A firmware defect in Coinkite's Coldcard hardware wallet, one of the most trusted Bitcoin-only cold storage devices, has resulted in confirmed thefts of 1,596 BTC ($103M) from approximately 7,300 addresses since July 30, 2026. A suspected fourth attack wave could push total losses to 2,055 BTC (~...
"This is the worst hit in bitcoin history to the most knowledgeable and 'properly secured' bitcoiners." — Guy Swann, Bitcoin Commentator
A firmware defect in Coinkite's Coldcard hardware wallet, one of the most trusted Bitcoin-only cold storage devices, has resulted in confirmed thefts of 1,596 BTC ($103M) from approximately 7,300 addresses since July 30, 2026. A suspected fourth attack wave could push total losses to 2,055 BTC (~$130M). The vulnerability traces to a March 2021 firmware update that silently routed seed generation to a weak software pseudorandom number generator (PRNG) instead of the device's STM32 hardware random number generator (RNG), reducing entropy from the expected 128 bits to as low as 40 bits on Mk3 devices.
The incident is the largest single hardware wallet exploit on record. It has forced Coinkite to halt device shipments, destroy remaining vulnerable inventory, and issue emergency firmware across all product lines. More consequentially, it has reignited the self-custody debate within the Bitcoin ecosystem, with institutional voices arguing the exploit strengthens the case for regulated custodians and spot Bitcoin ETFs.
The first sweep began on July 30, 2026. Galaxy Research documented 1,082.65 BTC drained from 1,196 addresses in a 41-minute window — an average of approximately 1 BTC per victim address. The attacker consolidated funds into shared collector addresses.
A second wave followed on July 31, taking an additional 594 BTC ($38M) from roughly 500 single-signature wallets in 25 minutes. Galaxy Research's Alex Thorn noted that Waves 1 and 2 appeared internally coordinated by a single operator but could not definitively confirm whether all waves originated from the same actor.
Wave 3 unfolded between Friday midday and Saturday morning UTC (August 1-2), sweeping 208 BTC from 1,912 addresses. The attacker shifted tactics: coins were routed to individual destination addresses rather than shared collectors, using pay-to-witness-script-hash (P2WSH) outputs that potentially carried multisignature or timelock conditions. Batching increased to approximately six victims per sweep transaction, and the average haul per address dropped to roughly 0.1 BTC — indicating that high-value key space had already been depleted.
On August 3, Galaxy Research reported a suspected fourth wave: 448.7 BTC from 709 wallets. If confirmed, the running total across four waves stands at approximately 1,816 BTC (~$114M) from more than 5,200 addresses. As of August 4, confirmed losses stand at 1,596 BTC ($103M) across ~7,300 verified addresses, with suspected totals reaching 2,055 BTC (~$130M) pending victim confirmation.
Galaxy Research additionally identified 14 smaller related incidents suggesting opportunistic exploitation by independent actors using the same vulnerability data.
The vulnerability is traced to a specific configuration error in a March 2021 firmware release. Coinkite's production build config set the macro MICROPY_HW_ENABLE_RNG to zero. The libngu cryptographic library checked whether the macro existed, not whether it was enabled, binding the build to MicroPython's Yasmarang fallback PRNG. This fallback initialized from the chip's unique device ID and timer registers, collecting no fresh entropy after initialization.
The consequence: seed phrases generated on affected firmware were derived from a dramatically reduced entropy pool.
Entropy estimates by device model:
| Model | Expected Entropy | Actual Entropy | |-------|-----------------|----------------| | Mk2/Mk3 | 128 bits (12-word BIP-39) | ~40 bits | | Mk4/Mk5 | 128 bits | ~72 bits |
Block's security team set conditional ceilings below 2^40.7 and 2^73.3 bits for the respective device classes. At 40 bits of entropy, the total keyspace is roughly 1.1 trillion possibilities — large by human standards but trivially searchable with modern GPUs. An attacker who determined the device UID, timer state, and prior RNG-call history could reproduce candidate output streams offline, then check derived addresses against the public Bitcoin blockchain without ever touching the physical device.
The flaw affected seeds generated on vulnerable firmware regardless of whether the device was subsequently updated. Users who created wallets years ago and stored them offline remained exposed.
