COLDCARD

Between July 30 and 31, 2026, attackers began draining Bitcoin from Coldcard hardware wallets made by Coinkite, exploiting a five-year-old firmware bug that caused some seed phrases to be generated with far less entropy than intended. Across four waves of theft running into early August, roughly 1,816 BTC — tracked at $115 million by DefiLlama and $116 million by TRM Labs and Galaxy Research — was swept from more than 5,200 addresses, making it the third-largest crypto hack of 2026.

How the attack works

Hardware wallets derive a seed phrase from entropy — random data normally sourced from a hardware random-number generator inside the device, giving the intended 128 bits of strength behind a standard BIP-39 seed. Coldcard firmware version 4.0.1, released in March 2021, contained a flaw in how that hardware-derived value was combined with optional user input such as dice rolls. On affected devices this collapsed the effective entropy of newly generated seeds to somewhere between roughly 40 and 72 bits instead of 128, depending on the model — Mk2/Mk3 versus Mk4/Mk5/Q — according to TRM Labs and Coinkite's own advisory.

A key space that small is brute-forceable: with enough compute, an attacker can systematically generate candidate private keys within the weakened range and check the corresponding Bitcoin addresses for a balance — without ever touching the victim's device, seed phrase, or any credential. This isn't theft in the usual phishing or malware sense; it's a mathematically bounded key space being scanned and swept, largest balances first. Transaction patterns differed across the four waves, which Galaxy Research read as several independent actors racing through the vulnerable key space in parallel rather than one coordinated operation.

Yieldo's database classifies this technique as Non-Random Private Key Generation, which is an accurate label: nothing was stolen from a user in the conventional sense — keys were generated predictably and then guessed.

What happened next

Coinkite published a security advisory on July 30, 2026, acknowledging the flaw and shipping fixed firmware (5.6.0 for Mk4/Mk5, 1.5.0Q for Q, and a patch for Mk2/Mk3 above version 4.1.9). It urged anyone whose seed was generated on vulnerable firmware to treat it as compromised and migrate funds immediately, calling the following days "some of the hardest in this company's history" per news.bitcoin.com.

By August 3–4 a fourth wave was still active, with Galaxy Research clocking sweep activity at roughly 45 times the pre-incident baseline. Some victims attempted Replace-By-Fee to reclaim unconfirmed transfers, which only worked if the attacker's sweep hadn't already confirmed on-chain. Laundering moved slowly and cautiously — by August 4, trackers had observed just one 64.9 BTC deposit to Wasabi Wallet and a 200 ETH transfer into Tornado Cash. No public fund recovery, arrests, or compensation from Coinkite had been reported as of this writing; the incident also pushed July 2026 to the second-worst month of the year for crypto theft, per Cointelegraph.

What this means

• The category hit here is the one usually assumed safest: cold storage protects against remote compromise and phishing, but not against a defect in the device's own firmware — entropy quality doesn't depend on whether the wallet is online or offline.
• A bug like this is invisible to the user in advance. A seed phrase looks like an ordinary random word list either way; there's no way to independently verify entropy quality without a firmware audit or an entropy dump, so the only warning came from the vendor's own advisory.
• The flaw sat undetected for five years, from March 2021 to July 2026 — considerably longer than the typical window in which smart-contract bugs get found or exploited. For firmware risk, "it has run fine for years" is not evidence of safety.
• Users who had added a BIP-39 passphrase (a 25th word) or generated entropy manually — 50-plus private dice rolls instead of trusting the on-device generator — were unaffected, since neither path depended on the flawed RNG. Diversifying the entropy source turned out to be an effective defense against exactly this class of bug.