Coldcard update reports patched seed flaw and larger loss estimate.

What happened.

Coldcard maker Coinkite has shipped fixed firmware after a reported seed-generation flaw allowed attackers to recreate private keys. Galaxy Research now reportedly connects nearly 1,200 drained addresses, holding more than 1,000 BTC, to the issue. The upstream record describes losses of roughly $70 million, though those figures are reported rather than independently verified.

This is an update to prior Coldcard coverage: the new elements are a firmware fix and a larger reported tally of affected funds. The reported exploit did not require attackers to touch the physical devices.

Why it matters.

The distinction between a device update and a vulnerable seed is central. If coins were controlled by private keys created through the affected process, updating firmware alone may not protect those coins. The supplied record says the practical monitoring implication is to move funds off pre-patch seeds.

The case also raises a narrower security question about AI-assisted code review. Coinkite’s NVK suspects an attacker used AI to find the latent flaw in older open-source firmware. That attribution is not established in the supplied evidence.

What to watch next.

Watch for further Coinkite guidance that clarifies which seeds are affected and what remediation is required, alongside additional tracing that either supports or revises the reported address and loss totals. A useful receipt would be a clear, source-backed update connecting the patched firmware, affected seed-generation process, and confirmed remediation steps.