Coldcard $70M exploit demands custody audit today

A security exploit targeting Coldcard hardware wallets resulted in $70 million in losses. This follows a separately reported incident this week in which 594 BTC were drained through a seed randomness flaw. Binance founder Changpeng Zhao publicly acknowledged that hardware wallets can carry bugs and advised users to spread funds across multiple wallet products. The 25-minute drain window reported in connection with the exploit means there is no practical response time once an attack is underway.

Hardware wallets have been treated as the terminal safe point in crypto custody. That assumption is now broken. Two distinct exploit vectors in a single week, both targeting Coldcard, signal either a systemic vulnerability in the device line or an active, coordinated campaign against it.