Hackers have stolen more than $130 million in Bitcoin from owners of Coldcard hardware wallets by exploiting a coding flaw discovered in 2021, according to blockchain security firms monitoring the incidents.

The Coldcard wallet, made by Coinkite, is intended to keep private keys offline, allowing users to store seed phrases without exposing them to internet connections.

Security researchers said at least a dozen distinct hacker groups have targeted Bitcoin holders using the Coldcard device, as reported by Galaxy Research. The estimated loss of roughly $130 million was confirmed by Tom Robinson, co‑founder and chief scientist of Elliptic. TRM Labs reported more than 200 crypto‑related hacks this year with total losses exceeding $950 million.

Investigators determined that the vulnerability lay in the wallet’s seed‑phrase generation code, which allowed attackers to predict the phrases and brute‑force the corresponding keys, enabling them to access the funds without needing to breach the hardware itself.

Jonathan Goodman, who reported a loss of $1.6 million, said he kept his seed phrase offline and stored his devices in safes, yet the flaw compromised his holdings, as he wrote on X.

Coinkite released an advisory on Thursday and updated it on Saturday, directing users to apply the firmware patch and migrate to a new seed phrase; the company has not responded to requests for comment.

The breach highlights persistent security risks in hardware wallet implementations and underscores the importance of ongoing code reviews and timely patches.