Fifty-two Bitcoin left wallets. A white hat caught roughly 40% of it mid-flight. The rest β about 31 BTC β is still moving. That is the entire factual surface of the Coldcard exploit as reported, and it is already enough to tell you which questions matter and which ones the market is conveniently ignoring.
Ledgers do not forgive, they only record. So let me record what actually happened before the narrative hardens.
Context: What Coldcard Actually Is
Coldcard is manufactured by Coinkite, a Canada-based firm. It is a Bitcoin-only hardware wallet β no altcoin support, no Bluetooth, no companion app chasing engagement metrics. Air-gapped by design. Open firmware. It sells to the hardest slice of the self-custody market: people who already accept that "not your keys, not your coins" is a literal constraint, not a slogan.
That positioning matters enormously here. Coldcard's entire commercial moat is the claim that it is the most paranoid device on the shelf. Not the most convenient. Not the most integrated. The most defensible. When an exploit lands against that device, the damage is not measured in satoshis β it is measured in the collapse of a premise.
I audited fifteen ERC-20 contracts in late 2017 for an angel syndicate managing $500,000. I found a reentrancy flaw in a contract two weeks before it drained. The team withdrew $200,000. The rest stayed and died. That experience taught me something that applies directly here: the size of a loss tells you almost nothing. The disclosure trail tells you everything.
Right now, the disclosure trail is empty.
Core: Reading the Order Flow
The single most important word in the reporting is "second wave."
A second wave is not an accident. It is a schedule. An attacker who returns to extract additional funds after an initial strike is operating with persistence β either retained access, a repeatable exploit path, or a list of affected addresses. Single-shot attacks look like phishing. Staged attacks look like systematic access.
Let me be explicit about what that implies. If the exploit were a one-time phishing success against a careless user, there would be no second wave, because the attacker would have already taken everything reachable. The second wave suggests the attacker could not drain everything at once β constrained by liquidity, by UTXO structure, or by the need to avoid triggering automated monitoring.
That constraint is exactly where the white hat operated.
A white hat recovering 40% is not a victory. It is evidence that the attacker was sloppy in the first hours. Funds that can be intercepted are funds that were still sitting in identifiable addresses, unmixed, unbridged, unspent. The white hat did not out-cryptography the attacker. The white hat out-timed him. Alpha is found in the friction, not the flow β and the friction here was the attacker's own settlement delay.
Now examine the destination: a Wyoming trust.
This is the detail most coverage will gloss over, and it is the one I would put at the top of the page. Wyoming has spent years building the most crypto-permissive legal scaffolding in the United States β SPDI banking charters, DAO LLCs, and trust structures explicitly designed to hold digital assets. Routing recovered Bitcoin into a Wyoming trust is not an operational choice. It is a legal one.
Why does that matter? Because a trust creates a trustee. A trustee creates fiduciary duties. Fiduciary duties create a paper trail, a claims process, and β critically β a jurisdictional hook if the attacker is ever identified.
But it also creates a problem. Who authorized the white hat to move those funds? Under what instrument? If the answer is "nobody yet," then the 21 BTC sitting in that trust is not recovered β it is parked in a legal grey zone, awaiting a claimant who has not been named.
Contrarian: The Narrative Is the Vulnerability
The story being told is that a white hat beat a hacker. It is dramatic, it is clean, and it is dangerous.
Liquidity evaporates when trust hits the floor β and trust in hardware wallets is the liquidity of the entire self-custody thesis. Every person who bought a Coldcard did so because they believed the device's threat model was airtight. That belief is now under audit, and the audit has not been published.
Three questions remain completely unanswered:
One: Is this a product-level flaw or a targeted attack? If it is product-level, 52 BTC is not the victim count β it is the sample size of a much larger exposed population. If it is targeted, the incident is tragic but contained. The reporting does not distinguish between these, and the difference is the difference between a firmware recall and a footnote.
Two: What did Coinkite know, and when? The manufacturer is absent from the narrative entirely. No firmware advisory, no vulnerability disclosure, no timeline. For a company whose product promise is verifiability, silence is the loudest possible signal.
Three: Can the remaining 31 BTC be traced? Every hour of delay increases the probability of mixing. Wasabi, JoinMarket, cross-chain bridges β the tooling for obfuscation is mature and cheap. The window where intervention is possible closes fast, and it has likely already closed.
The framing of "40% saved" quietly reframes a 60% loss as a partial win. That is not analysis. That is anesthesia.
Takeaway
Due diligence is the only hedge you control, and for hardware wallet holders that means three concrete actions today.
First, verify your firmware version against Coinkite's official channel β not social media, not aggregator blogs. Until a root-cause disclosure exists, treat any device that has held significant balances as potentially compromised and rotate keys to a freshly generated seed on a device you have independently verified.
Second, stop treating single-device self-custody as terminal security. Multisig with geographically separated keys is not paranoia anymore. It is standard practice, and this incident is the argument for it.
Third, watch the trust. If a public claims process for the 21 BTC never materializes, the recovery was cosmetic. Data speaks, but only if you know how to listen β and the data here is not the 40%. It is the silence around the other 60%.
The exploit is over. The audit has not started. That gap is where the next loss is being written.