Dangerous experiment with Coldcard: how quickly hackers drain vulnerable wallets
Well-known researcher and blogger Cole conducted a provocative public test that exposed an alarming reality: Coldcard hardware wallets, considered the gold standard of security, can be compromised in a matter of minutes. During the experiment, he generated a secret phrase on a Coldcard Mk3 device and created five wallets, each receiving the same amount in satoshis. The goal was to test how quickly automated scanners used by attackers would detect and drain these addresses.
The entire process was documented on video to ensure maximum transparency. The test was prompted by a recent high-profile Coldcard hack incident that had already shaken confidence in the brand.
Experiment Details and Methodology
For the sake of a clean study, Cole used a Coldcard Mk3 with firmware version 4.1.8, which he considers the most vulnerable. Notably, the issue potentially affects newer models as well — Mk4, Mk5, and Q. The device automatically generated a new secret phrase, from which five different wallet configurations were created:
1. A standard wallet without an additional passphrase.
2. A wallet with a passphrase consisting of one word from the BIP39 list.
3. A wallet with a passphrase consisting of two BIP39 words.
4. A wallet with a passphrase consisting of three BIP39 words.
5. A wallet with an arbitrary account number (from 1 to 9999).
To keep conditions identical, the researcher used a single address standard (bc1q), the same key derivation path, funded each address with 10,800 satoshis, and sent all funds in a single transaction. An interesting technical nuance: direct export of public keys to the Sparrow program caused a crash — the device stopped responding to commands, so the data had to be saved via CSV files to an SD card.
Results: Instant Theft
The results were shocking but predictable. The base wallet without a passphrase lost its balance almost instantly. As soon as the researcher opened the mempool explorer, the funds had already been moved to a new unknown address. This means hackers had pre-loaded the compromised keys into their bots and were waiting for the moment of funding.
Cole deliberately declined to use the RBF (Replace-By-Fee) mechanism to recover the funds, so as not to compromise the integrity of the experiment. The other four wallets — with passphrases and a non-zero account number — remained untouched. Nevertheless, the very fact that a secret phrase without additional protection is completely vulnerable is beyond doubt. Monitoring of address activity continues in real time.
My comment: This experiment is yet another reminder that even the most reliable hardware is useless without proper security hygiene. Using a BIP39 passphrase is not just a recommendation but a mandatory requirement for those storing significant amounts. Hackers do not break cryptography — they exploit human laziness and neglect of basic rules.