A firmware glitch in Coldcard hardware wallets turned the most trusted device in crypto into a liability. Starting July 30, 2026, attackers began draining wallets at scale, sweeping 1,082 BTC in just 41 minutes during the first assault. By the time Coinkite pushed an emergency patch the next day, over 1,596 confirmed bitcoins had vanished, with estimates suggesting the total could hit 2,055 BTC once all waves are tallied. That is roughly $130 million in losses.
The culprit was microscopic. In March 2021, someone shipped firmware version 4.0.1 with a single misplaced build flag. Instead of generating random seeds using the device's dedicated hardware randomness chip, Coldcard silently defaulted to a software pseudorandom number generator. On older Mk3 units, this collapsed entropy from 128 bits down to 40 bits. On newer models, it dropped to 72 bits. Weak enough that a motivated attacker could brute-force the keys in under an hour.
For five years, nobody caught it. Users thought they were storing bitcoin in the safest possible way, moving coins to addresses that looked secure. They were not. The device worked fine, displayed balances correctly, signed transactions without complaint. The vulnerability was invisible until someone realized the seeds could be guessed.
What makes this sting is the simplicity of what users did wrong. Nothing. They followed every best practice. They used a hardware wallet instead of keeping coins on an exchange. They wrote down their seed phrases. They stored them offline. They did everything the self-custody movement preaches, and it failed them anyway because the code they trusted had a bug they could never have detected.
Coinkite's patch arrived on July 31, but it only stops future damage. The firmware update cannot repair seeds that were already compromised. Every affected user must generate a brand new seed and manually migrate their remaining funds to fresh addresses. For some, the coins were gone before they even knew to move.
The aftermath has been brutal for self-custody confidence. Bitcoin has been flowing back to exchanges every single day since the exploit, reversing a two-year trend of users pulling coins off platforms after the FTX collapse. OKX reported record inflows in the days following the incident. Roughly 90% of the stolen bitcoin remains sitting at attacker-controlled addresses, unmoved and waiting.
This is the third-largest crypto hack of 2026, pushing the year's total theft past $1.2 billion across 276 incidents. But the Coldcard breach feels different because it exposes a structural problem nobody wanted to acknowledge. When you generate your own keys, you depend on code you cannot audit. You trust the manufacturer, the firmware developers, the build process, the supply chain. One mistake in any of those layers and your coins are gone. There is no insurance, no customer service, no way to reverse it.
This article is for informational purposes only and does not constitute financial advice. Hardware wallet security and recovery strategies should be reviewed with qualified professionals.
