On July 30, 2026, attackers drained roughly 594 Bitcoin worth about $38 million from nearly 500 wallets in under 30 minutes. By August 3, the total had climbed to approximately 1,367 BTC — close to $89 million — stolen across 4,585 addresses, according to on-chain analysis from CryptoRank and Galaxy Research. The victims thought their Bitcoin was safe in cold storage. They were wrong.
This is not a story about Bitcoin failing. It is a story about a firmware bug in a specific hardware wallet — Coldcard, made by Canadian manufacturer Coinkite — that allowed attackers to reconstruct seed phrases without ever touching the device. If you hold Bitcoin on any hardware wallet, you need to understand what happened and what to do about it.
What Is Coldcard?
Coldcard is a Bitcoin-only hardware wallet produced by Coinkite, a Canadian company. It has been considered one of the gold standards for self-custody: air-gapped transaction signing, dual secure elements, and a design philosophy built around minimizing trust in anything except the device itself. It is the kind of wallet that Bitcoin purists recommend to other Bitcoin purists.
That reputation made the hack more shocking. The device was not physically compromised. No phishing links were clicked. No seed phrases were entered into a website. The vulnerability was in the firmware itself.
How the Hack Worked
The root cause traces back to a March 2021 firmware build affecting Coldcard Mk3 devices (firmware versions 4.0.1 through 5.0.3), as well as later Mk4, Mk5, and Q models before patched versions were released, according to CoinDesk.
Here is the technical breakdown in plain English:
-
The hardware RNG was bypassed. Coldcard devices are designed to use a dedicated hardware random number generator (RNG) to create seed phrases — the 12 or 24 words that serve as the master key to a wallet. A build configuration error caused the firmware to fall back to a software-based pseudorandom number generator (PRNG) instead.
-
The software fallback was weak. Instead of 128 bits of entropy (the standard for a secure 12-word seed), the software PRNG was seeded from predictable values like the chip's unique ID and timer registers. On the Mk3, effective entropy was estimated at roughly 40 bits. On later models, about 72 bits — still far below the 128-bit threshold, according to The Hacker News.
-
Attackers could brute-force seeds offline. Because the randomness was predictable, an attacker who understood the pattern could generate candidate seed phrases on their own hardware, derive the corresponding Bitcoin addresses, and compare them against the public blockchain. When a match was found, they had the private key. No device access required.
-
The sweep was automated and fast. On July 30, attackers drained 1,196 addresses in 41 minutes across six blocks, taking 1,082.65 BTC. By August 2–3, the total reached 1,367 BTC across 4,585 addresses in three distinct attack waves, according to CryptoRank.
-
AI may have been involved. Industry experts believe attackers used AI to review Coldcard's open-source code and identify the vulnerability, according to Bitcoin Magazine. This represents a new threat surface: AI-assisted code auditing of open-source wallet firmware.
Who Is at Risk?
Not every Coldcard user is affected. According to Coinkite's security advisory and Block's independent analysis:
At risk: - Seeds generated on Coldcard Mk3 devices running firmware 4.0.1 or later - Seeds generated on Mk4, Mk5, and Q devices before firmware versions 5.6.0 (Mk4/Mk5) and 1.5.0Q (Q) - Single-signature wallets created without a BIP-39 passphrase - Seeds generated without additional dice-roll entropy
Not at risk (based on current information): - Seeds generated with a strong BIP-39 passphrase (25th word) - Seeds generated with at least 50 dice rolls for additional entropy
If you are unsure whether you are affected, check Coinkite's official security advisory for your exact model, firmware version, and seed-generation method. When in doubt, assume you may be at risk.
