Coldcard exploit analysis

On 31 July 2026, thousands of users of Coldcard hardware wallets suffered at least 2,055 BTC in combined losses, then worth approximately $130 million, after thieves exploited a flaw in the wallet firmware's seed-phrase generation. The flaw was in a 2021 version of the firmware, which affected a wide range of Coldcard devices. The buggy firmware skipped the device's hardware randomness generator and fell back to generating seed phrases from random numbers seeded by the device's serial number and clock registers. The resulting seed phrases were relatively easy to guess, and hackers methodically drained vulnerable wallets as researchers warned that all affected Coldcard devices would eventually be drained if their owners did not move assets to a more secure device. The initial drain saw 594 BTC (~$38 million) taken from about 500 separate wallets in a 25-minute sweep.

The mechanism was weak entropy. Coldcard, made by the Canadian firm Coinkite, normally derives seed phrases from a hardware random number generator on the device. The 2021 firmware version had a code error that caused it to fall back to deterministic values seeded from the device's serial number and clock registers. The set of possible seed phrases generated in that way is much smaller than the set the device was supposed to support, which made them guessable by brute force. Once a guess yielded a wallet with funds, the attacker could sweep the balance. The first attack appeared to target higher-value wallets — only wallets containing 0.15 BTC (~$9,500) or more were impacted, suggesting the attacker had a strategy of prioritising profitable targets. Researchers at Galaxy Digital estimated that around 15 unique groups were involved in the drain.

The figures rose over time. The web3isgoinggreat account put the loss at "at least 2,055 BTC (~$130 million)". CoinDesk reported the initial sweep at "594 BTC (~$38 million)" in 25 minutes. Decrypt reported the cumulative loss at $88 million and growing as the drain continued. Coinkite declined to estimate the loss but said the issue affected only Mk3 devices with the affected firmware. The class-action pressure cited by news.bitcoin.com reported losses of "over 1,300 BTC" at the time of the threatened lawsuit.

The response was a Coinkite firmware patch and a public warning, with the company's email list retaining affected customers' contact information — itself a point of post-incident criticism. Coinkite described itself in marketing materials as "ultra-secure", and the website carried third-party reviews describing the product as "one of the most secure Bitcoin hardware wallets ever built". The fact that the drain was made possible by a 2021 firmware bug that the company did not flag for years made the security framing harder to defend. Coldcard users with affected devices were advised to move funds to a more secure wallet. The retention of customer emails after the disclosure became its own story.

Compared with the other wallet-related losses in the corpus, the Coldcard case is the largest single-vendor hot-and-cold-wallet event of 2026 by software. Hardware wallets are usually marketed as more secure than software wallets because they keep the seed phrase offline, but if the seed phrase generation is flawed, the offline protection is no protection at all. The Coldcard case is the second major supply-chain or generation bug affecting hardware wallets in the corpus, after a separate 2024 Ledger supply-chain incident. The Tripled-A exchange treasury loss of $11.8 million, the Coinsbuy exchange drain of $8 million, and the Bitget centralised exchange loss of $387.5 million are not directly comparable — they are business-side compromises, not seed-phrase generation failures.