Major Coldcard Hack Exposes $116 Million Vulnerability in Bitcoin Wallets

Major Coldcard Hack Exposes $116 Million Vulnerability in Bitcoin Wallets

A significant security breach involving Coldcard hardware wallets has resulted in the loss of approximately $116 million, revealing a critical vulnerability tied to the device’s firmware.

Vulnerability Overview

In March 2021, a configuration error in Coldcard firmware version 4.0.1 caused the wallets to redirect seed generation from a dedicated randomness chip to a deterministic software pseudorandom number generator. This error reduced the effective entropy from 128 bits to around 40 bits for Mk3 devices and between 72 bits for Mk4, Mk5, and Q models. For five years, users remained unaware of the risk, as the flawed firmware consistently generated weak private keys.

Details of the Attack

The exploit, which began on July 30, 2026, unfolded in four waves. During the first wave, an attacker drained 1,082 BTC within 41 minutes from more than 1,196 addresses. Following this, total confirmed losses reached 1,596 BTC across three additional waves, with estimates suggesting that as much as 2,055 BTC could eventually be stolen if a suspected fourth wave is confirmed.

Impact on the Crypto Community

The incident has prompted a significant shift in user behavior, with a net transfer of Bitcoin from self-custody wallets to exchanges observed for the first time since the FTX collapse. Hardware wallet manufacturers are now facing increased pressure to conduct independent audits of their seed generation methodologies.

Community Reaction

Notably affected users expressed outrage on social media, with one entrepreneur highlighting the irony of their loss despite following best security practices. “I did everything right,” lamented Jonathan Goodman, who lost a substantial amount stored on a Coldcard, reflecting the sentiment of many community members who had relied on the security assurances of Coldcard wallets.

Looking Forward

The aftermath of the Coldcard hack raises significant questions regarding the integrity of self-custody practices in the cryptocurrency space. With around 90% of stolen Bitcoin still unmoved in attacker-controlled addresses, the incident serves as a sobering reminder of the need for rigorous auditing in digital asset security.