions per day. A theoretical liquidation of 1,367 BTC, which has not been observed and may not be the plan, would disappear into that flow without leaving a visible dent in price. As a share of the roughly 19.8 million bitcoin in circulation, the drained amount works out to about 0.007 percent. By either measure, the direct price signal is noise. The indirect signal is where the real cost sits. Security events in self-custody are not priced by the amount stolen; they are priced by the confidence premium they strip from the storage layer. Institutional participants already pay for custody, for insurance, for multi-layer vaulting. Every hardware wallet incident hardens their argument that private-key self-custody is a hobbyist's solution. In a sideways market, where capital allocators are choosing between positions rather than chasing momentum, that argument changes flow. A manager who was comfortable with a $10 million Coldcard position may start allocating to a regulated custodian. That shift is not visible in the price of bitcoin. It is visible in the revenue of custody providers, and it is visible in the insurance premiums that are quietly rising for cold-storage mandates. The 1,367 BTC figure also carries a governance lesson. When losses are concentrated in a single exchange, the market can see the bankruptcy filing, the token price, the withdrawal freeze. When losses are distributed across a hardware wallet cohort, there is no aggregate signal unless a research team assembles it. That asymmetry is why Galaxy's report matters beyond its headline number: it converts a silent distribution into a measurable event. But it also illustrates the structural opacity of self-custody. We only know about this theft because someone with chain-analysis infrastructure decided to count it. The true total of hardware wallet losses is almost certainly larger than any public figure. THE ECOSYSTEM MOMENT This event lands at a specific point in bitcoin's maturation. The 'not your keys, not your coins' doctrine reached a wide audience in the 2020 to 2023 cycle. Hardware wallet sales grew with it. High-net-worth individuals and small institutions built vaults. Multisig coordination services built entire products on the assumption that a hardware wallet from a reputable vendor was a trustworthy root of custody. That assumption is now under question, not because the hardware failed, but because the framing was always incomplete. A hardware wallet secures the key. It does not secure the map of where the key lives. If attackers can fingerprint a device class on-chain, then the hardware wallet is a lock on a door that advertises itself. Every address associated with a Coldcard becomes a flag on a map that says 'valuable objects inside.' This should push the ecosystem toward a conclusion that security engineers reached years ago: single-device self-custody, regardless of vendor, is a middle tier of security, not the top tier. The top tier is multi-key, multi-vendor, geographically distributed custody. A multisig vault with keys held on different devices from different manufacturers, in different jurisdictions, is the current technical answer to the problem of device-class targeting. If an adversary can fingerprint a Coldcard, they cannot as easily fingerprint a Coldcard plus a Trezor plus an offline software key, each signing on a different architecture. The market may finally be ready to hear that recommendation. The regulatory cross-current is uncomfortable. A theft of this scale is a criminal matter. If the stolen funds move toward wallets linked to sanctioned entities, the North Korean IT operator clusters, the case lands in OFAC territory and changes the enforcement conversation. If the funds remain traceable, this becomes a high-profile test of chain-tracing capacity that law enforcement will likely narrate as a success for transparency. The harder policy angle is the one nobody in bitcoin wants to say out loud: large self-custody losses are the strongest lobbying material the custody industry has ever had. Every announcement like this one is ammunition for the argument that private keys are too dangerous for ordinary people, and that regulated custody, insurance, and KYC are consumer protections rather than compromises. I do not agree with that conclusion. But I am under no illusion about how this data is being used in Washington and Brussels. The empirical lesson is not that self-custody is impossible. It is that self-custody requires an operational discipline that most people do not have, and the failure mode is punishing. COINKITE'S SILENCE, AND WHAT THE BULLS GOT RIGHT The most important variable in the coming weeks is the response from Coinkite. Silence is the loudest bug report. A company that has been the subject of a $130 million unexplained withdrawal claim cannot decline to respond indefinitely without the market drawing the obvious conclusion. But I want to be careful about what I am asking for. If the attack vector was user-side, phishing, seed exposure, social engineering, Coinkite may have no technical statement beyond 'our firmware is unaffected.' That statement would be true and unsatisfying. If the vector was supply-chain or device-level, Coinkite has a legal incentive to say as little as possible until the investigation is complete, and a technical incentive to disclose exactly what was vulnerable. The difference between those two futures is the difference between a blip and a brand collapse. Now the contrarian part, because it is genuinely important. The bulls got several things right here, and the silence of the coverage on those points is itself a bias. First, there is still no evidence