What Happened
Beginning July 30, 2026, attackers systematically exploited a five-year-old firmware bug in Coinkite’s Coldcard hardware wallet to drain bitcoin from thousands of addresses. Over four days, three waves of attacks drained approximately 1,816 BTC (worth ~$116 million) from 5,200+ vulnerable wallets.
The root cause: a March 2021 firmware update contained a build configuration error that caused seed generation to fall back on a weak software random number generator instead of the device’s cryptographically secure hardware entropy source. This flaw remained unpatched for over five years, exposing every Coldcard user who generated a seed during that window.
Why Cold Storage Failed
Coldcard’s brand promise is that the device generates private keys in complete isolation from the internet, making it “the safest” way to hold Bitcoin. Yet the hack shows that even cold storage can be compromised if the device’s firmware is flawed.
The attack was not a network breach or physical theft. Attackers simply predicted the private keys by simulating the weak random number generator with the same timestamp and conditions as the vulnerable Coldcards. Once they had the private keys, transferring the bitcoin was trivial.
Galaxy Research estimates that at least 1,816 BTC in exploited wallets were drained. The actual number of affected devices is likely much higher — some users may not have noticed the theft, or may be waiting to move their funds.
Impact on the Ecosystem
This is the third-largest crypto hack of 2026, behind two other major exploits. The year has already seen 276 separate incidents totaling $1.2 billion in losses. The Coldcard incident is particularly damaging because it undermines confidence in cold storage — the last line of defense for paranoid investors.
Hardware wallet manufacturers like Ledger, Trezor, and others now face increased scrutiny. Users are questioning whether their devices are truly secure, or whether years-old bugs lurk in their firmware waiting to be discovered.
What You Must Do
If you own a Coldcard and generated your wallet seed between March 2021 and the patch:
- Check your firmware version immediately. Go to Coinkite’s official website and compare your device’s version to the patched release.
- If vulnerable, migrate your funds. Move all bitcoin from the affected wallet to a new seed on a patched device or a different hardware wallet. Do this today.
- Do not move small amounts to test. Use a single transaction to move all funds at once to minimize fees and reduce your exposure window.
- Update and verify. After upgrading your Coldcard firmware, generate a new seed and move funds to that wallet. Do not reuse the old seed under any circumstances.
The theft is not reversible — Bitcoin transactions cannot be undone. Your only option is to secure any remaining funds before attackers find them.
The Broader Lesson
This hack illustrates a painful truth: even the most paranoid security practices can fail if the devices you trust contain subtle bugs. The Coldcard team did not intend to leave a backdoor open for five years, and the vulnerability was not obvious from the outside.
Going forward, hardware wallet manufacturers must invest in:
- Firmware audits by independent security firms
- Bug bounty programs that reward researchers for finding issues
- Transparent update schedules so users know when patches are critical
For users, the takeaway is clear: regularly update your hardware wallet firmware, and if you discover you were using a device during a vulnerable period, move your funds immediately. Trust, but verify — and in crypto, verify often.
Advertisement
Sources and review
This article was checked against the primary or authoritative sources below .
- $116M stolen from crypto cold wallets in security breach — Yahoo Finance
- Coldcard Bitcoin Wallets Compromised as Hackers Exploit Software Flaw — Bloomberg
- The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack — TRM Labs
- Bitcoin at Center of $1.2 Billion Crypto Hack Wave Spanning 276 Exploits — COINOTAG
Frequently asked questions
A March 2021 firmware update introduced a build configuration error that caused seed generation to fall back on a weak software random number generator instead of the device's hardware-based entropy source. This flaw affected Coldcard devices used to generate wallet seeds between March 2021 and the patch. Attackers exploited this to predict private keys and drain funds.
Galaxy Research's analysis identified approximately 1,816 BTC stolen across 5,200+ addresses, worth close to $116 million at August 2026 prices. The theft happened in waves beginning July 30, 2026, with attackers systematically draining vulnerable wallets over several days.
Only if you generated a wallet seed on a Coldcard between March 2021 and the firmware patch are you at risk. If you generated your seed before March 2021 or after the patch was released, you are safe. Check Coinkite's official website for your device's firmware version and upgrade to the latest patch immediately if you fall in the vulnerable window.
First, check if your Coldcard was used to generate a seed during the vulnerable period. If yes, immediately migrate all funds from that wallet to a new seed generated on a patched Coldcard or a different hardware wallet. Do not delay. Second, verify your firmware version and upgrade if necessary. Third, monitor affected addresses for any remaining balance that needs to be moved.
Yes. The year has already seen 276 separate exploits resulting in $1.2 billion in total losses. The Coldcard hack ranks third by size, after two larger breaches. This incident highlights that even cold storage — long considered the safest way to hold Bitcoin — can be compromised if the device's seed generation is flawed.
No. The flaw was specific to Coldcard's firmware implementation, not Bitcoin's underlying cryptography or blockchain. The vulnerability existed in how the device generated private keys, not in Bitcoin's security model. Properly generated Bitcoin private keys remain mathematically secure.
Advertisement