A security flaw in Coldcard Wallet has been linked to one of the largest Bitcoin hardware wallet thefts in recent memory. More than 1,082 Bitcoins, valued at nearly $70 million, were stolen from over 1,100 wallets before manufacturer Coinkite publicly disclosed the vulnerability. Hardware wallets like Coldcard are widely regarded as the gold standard for self-custody of digital assets because they store private keys offline, isolated from internet-based attacks — making a flaw of this magnitude particularly significant for the broader cryptocurrency security landscape.

According to research findings, the attacker did not compromise the devices directly. Instead, a bug in Coldcard's wallet software enabled offline generation of private keys, granting the attacker access to affected wallets.

Coldcard Wallet Flaw Enabled Key Recovery

Galaxy Research reported that the attacker drained 1,196 Bitcoin wallets between 01:10 UTC and 01:51 UTC on July 30, stealing approximately 1,082.65 BTC within a 41-minute window.

The theft occurred roughly 30 hours before Coinkite issued its security alert warning users that their Coldcard Wallets could be compromised due to vulnerabilities in certain firmware versions. Experts believe the attacker targeted wallets created using Coldcard Mk3 devices running firmware versions 4.0.1 through 5.0.3, which were released in March 2021.

The Galaxy Research report noted that every transaction was carried out at the same fee rate of 30 sat/vB and without any change outputs. This pattern strongly suggests the attacker already possessed the private keys and was automating withdrawals rather than individually targeting users.

Vulnerability Origin and Expanded Warning

Security researchers traced the vulnerability to a firmware update released in 2021. Coldcard hardware wallets are designed to use a hardware random number generator for creating recovery phrases, making the keys extremely difficult to predict.

However, researchers from Block demonstrated that a software glitch prevented this hardware feature from functioning properly. As a result, the wallets fell back to a software-based random number generator that relied on predictable inputs, including the device's serial number and internal clock. Random number generator failures have historically been among the most damaging classes of vulnerabilities in cryptocurrency, with incidents such as the 2013 Android Secure Random bug rendering Bitcoin wallets on affected devices vulnerable to key theft.

This flaw reduced the entropy of recovery seeds from 128 bits to approximately 40 bits. According to the researchers, this reduction made large-scale brute force attacks feasible with modern computing resources.

Coinkite subsequently expanded its warning to cover certain firmware versions on the Mk4, Mk5, and Coldcard Q models, while noting that newer hardware revisions significantly mitigated the risk.

— nvk (@nvk) July 31, 2026

Users Urged to Move Funds Immediately

The stolen Bitcoins were consolidated into a small number of accounts. One such account reportedly holds more than 562 BTC, while others contain approximately 398, 89, and 32 BTC. The funds have remained stationary since being consolidated.

Coinkite advises anyone who generated a recovery phrase using the compromised firmware to migrate immediately to a new wallet running the latest firmware. The company also emphasized that users who had enabled an additional BIP-39 passphrase can consider themselves secure, as the passphrase provides a separate layer of protection beyond the recovery seed alone. Researchers further noted that other vulnerable wallets remain at risk of similar exploitation.