that Coldcard's cryptographic core failed. The BIP39 mnemonic generation, the BIP32 derivation, the secp256k1 signing, the PSBT handling. None of it has been shown broken. In a decade of hardware wallet incidents, the reported attack vectors overwhelmingly live outside the cryptographic core. The code didn't betray these users in any documented sense. Second, Coldcard's open-source firmware is a resilience feature, not a vulnerability. A closed-signer attack cannot be ruled out for black-box hardware. For open hardware, the community can inspect, reproduce, and attest. If anything, a serious supply-chain compromise would be detected sooner in a Coldcard-oriented community than in a consumer-oriented one, because this is the exact crowd that checks attestation signatures. That adversarial community is the market's most effective watchdog, and it is not presently publishing evidence of device-level compromise. Third, the address-fingerprinting problem is not a Coldcard problem. It is an industry problem. Ledger users, Trezor users, and software wallet users all leave statistical footprints that clustering algorithms can match to device types or user profiles. If Galaxy Research could identify Coldcard addresses from public chain data alone, so could a sufficiently organized adversary, and the same applies to every other wallet class. The correct reading of this event, if the fingerprinting hypothesis holds, is not 'Coldcard is uniquely unsafe.' It is that on-chain privacy for the entire self-custody sector is weaker than its marketing suggests. That is a much harder problem to fix, and it has no firmware update. Fourth, there is a real possibility that the number itself will be revised. Galaxy Research is a credible institution, but aggregating thefts across 'Coldcard addresses' involves clustering assumptions. If the clustering is wrong for some addresses, if a percentage of the 1,367 BTC belonged to software wallet users whose behavior merely resembled a Coldcard profile, the true figure could be lower. That is not exculpatory for anyone. But precision matters in security analysis, and precision requires methodology. The danger in the opposite direction is equally real. An overcorrection, mass dumping of hardware wallets, panic migration to exchanges, or a stampede into centralized custody, would convert this event into a self-inflicted wound. The correct response to a lock being picked by breaking the door is not to remove the lock and leave the door open. It is to change the architecture around the lock. WHAT I WOULD DO NOW I am not going to tell readers to sell their Coldcards. I am going to tell them to do seven specific things. First, wait for the Coinkite statement before concluding anything about the device class. If they address the vector, weigh it against the Galaxy data. If they stay silent for another quarter, treat that silence as evidence. Second, do not move assets to an exchange in panic. A hot wallet is a worse threat model than the one you have, even if the Coldcard-specific threat model turns out to be compromised. Moving your bitcoin to a custodial exchange to escape a hardware wallet attack is like fleeing a flood by swimming into the ocean. Third, if you hold more bitcoin than you can afford to lose, add a second layer of protection. A multisig vault with keys from different vendors, a Coldcard, a Trezor, an offline software key stored separately, is the current standard for serious self-custody. If that complexity is too much, a regulated custody product is a legitimate alternative. Self-custody is not a moral achievement. It is a risk decision, and it should be re-evaluated with the same discipline as any other risk decision. Fourth, revisit your seed backup. If your seed phrase has ever touched a computer, a camera, a cloud service, or a messaging app, it is compromised, and you should rotate it urgently. This is the operational gap that accounts for the majority of hardware wallet losses, and it is the gap most likely to explain this event. Fifth, change your on-chain behavior if you care about privacy. Coinjoin, taproot outputs, coin control, and avoiding address reuse all reduce the statistical fingerprint that clustering algorithms rely on. The goal is to stop looking like a profile. The goal is to stop giving the map a label. Sixth, watch the chain for the money. Large thefts produce observable signals: sudden exchange deposits, consolidation patterns, or a long dormancy that suggests a waiting game. Entropy always finds the path of least resistance, but it also leaves a path. Following it is the only form of accountability that matters in this industry. Seventh, hold the reporting to the standard that the figure demands. A 1,367 BTC claim without methodology is a hypothesis, not a verdict. The industry should demand from Galaxy Research the same rigor it demands from any security researcher: addresses, time windows, transaction hashes, and a reproducible trail. Verify the root, ignore the branch. If the root is a sound device, the branch is the target list. If the root is a cracked seal, the branch is the entire industry. This is the critical moment for hardware wallet culture. It will either mature into a multi-layered discipline with honest threat models, or it will remain a cargo cult built on the fantasy that a device alone can protect a moving target. Coldcard has been the flagship of the fantasy and the best hope of the real solution, all at once. The difference is accountability. Galaxies publish reports. Coinkites publish statements. Users publish their own safety. The chain publishes everything else. Precision is the only apology the truth accepts.