- Hackers exploited a fundamental cryptographic flaw in Coldcard hardware wallets — a brand of “cold” Bitcoin storage devices manufactured by Canada-based Coinkite Inc. and widely considered one of the safest methods of storing cryptocurrency because the devices are isolated from the internet — draining approximately $86 million worth of Bitcoin (roughly 1,367 BTC) from more than 4,500 wallets by Monday, up from $38 million in reported losses when the vulnerability first became public on Friday; the speed of the escalation (more than doubling over a weekend) indicates the attackers have automated the exploit and are systematically working through all wallets generated by affected firmware versions; Coinkite confirmed the vulnerability and released fixed firmware, but the fix does not recover already-drained funds — for victims, the damage is permanent.
- The root cause of the vulnerability is a failure in how Coldcard devices generate the “seed phrase” — a long string of words that serves as the master key to a Bitcoin wallet and from which all private keys are derived; true randomness is a non-negotiable requirement for cryptographic key generation, and Block Inc.’s engineering team (which discovered and published the flaw) found that the Coldcard firmware’s random-number generator had a fallback mechanism that, under certain conditions, produced deterministic output based on predictable values like device serial numbers rather than truly random values; the result is that an attacker who knows the serial number of a Coldcard device and the firmware version it used can systematically recalculate what seed phrase it would have generated and thereby reconstruct the private keys without ever having physical access to the device; the attack is thus purely computational — no physical theft required.
- The victim experience illustrates the particularly devastating nature of this vulnerability: Jonathan Goodman, one of the victims, told Bloomberg he had kept his Coldcard device in a safety deposit box that had never been connected to the internet — precisely the security practice that hardware wallet manufacturers recommend as best-in-class; he saw three wallets completely drained between 9:36 and 9:43 p.m. on July 29th, losing $1.6 million; the 7-minute window reflects the attacker’s automated execution speed once the seed phrase was recalculated; as Failsafe CEO Aneirin Flynn put it: “It exposes the fallacy of your crypto being offline. The device is just responsible for generating your passwords, and if the underlying math is broken then your passwords can be reverse-engineered” — the offline nature of the device provided no protection against a flaw in the key generation process itself.
- The broader cryptocurrency security context is important: TRM Labs data shows that while total crypto stolen in the first half of 2026 ($972 million) is less than half of the $2.3 billion stolen in the first half of 2025, the total number of individual hacks reached 207 — the highest ever recorded in any six-month period — and infrastructure and key compromise incidents, while representing only 15% of hacks by count, account for 76% of total losses; TRM’s global head of policy Ari Redbord framed the Coldcard hack with a line that will likely become a benchmark for how the industry discusses self-custody risk: “Coldcard shows that self-custody moves the risk, it does not remove it” — a formulation that applies as much to exchange custody (which moves risk to the custodian) as to self-custody (which moves risk to the security of the key generation process).
What Happened?
A cryptographic flaw in Coldcard hardware Bitcoin wallets — discovered by Block Inc.’s engineering team — made seed phrases predictable by using device serial numbers instead of true randomness in the key generation process. Attackers systematically exploited the vulnerability, draining $86 million from 4,500+ wallets as of Monday, up from $38 million Friday. Victims include users whose devices were kept offline in safety deposit boxes and never connected to the internet. Coinkite released patched firmware but cannot recover stolen funds.
Why It Matters?
Hardware cold wallets are the gold standard for Bitcoin security — the attack surface for this hack was not internet connectivity or exchange vulnerability but the mathematical soundness of key generation itself. The breach demonstrates that “offline” security is only as strong as the software that generates the keys, not the physical isolation of the device. With $86 million stolen in days from a purely computational attack requiring no physical access, this will fundamentally reshape how the industry evaluates self-custody security.
What’s Next?
Watch whether losses continue climbing as attackers work through remaining affected wallets — anyone using Coldcard firmware with the affected RNG vulnerability and who has not yet been drained remains at risk until they migrate to new wallets generated with patched firmware; watch for regulatory response, as the scale of losses from a hardware vendor’s software flaw raises questions about liability and disclosure standards for wallet manufacturers; watch how other hardware wallet manufacturers (Ledger, Trezor) respond with their own security audits; and watch Bitcoin’s price sensitivity to the event — $86 million drained and potentially resold is not negligible selling pressure, though it is unlikely to be market-moving at current Bitcoin valuations.
Source: Bloomberg
