Attackers have drained approximately 1,367 Bitcoin from Coldcard hardware wallets, with an estimated value of around USD 85 million. The root cause is a vulnerability in the way Coldcard devices generate cryptographic keys—a significant blow to the concept of self-custody.

Hardware wallets are physical devices that create and store the private keys to a cryptocurrency holding entirely offline. The key never leaves the device, not even when authorizing a transaction. This approach operates independently of banks or exchanges and is widely regarded as the most secure storage method available. Coldcard, manufactured by the Canadian company Coinkite, is one of the most prominent hardware wallets built exclusively for Bitcoin and has been widely recommended within self-custody and privacy-focused communities. However, for more than five years, a firmware flaw rendered the keys generated by these devices predictable.

How the Coldcard Vulnerability Made Private Keys Computable

Access to a Bitcoin wallet hinges on a single random number. From that number, the device derives the seed phrase—a set of 12 or 24 recovery words conforming to the BIP-39 standard, the industry-wide specification used by virtually every hardware wallet manufacturer. These words can restore an entire holding in an emergency. If that initial number is not truly random, however, an outsider can recompute it.

On Coldcard devices, the hardware random number generator within the built-in STM32 microcontroller—a widely deployed chip family from STMicroelectronics used across embedded systems—was supposed to handle this critical task. A build setting, however, had switched the generator off. Furthermore, a check routine in the libngu library only verified whether the setting existed—not whether it was actually active. Consequently, the firmware fell back to an alternative entropy path. That fallback derived its entropy from the microcontroller's serial number, a system counter, and the registers of the real-time clock. None of these values are secret; an attacker can read part of the serial number over USB. On the Mk3 model, the system counter covers only approximately 80,000 possible values—far smaller than even a four-digit PIN and placing the search space far below what is considered cryptographically secure. Anyone with knowledge of the formula can reconstruct the keys.

Wallets affected are those whose seed was generated on vulnerable firmware after 1 March 2021. This primarily applies to single-signature wallets, but multisig configurations are also vulnerable if every participating device is affected. The same flawed entropy source also fed paper wallet keys, XOR seed masks, encryption for device clones, Web2FA secrets, and stored passwords. Any user operating an affected device must treat every secret created on it as compromised.

1,367 Bitcoin Drained So Far

The first wave of outflows occurred overnight into 30 July. Within approximately 41 minutes, between 594 and 1,083 BTC left between 500 and 1,200 addresses, depending on the count. Additional waves followed over subsequent days. For the third wave, Galaxy Research reported 207.73 BTC. In total, the confirmed damage amounts to approximately 1,367 BTC from 4,585 affected addresses.

The process is ongoing. On 3 August, Galaxy Research reported a suspected fourth wave, initially recorded at 388.93 BTC from 462 addresses. Revised figures subsequently put it at 448.73 BTC from 709 addresses. During the first interim count, movements clustered in blocks 960,778 to 960,792, spanning roughly two and a half hours. The rate was approximately 13.8 sweep transactions per block—around 45 times the pre-incident baseline. Should this wave be confirmed, total losses would rise to approximately 1,816 BTC, or about USD 113 million.

The behaviour following the outflows is also noteworthy. Nothing has moved from any identified receiving address, which is unusual for a theft of this magnitude. Analysts have flagged approximately 600 suspicious addresses to law enforcement agencies, compliance firms, and cybersecurity investigators.

Coinkite Ships Corrected Firmware and Halts Shipments

Manufacturer Coinkite acknowledged the flaw in late July and updated its security advisory again in early August. The company has not, however, confirmed a direct link between the vulnerability and the observed outflows.

The advisory covers the Mk2 and Mk3 models running firmware versions 4.0.1 through 4.1.9. Mk4 and Mk5 devices running versions prior to Standard 5.6.0 or Edge 6.6.0X are also affected, as is the Q model prior to Standard 1.5.0Q or Edge 6.6.0QX. Corrected firmware is now available for every affected model: Mk2 and Mk3 receive version 4.2.0, Mk4 and Mk5 receive Standard 5.6.0, and the Q receives 1.5.0Q.

A firmware update alone is insufficient, however, because the old seed remains computable. Coinkite advises affected users to update the firmware and generate an entirely new seed. After completing a small test transaction, users should transfer their full balance to the newly generated addresses and verify the new backup before the transfer. One group is exempt from migration: users who generated their seed manually at setup using at least 50 independent dice rolls, provided they never recorded those rolls anywhere. A strong BIP-39 passphrase does not replace the need for migration; according to the advisory, it functions only as an additional barrier.

The company has also halted shipments of new devices and destroyed remaining stock carrying affected firmware.

"Affected customers who had already received their devices were contacted directly with a recommendation and migration steps. Our entire focus is now on helping affected users migrate safely."

— Coinkite, company statement

Key Compromises Cause Most Hack Losses

Measured against the broader industry, the Coldcard incident is not an anomaly. During the first half of 2026, attackers seized approximately USD 972 million worldwide, according to TRM Labs. That represents a decline of more than 50 percent compared to the USD 2.3 billion lost during the same period a year earlier. At the same time, the number of incidents climbed to a record 207, up from 83 in the first half of 2025. While the total haul is shrinking, the frequency of attacks is rising.

Losses are heavily concentrated in one category. Infrastructure and key compromises account for approximately 15 percent of incidents, TRM Labs finds, yet they cause roughly 76 percent of total financial damage. The Coldcard incident fits squarely within this pattern, particularly because the flaw struck at the key-generation process itself. Firmware-level vulnerabilities in hardware wallets that directly enable mass private-key reconstruction are rare; most hardware wallet losses stem from supply-chain attacks, phishing, or user error. Here, a single error at the key-generation stage propagated across years and thousands of devices.

State-linked actors constitute the largest single block of attackers. North Korea-linked groups such as Lazarus and TraderTraitor account for approximately USD 643 million, TRM Labs reports—about 66 percent of all half-year losses. The April attacks on Drift and KelpDAO accounted for the majority of that total.

Ultimately, the Coldcard incident does not introduce a new category of risk. Rather, it underscores where the existing risk resides: the point at which key material is generated determines the security of a holding. Whether those keys subsequently rest with a custodian or on a device at home is a secondary consideration.