Hackers have stolen an estimated $130 million worth of Bitcoin from users of the Coldcard hardware wallet after exploiting a flaw in how the device generated seed phrases, security researchers and the wallet’s manufacturer say.

The attack unfolded in waves. Nearly half of the stolen funds, about $70 million, were drained in just the first 41 minutes after the exploit was put into motion, according to reports tracking the incident. At least a dozen different hackers have been identified targeting Coldcard users since the flaw came to light.

The root cause traces back to a software bug in Coldcard’s firmware dating to March 2021. The bug meant the device was generating seed phrases, the master keys used to recover a wallet, with less randomness than advertised. That predictability allowed attackers to brute-force their way to victims’ seed phrases rather than needing to guess them essentially at random.

So far, three confirmed waves of attacks, along with a number of smaller, separate incidents, have resulted in roughly 1,596 bitcoin stolen from about 7,300 addresses, based on tracking of the affected wallets.

Coinkite, the company behind Coldcard, has warned users that simply updating the device’s firmware will not repair wallets whose seeds have already been compromised. Instead, the company is urging affected users to migrate their funds to newly generated wallets with fresh, uncompromised seed phrases as quickly as possible.

Coldcard has built its reputation on being one of the more security-focused hardware wallets on the market, marketed toward users who want to keep their bitcoin fully offline and out of reach of online attackers. The scale of this breach, with confirmed losses already exceeding $130 million, marks one of the largest thefts to hit hardware wallet users to date and raises fresh questions about how thoroughly randomness and entropy sources are tested in devices designed specifically to protect cryptocurrency holdings.

Bitcoin owners using Coldcard devices are advised to check official channels from Coinkite for the latest guidance on migrating funds safely.