Coldcard Ships Firmware After $114M Bitcoin Theft, But Warns Patch Isn’t a Cure

The difference between a patched wallet and a safe wallet is not always obvious. Coldcard has shipped new firmware after a $114 million bitcoin theft tied to a flaw in its hardware wallet, and the company is drawing that line explicitly.

According to the original report, the update follows three weeks of review that uncovered additional bugs unrelated to the original exploit. But installing the firmware does not make an already compromised wallet safe. The warning is not boilerplate.

A firmware update can close a software path, but it cannot recover a seed phrase or private key that has already been exposed.

If an attacker was able to extract key material through malicious firmware or another vulnerability, the exposed credentials remain dangerous no matter how many patches arrive later.