Bitcoin hardware wallets are considered one of the safest ways to store cryptocurrency because they keep private keys offline. This protects them from many online threats, such as malware, phishing, and exchange hacks. However, the Coldcard hack showed that offline storage is only as secure as the software that creates the wallet’s keys. In late July 2026, attackers exploited a weakness in some Coldcard firmware versions and drained Bitcoin from thousands of wallets. Within a few days, estimated losses exceeded $130 million, affecting more than 7,000 wallets. The incident shows that keeping a wallet offline is not enough. Every part of the security process must work properly to keep cryptocurrency safe.

Note: The Cryptolenz editorial team will continue updating this article as new findings about the Coldcard hack emerge. Last updated on August 7, 2026.

Quick Summary

Category	Details
Incident	Coldcard Hardware Wallet Hack
Root Cause	Firmware entropy (random number generation) bug introduced in March 2021
Attack Method	Reconstruction of weak wallet seeds and private keys- no physical device access required
Estimated Losses	More than $130 million in Bitcoin
Affected Wallets	Approximately 7,000+ addresses
Bitcoin Network Compromised?	No
Firmware Patched?	Yes
Existing Vulnerable Wallets Safe After Update?	No - seeds must be regenerated
Recommended Action	Generate a brand-new wallet and migrate all funds immediately

Key Takeaways

1. A firmware flaw in Coinkite's Coldcard hardware wallet weakened the randomness used to generate wallet seeds, tracing back to a March 2021 code change.

2. Attackers did not need physical access to a device, its PIN, or malware on a victim's computer; they exploited predictable seed generation to reconstruct private keys from scratch.

3. Losses are estimated at $130 million+ in Bitcoin across roughly 7,300 addresses, according to Galaxy Research, TRM Labs, and CertiK.

4. Coinkite has released patched firmware, but existing vulnerable seeds remain at risk until funds are moved to a brand-new wallet.

5. This is being called one of the worst self-custody security failures in Bitcoin's history and a wake-up call for how "offline" hardware wallets are actually secured.

Table of Contents

1. What Happened: The Coldcard Hack, Explained

2. Timeline of the Attack

3. Why the Vulnerability Was So Dangerous

4. Which Coldcard Devices Are Affected?

5. Where Did the Stolen Bitcoin Go?

6. Coinkite's Response

7. What Should Coldcard Users Do Now?

8. Does This Affect Other Hardware Wallets?

9. Security Lessons for Every Crypto Investor

What Happened

The Coldcard hack wasn't an attack on Bitcoin itself, and it wasn't a case of someone physically stealing a device out of a safe. It was something far more unsettling for self-custody advocates: a software bug that made supposedly random wallet seeds predictable.

Coldcard, made by Canadian company Coinkite, is one of the most popular Bitcoin-only hardware wallets on the market prized precisely because it's designed to generate and store private keys entirely offline. That's what made this incident so damaging: the flaw meant an attacker sitting anywhere in the world could reconstruct a victim's private keys without ever touching their device.

Coinkite's core message to users: "Updating your firmware alone does not make an existing wallet safe."

Coinkite traced the root cause to a firmware and library migration made in March 2021. During that update, the process used to generate wallet seeds was unintentionally rerouted away from Coldcard's dedicated hardware random-number generator and toward a much weaker software-based fallback. On the oldest affected models, researchers estimate the effective randomness collapsed from an intended 128 bits down to roughly 40 bits, the difference between a computationally impossible brute-force attack and a feasible one. The bug sat undetected inside trusted firmware for more than five years before attackers began exploiting it at scale.

Timeline of the Attack

Date	Development
March 2021	Vulnerable firmware/library migration introduced (root cause)
July 29 - 31, 2026	First large-scale sweeps detected; 1,082 BTC drained from 1,196 addresses in 41 minutes, Coinkite CEO Rodolfo Novak publicly urges all users to move funds immediately
Aug 2 - 7	Losses climb to 1,367 BTC from 4,500+ addresses ($89M), TRM Labs ties losses to 1,816 BTC from 5,200+ addresses ( $116M), Galaxy Research and CertiK estimates surpass $130M across 7,300 wallets

The scale and speed of the very first sweep suggested the attacker had already built a large database of cracked seeds and private keys before the theft even began. Because some victims still haven't discovered their funds are gone, and investigators are still separating the original exploit from copycat activity, the final total is expected to keep climbing.

Why the Vulnerability Was So Dangerous

A standard 12-word Bitcoin seed is designed to carry about 128 bits of entropy, a number so astronomically large that guessing it is considered computationally impossible with any existing technology.

The Coldcard flaw shattered that assumption for affected devices:

1. Mk2 and Mk3 models: effective security fell to roughly 40 bits

2. Mk4, Mk5, and Q models: partially protected by additional secure-element entropy, but still estimated at only around 72 bits instead of the intended 128

Forty bits might sound like a lot, but in cryptographic terms it's a completely different category of problem. With enough computing power and knowledge of how the flawed seed-generation process worked, attackers could systematically generate candidate seeds, check them against known Bitcoin balances, and derive working private keys, all without needing the physical wallet.

The Technical Root Cause

The bug traces to a 2021 migration in which Coldcard moved its elliptic-curve cryptography to Bitcoin Core's widely trusted “libsecp256k1” library, using a new embedded library called “libNgU”. As part of that change, seed generation shifted from Coldcard's device-specific hardware RNG call to a generic software function that, due to a build configuration error, silently fell back to a weak pseudo-random number generator instead of the intended hardware entropy source. Because both the correct hardware RNG code and the flawed fallback code existed side-by-side in the firmware, the bug was easy to miss during code review; anyone auditing the source could see the secure code path without realizing wallet seeds never actually reached it.

