Hardware Wallet Flaw Blamed for Nearly $90 Million in Bitcoin Thefts

Researchers have identified a critical security flaw in certain Coldcard hardware wallets that appears to have enabled the theft of approximately 1,367 Bitcoin—worth close to $90 million—from more than 4,500 addresses. Hardware wallets are physical devices designed to store cryptocurrency offline, away from internet-connected systems, and are generally considered one of the safest ways to hold digital assets.

This incident is a reminder that even devices marketed as highly secure can contain vulnerabilities that attackers can exploit at scale. For businesses that hold or transact in cryptocurrency, this kind of flaw highlights the importance of keeping device firmware updated, verifying vendor security advisories, and not assuming that any single security product is infallible.

While most small businesses may not deal directly with hardware wallets, the broader lesson applies to any organisation relying on specialised hardware for security: regularly check for manufacturer updates and advisories, and have a plan for responding quickly if a device you use is found to be compromised.