Did Bitcoin Get Hacked?

In a little over a month, two security failures put hundreds of millions of dollars in bitcoin at risk.

Attackers first stole roughly 594 BTC from wallets created using vulnerable COLDCARD firmware. Then, nearly 4,000 BTC was withdrawn from reserves associated with Liquid Network.

The network continued producing blocks. Nobody broke Bitcoin's cryptography, created new BTC or rewrote ownership on the blockchain.

The failures occurred in systems built around Bitcoin. COLDCARD failed while generating the secret controlling a wallet. Liquid failed while representing bitcoin outside the base layer.

COLDCARD: When Randomness Stopped Being Random

A Bitcoin wallet begins with a secret, usually represented by 12 or 24 seed words. Those words generate the private keys required to spend the bitcoin held by the wallet.

Their security depends on randomness. If the seed is truly unpredictable, guessing it is practically impossible.

Affected versions of COLDCARD firmware could fall back to a weaker software-based source when generating new seeds. Some seeds could therefore be reconstructed using non-secret device information.

Nothing appeared wrong to the owner. The seed words looked random, the addresses worked and the balance remained visible.

But an attacker did not need the physical device or remote access to it. By reconstructing a vulnerable seed, they could derive its private keys and create valid Bitcoin transactions.

Around 594 BTC was reportedly swept from approximately 500 single-signature wallets in about 25 minutes. CoinDesk

Bitcoin accepted the transactions because they contained valid signatures. The critical failure had happened earlier, when the vulnerable seeds were generated.

Updating the Device Is Not Enough

COLDCARD has released patched firmware for its supported devices. Its guidance currently recommends standard firmware 5.6.2 for Mk4 and Mk5 devices and 1.5.2Q for the Q. COLDCARD Security Status

However, updating the firmware only corrects future seed generation. It cannot make an existing seed more random.

Users whose seeds fall within the affected scope must migrate their bitcoin to a new wallet generated using corrected firmware, unless they satisfy the advisory's independent-dice exception.

Liquid: Bitcoin That Did Not Exist

Liquid is a Bitcoin sidechain. Users lock BTC and receive an equivalent asset called L-BTC. Under normal conditions, every L-BTC should be backed by BTC held in reserve.

Attackers found a way to create approximately 4,000 L-BTC without depositing the corresponding bitcoin.

This did not create new BTC. The counterfeit assets existed only on Liquid.

The loss occurred when the unbacked L-BTC was exchanged through SideSwap's automated peg service. The service accepted the withdrawal requests and released genuine BTC from its funded wallet.

Roughly 4,000 of the approximately 4,200 BTC held in the relevant reserve was withdrawn, worth about $320 million at the time. Reuters

Again, Bitcoin processed valid transactions. It could not determine that the economic claims behind them originated from unbacked L-BTC.

Bitcoin verifies transactions. It does not verify promises made by external systems.

The “White Hats” Holding Hundreds of Millions

The people behind the Liquid incident described themselves as white-hat hackers and communicated through on-chain messages.

After a patch was deployed, approximately 85% of the withdrawn bitcoin was returned. Around 600 BTC remained unreturned as of September 9. Chainalysis

The incident also exposed a disclosure failure.

According to SideSwap, a fix for the underlying Elements vulnerability was written on August 3 and privately distributed to Liquid members on August 12. The fix was merged into the public repository on September 1, before a released version containing it was available.

The public change described the vulnerability while production systems remained exposed. Days later, the large withdrawal occurred. SideSwap

A public fix can become a guide to the vulnerability it repairs. Publishing it before affected systems have upgraded creates a race between defenders and attackers.

Bitcoin's Security Does Not Automatically Transfer

The two incidents failed at opposite ends of Bitcoin ownership.

COLDCARD weakened the secret used to control bitcoin. Liquid allowed unbacked claims to be exchanged for real bitcoin.

Both challenge the assumption that any system using Bitcoin automatically inherits Bitcoin's security.

