Attackers have drained roughly 1,367 Bitcoin from Coldcard hardware wallets, currently worth about USD 85 million. The cause is a Coldcard vulnerability in how the devices generate keys. For self-custody, the incident is a heavy blow.
A hardware wallet is a device that creates the private keys to a crypto holding and stores them offline. The key never leaves the device, not even when signing a transfer. This form of storage works without a bank or an exchange. Therefore it goes by the name self-custody and counts as the safest option available. Coldcard ranks among the best-known of these devices. Canadian company Coinkite builds it exclusively for Bitcoin. That very assumption has now taken damage. For more than five years, a firmware flaw made the key that a device generates predictable.
Subscribe to our newsletter
The best articles of the week, directly delivered into your mailbox.
How the Coldcard vulnerability made private keys computable
Access to a Bitcoin wallet rests on a single random number. From it, the device derives the seed. Those 12 or 24 words restore the entire holding in an emergency. Yet if that number is not truly random, an outsider can recompute it. On the Coldcard, the hardware random number generator of the built-in STM32 chip should have handled this job. A build setting switched the generator off. Moreover, a check routine in the libngu library tested only whether the setting existed, not whether it was active. As a result, the firmware reverted to a fallback path. Its entropy came from the serial number of the microcontroller. A system counter and the registers of the real-time clock supplied the rest.
These values are not secret. An attacker can read out part of the serial number over USB. On the Mk3 model, the system counter covers only around 80,000 possible values. Therefore the search space sits far below what counts as cryptographically secure. Anyone who knows the formula can work out the keys.
Affected wallets are those whose seed arose on vulnerable firmware after 1 March 2021. This applies first of all to single-signature wallets. But multisig setups are open to attack too, provided every device involved is affected. The same source additionally fed paper wallet keys and XOR seed masks. It also supplied the encryption of device clones, Web2FA secrets and stored passwords. Anyone using an affected device must treat every secret created there as compromised.
1,367 Bitcoin drained so far
The first outflow ran overnight into 30 July. Within roughly 41 minutes, between 594 and 1,083 BTC left 500 to 1,200 addresses, depending on the count. Further waves followed in the days after, and for the third one Galaxy Research reports 207.73 BTC. Overall, the damage adds up to around 1,367 BTC from 4,585 affected addresses.
The process is not over, however. On 3 August, Galaxy Research reported a suspected fourth wave, initially with 388.93 BTC from 462 addresses. Subsequently, revised figures put it at 448.73 BTC from 709 addresses. In that first interim count, the movements clustered in blocks 960,778 to 960,792. That spans roughly two and a half hours. The rate therefore sits at about 13.8 sweep transactions per block, around 45 times the level before the incident. Should this wave hold up, the damage rises to some 1,816 BTC or about USD 113 million.
The behaviour after the outflow is also notable. Nothing has moved so far on any identified receiving address. For a theft of this size, that is unusual. Analysts have additionally flagged around 600 suspicious addresses to law enforcement agencies, compliance firms and cybersecurity investigators.
Coinkite ships corrected firmware and halts shipments
Manufacturer Coinkite acknowledged the flaw in late July and updated the security advisory again in early August. Nevertheless, the company does not confirm a link to the outflows there. The warning covers the Mk2 and Mk3 models with versions 4.0.1 through 4.1.9. Mk4 and Mk5 before Standard 5.6.0 or Edge 6.6.0X also count as affected. The same applies to the Q model before Standard 1.5.0Q or Edge 6.6.0QX. Corrected firmware now exists for every affected model. Mk2 and Mk3 get version 4.2.0, Mk4 and Mk5 Standard 5.6.0, and the Q 1.5.0Q.
An update alone does not suffice, however, because the old seed stays computable. In essence, Coinkite advises affected users to update the firmware and generate a new seed. After a small test transaction, they should move the balance to the new addresses. Users should verify the new backup before the transfer. One group can skip the migration. That exemption covers users who generated the seed themselves at setup with at least 50 independent dice rolls. Such users must also never have noted those rolls anywhere. A strong BIP-39 passphrase, by contrast, does not replace the migration. According to the advisory, it works only as an additional barrier.
The company has also stopped shipping new devices and destroyed remaining stock carrying affected firmware.
"Affected customers who had already received their devices were contacted directly with a recommendation and migration steps. Our entire focus is now on helping affected users migrate safely." - Coinkite, company statement
Key compromises cause most hack losses
Measured against the wider industry, the case is no outlier. During the first half of 2026, attackers seized around USD 972 million worldwide, according to TRM Labs. Against the USD 2.3 billion of the year-earlier period, that marks a drop of more than 50 percent. At the same time, the number of incidents climbed to a record 207. In the first half of 2025, the count stood at 83. The haul is shrinking. Attack numbers are climbing.
The losses concentrate in one category. Specifically, infrastructure and key compromises account for around 15 percent of incidents, TRM finds. Yet they cause about 76 percent of the total damage. That is exactly where the Coldcard incident sits, especially since the flaw hit key generation itself. A single error at that point carries through years and thousands of devices.
State-linked actors form the largest single block. North Korea-linked groups such as Lazarus and TraderTraitor account for around USD 643 million, TRM reports. That is about 66 percent of the half-year losses. The April attacks on Drift and KelpDAO drove most of it. Consequently, the Coldcard incident creates no new risk. It shows where the existing one sits. Where and how the key material comes into being decides the security of a holding. Whether it then rests with a custodian or on a device at home matters only after that.
