Jonathan Goodman kept his 18.25 $BTC on a Coldcard that had never touched the internet, locked in a safety deposit box. Between 9:36 pm and 9:43 pm on July 29, every wallet he had was emptied — about $1.6 million Canadian dollars, gone in seven minutes.

"Perhaps the hardest part about this is that I did everything right," the Canadian entrepreneur wrote on X in a post that has drawn 7.6 million views. "I never shared my seed phrase with anybody. My devices never touched the internet. Everything was kept in multiple safes and safety deposit boxes. None of it mattered."

Goodman's account is one of dozens filling X and the Bitcoin subreddit since the Coldcard exploit surfaced on July 30, and they share a refrain: the victims followed the self-custody playbook. They bought a hardware wallet from a respected manufacturer, generated seeds offline, stamped backups into steel, and never typed a seed phrase into a connected device.

A firmware bug that made Coldcard-generated seeds guessable rendered all of it moot — attackers have swept roughly 1,816 $BTC, worth some $114 million, from more than 5,200 addresses across four waves of coordinated sweeps.

Goodman said he learned of the hack days after the fact, at his cottage, and checked his balances expecting nothing. "Right away I saw lines of red transaction–withdrawals–and I knew," he wrote. He is filing a police report and a report with the Ontario Securities Commission, but doesn't expect to recover anything.

A Race Against Thieves

Because the flaw allows attackers to reproduce private keys, affected users are not just victims of a past theft — they are in a real-time race to move coins before attackers reach them. Some lost that race by hours.

Tim Lamb was on a family holiday when news of the hack broke on Friday. His Coldcard Mk3 and seed plate were hidden at home. "Not until Saturday evening did I get the idea to ask my neighbour with the house key to find the seed for me," he wrote on X. By Sunday morning, when the neighbor located the plate and Lamb restored the wallet, it read zero. The 2 $BTC had been drained Saturday afternoon.

"This 2 bitcoin was supposed to be to give to my 2 children to give them a good start in life. Makes me tear up to think of it," Lamb wrote, adding: "@Coinkite, if there was any fairness, you would have to pay us our money back."

A pseudonymous Bitcoiner who posts as Marius Off Chain said a friend without access to his device had his Mk2 drained on Sunday morning, the funds consolidated with 890 other inputs into a single address holding 64 $BTC.

The scramble produced grim advice from Bitcoin Core developer Luke Dashjr, who wrote: "This is a tragedy. If you can't get to your Coldcard, find someone who can. Even if you don't trust them with your life savings, worst case at least you'd know who took it!"

'8 Years of Stacking, Gone'

The stories on Reddit run raw. "The Bitcoin subreddit is absolutely heartbreaking right now. So many people have been destroyed," wrote the pseudonymous investor Zynx in a post viewed 3.6 million times.

In one widely shared r/Bitcoin post titled "8 years of stacking, gone. I think it's time to move on," a user going by DuckDuckMoss described accumulating 2 $BTC to escape a sanctioned country's inflating currency. "I'm 39, and I was hoping to have a good financial cushion before 50. But today, my 2 $BTC were drained," they wrote. "I thought I was secure because Cold Card was always praised as one of the best and most secure wallets." The post ends with a renunciation: "I'm done with Bitcoin. I'm not even sure if I still believe in it. Maybe I should have just moved everything into a Bitcoin ETF when they launched."

Another user, posting as Schtuff, said he had been saving since 2015 and stamped his seed in a steel plate. "My life savings was taken from me today. I don't now what to do, I'm lost."

Fleeing the Playbook

For users who saved their coins, the episode is reshaping how they hold them — often in ways that cut against self-custody orthodoxy. A user posting as ACEIN, whose Coldcard Mk4 held retirement savings, described being out of town for a conference, downloading BlueWallet — a mobile hot wallet — importing the 12-word seed, and sending everything to Coinbase after a test transaction. The next move is a choice between a multisig setup, Block's Bitkey, or selling the bitcoin for BlackRock's IBIT ETF. "I am still undecided."

Calle, the pseudonymous developer of the Cashu ecash protocol, called the exploit "worse than any previous Bitcoin exchange hack," writing that many affected users would not hear about the incident in time to respond. "I am truly saddened for everyone affected, especially those who may have just lost their life savings. The worst part is that they did everything right."

'I'm Sorry and I'm Devastated'

Coldcard maker Coinkite has released fixed firmware for every model, halted shipments and destroyed remaining inventory carrying affected firmware. "I'm sorry and I'm devastated. Our team is heartbroken about yesterday's news," CEO Rodolfo Novak, known as NVK, wrote in an open letter, urging anyone who generated a seed on a Coldcard to move funds immediately.

The letter did not address the question hanging over posts like Lamb's: whether Coinkite will compensate users whose coins are already gone.