A hardware wallet can generate a weak seed. A sidechain can issue an unbacked asset. A custodian can lose its keys. A service can authorise an invalid withdrawal.

Each additional layer introduces its own assumptions and failure points.

“Don't trust, verify” becomes difficult when critical processes remain invisible to ordinary users. Most people cannot inspect whether a hardware wallet collected genuine entropy. An L-BTC holder cannot independently prove at every moment that the entire circulating supply remains backed and redeemable.

Open-source code, reproducible builds, multisignature setups, independent reviews and personal entropy can reduce specific risks. None removes every risk.

What You Can Do

Start by identifying where your bitcoin is exposed. Is it protected by a hardware-generated seed? Held through a sidechain? Deposited with a custodian? Controlled through multisignature?

If You Generated a Seed Using Affected Firmware

• Check your firmware version and seed-generation method.
• Install and verify the latest recommended firmware.
• Remember that updating does not repair an existing affected seed.

If You Use Liquid or Another Bitcoin-Linked Network

• Confirm whether deposits, withdrawals and peg operations are functioning.
• Understand who controls the bitcoin backing the issued asset.
• Do not assume that an asset labelled “BTC” has the same security properties as bitcoin on the base layer.
• Keep only the amount required for the activity you are performing.
• Return long-term holdings to keys you control when the additional system is no longer needed.

Finally, map the dependencies in your setup:

Seed generation → Signing device → Wallet software → Network or service → Recovery backup

Your security is limited by the weakest part of that chain.

Bitcoin survived both incidents. Yet, that is little comfort to someone who lost their coins.

The base layer can enforce valid signatures. It cannot guarantee how the keys were created, who controls them or whether promises made outside the blockchain are true.

Frequently asked questions

Did Bitcoin get hacked?

No. Nobody broke Bitcoin's cryptography, created new BTC or rewrote ownership on the blockchain. The network continued producing blocks. The failures occurred in systems built around Bitcoin: COLDCARD firmware used to generate wallet secrets, and Liquid Network's representation of bitcoin outside the base layer.

What happened in the COLDCARD Bitcoin wallet incident?

Affected versions of COLDCARD firmware could fall back to a weaker software-based source when generating new seeds. Some seeds could be reconstructed using non-secret device information. Around 594 BTC was reportedly swept from approximately 500 single-signature wallets in about 25 minutes. Bitcoin accepted the transactions because they contained valid signatures.

Does updating COLDCARD firmware protect an existing seed?

No. Updating the firmware only corrects future seed generation. It cannot make an existing seed more random. Users whose seeds fall within the affected scope must migrate their bitcoin to a new wallet generated using corrected firmware, unless they satisfy the advisory's independent-dice exception.

What COLDCARD firmware versions are recommended?

COLDCARD currently recommends standard firmware 5.6.2 for Mk4 and Mk5 devices and 1.5.2Q for the Q.

What happened on the Liquid Network?

Attackers found a way to create approximately 4,000 L-BTC without depositing the corresponding bitcoin. The unbacked L-BTC was exchanged through SideSwap's automated peg service, which released genuine BTC. Roughly 4,000 of the approximately 4,200 BTC held in the relevant reserve was withdrawn, worth about $320 million at the time.

Did the Liquid incident create new bitcoin?

No. The counterfeit assets existed only on Liquid. Bitcoin processed valid transactions; it could not determine that the economic claims behind them originated from unbacked L-BTC.

How much bitcoin was returned after the Liquid incident?

After a patch was deployed, approximately 85% of the withdrawn bitcoin was returned. Around 600 BTC remained unreturned as of September 9.

Does using Bitcoin automatically inherit Bitcoin's security?

No. A hardware wallet can generate a weak seed. A sidechain can issue an unbacked asset. A custodian can lose its keys. A service can authorise an invalid withdrawal. Each additional layer introduces its own assumptions and failure points. Bitcoin can enforce valid signatures; it cannot guarantee how the keys were created, who controls them or whether promises made outside the blockchain are true.