Which Coldcard Devices Are Affected?

Device / Firmware Track	Vulnerable Versions	Fixed Version
Coldcard Mk2 / Mk3	4.0.1 – 4.1.9	4.2.0+
Coldcard Mk4 / Mk5 (standard)	Before 5.6.0	5.6.0+
Coldcard Mk4 / Mk5 (Edge)	Before 6.6.0X	6.6.0X+
Coldcard Q (standard)	Before 1.5.0Q	1.5.0Q+
Coldcard Q (Edge)	Before 6.6.0QX	6.6.0QX+

Coinkite has confirmed that original Mk1 devices, along with TAPSIGNER, OPENDIME, and SATSCARD, run on different codebases and were not affected.

Important: Updating your firmware today does not retroactively fix a seed that was already generated on vulnerable firmware. It only ensures any new seed you generate going forward is secure.

Where Did the Stolen Bitcoin Go?

Early on, blockchain analysts observed that most of the stolen Bitcoin was being consolidated into a relatively small number of attacker-controlled wallets, with little evidence of laundering. That began to shift by early August: on-chain trackers at CertiK identified roughly 64 BTC connected to the exploit moving through the Bitcoin mixing service Wasabi, along with around 200 ETH tied to related activity flowing into Tornado Cash. No single group has been publicly identified as responsible, and differing transaction patterns across the various attack waves suggest multiple independent actors, possibly including copycats who reverse-engineered the vulnerability after Coinkite's public disclosure.

Coinkite's Response to the Coldcard Hardware Wallet Hack

Following discovery of the vulnerability, Coinkite publicly acknowledged the issue and released a detailed technical explanation of how the bug occurred. The company emphasized that the incident was not caused by a compromise of Bitcoin itself or a breach of Coldcard's infrastructure; it stemmed from an entropy-generation error introduced during the 2021 firmware migration.

To limit further damage, Coinkite has:

1. Released patched firmware for all affected product lines

2. Published technical documentation explaining the vulnerability

3. Halted shipments of devices running vulnerable firmware

4. Removed remaining vulnerable inventory from distribution

5. Coordinated with blockchain security researchers and industry partners

6. Begun working with law enforcement agencies investigating the theft

Coinkite has also acknowledged it was unaware of the defect prior to the attacks, noting that the bug may have ultimately surfaced through AI-assisted code review even though the company's own internal AI-assisted audit earlier in 2026 failed to catch it.

What Should Coldcard Users Do Now?

If you generated a wallet on affected firmware, assume the recovery seed could eventually be reconstructed by an attacker even if your wallet hasn't been targeted yet. Migrating to a new wallet is the safest course of action.

Step 1: Stop Using the Existing Wallet

Do not send any new Bitcoin to addresses derived from the old seed. Every additional deposit increases your potential exposure.

Step 2: Install the Latest Firmware

Download and install the latest official firmware for your specific Coldcard model, obtained only from Coinkite's official channels.

Step 3: Generate a Brand-New Wallet

Create an entirely new recovery seed using the updated firmware, which uses the corrected entropy-generation process.

Step 4: Verify the Backup

Before transferring funds, confirm every recovery word, verify the wallet fingerprint and check the first receiving address displayed on the device. Small mistakes during backup can permanently lock you out of your Bitcoin.

Step 5: Test the New Wallet

Before moving your entire balance, send a small test amount of Bitcoin, wait for confirmations, verify the transaction arrived correctly and confirm you can access the new wallet

Step 6: Transfer All Funds

Once testing succeeds, move your remaining Bitcoin, double-check the destination address on the Coldcard screen and wait until every transaction is confirmed. Once complete, stop using addresses associated with the old seed entirely.

Step 7: Keep the Old Recovery Phrase Safe (But Unused)

Don't destroy your old seed immediately; it may still be useful for verifying historical transactions, supporting insurance or legal claims, or assisting investigations. However, never enter the old recovery phrase into a website, software wallet, browser extension, or smartphone app.

Does This Affect Other Hardware Wallets Like Ledger or Trezor?

No, based on current evidence. There is no indication this firmware vulnerability impacted other popular hardware wallets, including:

1. Ledger

2. Trezor

3. BitBox

4. Blockstream Jade

5. Bitkey

The vulnerability was tied to a specific firmware and build-integration path used only by certain Coldcard devices. That said, the incident is a reminder that every hardware wallet depends on more than secure hardware. Firmware quality, cryptographic implementation, testing procedures, and software supply-chain security are all essential parts of a secure self-custody solution.

Security Lessons Every Crypto Investor Should Learn

1. Offline Doesn't Mean Invulnerable

Keeping private keys offline protects against many common threats, but it doesn't eliminate every risk. If the seed is generated incorrectly, an attacker may never need physical access to the device.

2. Randomness Is the Foundation of Wallet Security

Every Bitcoin wallet ultimately depends on one thing: a truly unpredictable recovery seed. Weak entropy can undermine even the most advanced hardware security features.

3. Firmware Matters as Much as Hardware

Users often focus on the physical device while overlooking firmware updates. Always install security updates promptly and monitor announcements from wallet manufacturers.

4. Follow Official Security Advisories

Security researchers and wallet manufacturers regularly publish vulnerability disclosures. Subscribing to official updates can help you respond quickly if a new issue is discovered.

5. Consider Multisignature for Large Holdings

Investors managing significant Bitcoin holdings may benefit from a multisignature (multisig) setup. By requiring approvals from multiple independent devices, multisig reduces reliance on any single hardware wallet or firmware implementation. It's more complex to manage, but it adds meaningful protection against single points of failure.