Coinkite confirmed the following firmware versions were compromised:
Coinkite's TAPSIGNER, OPENDIME, and SATSCARD products use separate firmware stacks and are not affected.
Coinkite shipped emergency firmware on July 31, within 24 hours of the first wave. The company stated: "The last three days have been some of the hardest in this company's history, and for a lot of the people reading this, they've been something much worse."
Key response actions include:
Verified affected addresses have been shared with law enforcement, exchanges, and compliance firms to flag and potentially freeze stolen funds.
According to Galaxy Research, 90% of stolen Bitcoin remains untouched in receiving addresses as of August 4. The attacker has prioritized consolidation over liquidation, suggesting either patience for attribution to cool or potential difficulty accessing fiat off-ramps under current exchange KYC/AML regimes.
No confirmed attribution to state-backed groups (North Korea's Lazarus Group, Russian actors, or others) has been established, though investigation is ongoing. Galaxy Research and Block's security teams are the primary entities conducting on-chain analysis.
The tactical evolution across waves — from large, rapid sweeps to smaller, batched transactions using more complex script types — indicates the operator adapted in real time, possibly in response to public disclosure of the vulnerability.
The exploit has produced sharp disagreement among Bitcoin ecosystem participants about the viability and future of self-custody.
Against continued self-custody reliance:
Lorenzo Valente, Director at ARK Invest, stated: "The self-custodial hardware space is a disaster at this point and creates more bad rep for the industry than anything else." He added: "You are better off today holding funds across several publicly-traded exchanges or ETFs."
Nick Neuman, CEO of multisig custody provider Casa, noted: "You just can't ask people to roll dice to be secure with your self custody. It's a non-starter for 99% of people."
Ido Ben-Natan, CEO of security firm Blockaid, observed that hardware wallet security "comes down to the firmware and systems users interact with but never see."
In defense of self-custody:
Bitcoin analyst Willy Woo argued that self-custody remains the only path to sovereign Bitcoin ownership, even as users migrate funds to exchanges and ETF wrappers in the immediate aftermath.
Bloomberg Intelligence ETF analyst Eric Balchunas said the incident could accelerate a shift toward spot Bitcoin ETFs, noting that ETF assets benefit from institutional custodians with dedicated cybersecurity teams, operational controls, and regulatory oversight.
Bitcoin price impact has been minimal. BTC and ETH each dropped less than 1% since the theft began on July 30, suggesting the market views the incident as a product-specific failure rather than a systemic risk.
The broader context is notable. According to data referenced in multiple reports, there have been 207 separate crypto attacks in H1 2026 — the highest half-year total on record — though aggregate losses ($972M) were less than half the $2.3B stolen in H1 2025. The Coldcard exploit, occurring in late July/early August, adds significantly to the 2026 tally.
The hardware wallet industry faces reputational damage. Coldcard occupied a distinctive position as the preferred device among Bitcoin-maximalist self-custody advocates. Its compromise does not implicate competing hardware wallets (Ledger, Trezor, Foundation Devices, and others use different firmware and entropy generation methods), but it raises systemic questions about firmware audit practices, supply chain integrity, and the transparency of entropy sources across the entire product category.
The incident has also drawn attention to the lack of standardized security certification for hardware wallets. Unlike payment card terminals (which must pass PCI-DSS audits) or enterprise HSMs (subject to FIPS 140-2/3 validation), consumer hardware wallets operate without mandatory independent security certification.
The Coldcard exploit is a case study in how a single firmware configuration error — a macro set to zero rather than one — can undermine the security model of an entire product line for half a decade before detection. The five-year latency between the defect's introduction and its exploitation raises questions about the adequacy of firmware audit practices in the hardware wallet industry, and whether the current model of trusting manufacturers to self-certify security properties is sustainable as Bitcoin's installed base of self-custodied value grows.
The immediate economic damage — $103M confirmed, potentially $130M — is material but contained. The longer-term impact may be structural: a shift in how the market prices the operational risk of self-custody versus the counterparty risk of institutional custodians. Neither option is risk-free. The Coldcard incident demonstrates that the security of "your keys, your coins" depends entirely on the integrity of the system that generated those keys.