A five-year-old firmware flaw left thousands of Bitcoin addresses vulnerable to brute-force attacks, with victims who did everything right still losing everything. A firmware vulnerability in Coldcard hardware wallets, produced by Coinkite, allowed attackers to drain roughly 1,596 to 1,719 BTC from thousands of addresses, with losses estimated between $100M and $111M. Alex Thorn, from Galaxy Digital’s on-chain analysis team, confirmed the findings through on-chain forensics. But patching a device does not recover lost funds, and it does not fix seeds already generated on vulnerable firmware. Attackers have moved the Bitcoin but have not converted or dispersed it in typical laundering patterns, at least not yet.