What Coinkite Has Done
Coinkite released patched firmware on July 31, 2026: - Mk3: Update to version 4.2.0 or later - Mk4 and Mk5: Update to version 5.6.0 or later - Q: Update to version 1.5.0Q or later
However, updating the firmware does not fix seeds that were already generated on vulnerable firmware. Those seeds remain weak. Users must generate a completely new seed on patched firmware and migrate their funds to new addresses. As Coinkite CEO NVK stated: "If you generated a seed using a Coldcard wallet, move your funds now, using our updated best practices, before reading further," according to Fidelity.
What to Do Right Now
If you use a Coldcard wallet — or any hardware wallet — follow these steps:
Step 1: Check Your Exposure
Determine when your seed was generated and on which firmware version. If your seed was created on a Coldcard Mk3 after March 2021, or on any affected Mk4/Mk5/Q device, consider yourself at risk.
Step 2: Generate a New Seed
On patched firmware (or on a different, unaffected device), generate a completely new seed phrase. Do not import your old seed into a new wallet — the weakness carries forward. A compromised seed is compromised everywhere, as Block's engineering team warned, according to Forbes.
Step 3: Migrate Your Funds
Send your Bitcoin from the old addresses to the newly generated addresses. Do this calmly and carefully. Coinkite specifically warned: "Rushing a wallet migration can create a more immediate risk than the issue you are trying to address."
Step 4: Verify and Destroy
Confirm your funds have arrived at the new addresses. Once confirmed, the old seed is no longer needed — but do not throw it away carelessly. Store it securely in case of future disputes, then destroy it physically once you are certain everything has migrated.
What This Means for Self-Custody
The Coldcard hack does not mean self-custody is broken. It means that self-custody is only as strong as the tools you use and the practices you follow. Several principles emerge from this incident:
1. Diversify your hardware. No single device is infallible. Using different hardware wallets for different portions of your holdings reduces the risk that a single firmware flaw drains everything.
2. Use passphrases. A BIP-39 passphrase (the "25th word") adds an additional layer of entropy that is not stored on the device. Even if the device's seed generation is compromised, a strong passphrase makes the seed much harder to reconstruct.
3. Keep firmware updated. Firmware updates are not cosmetic. They patch real vulnerabilities. Check for updates regularly and apply them — but understand that updating firmware does not retroactively fix seeds generated on older versions.
4. Understand what you are using. If you cannot explain how your wallet generates its seed phrase, you are trusting the device blindly. That trust is exactly what was exploited here.
Alternative Hardware Wallets
If you are looking for alternatives to Coldcard, two options stand out for different reasons:
Tangem
Tangem offers card-based NFC wallets starting at $47.90 for a 3-card set — no screens, no buttons, just tap your phone. The card generates and stores the seed internally. For beginners and those who want simplicity, Tangem is an excellent option. Many CGH readers have already adopted Tangem as their primary hardware wallet.
(Affiliate link — CGH may earn a commission at no extra cost to you.)
Ledger
Ledger remains one of the most widely used hardware wallets in the world, supporting Bitcoin, Ethereum, Solana, and dozens of other chains. Ledger is a solid choice for multi-chain holders who want a device with a proven track record and broad ecosystem support.
(Affiliate link — CGH may earn a commission at no extra cost to you.)
The Bigger Picture
The Coldcard incident is a wake-up call, but it is not unique in Bitcoin's history. From the Mt. Gox collapse to the Bitcoin Savings & Trust Ponzi scheme, the crypto space has repeatedly learned that security is a moving target. What makes this different is the scale and the method: 1,367 BTC stolen without a single device being physically accessed, potentially using AI to audit open-source code.
The threat surface has expanded. It is no longer just smart contract bugs and phishing links. Hardware wallets — the tools we tell everyone to use — are now in the crosshairs. That does not mean you should abandon self-custody. It means you should practice self-custody with eyes wide open.
CGH Take
The Coldcard hack is a reminder that "cold storage" is not a magic shield. It is a set of practices and tools, and every tool has potential weaknesses. Here is what we recommend:
- If you use Coldcard, check your firmware version immediately. If you are affected, generate a new seed and migrate your funds — calmly and carefully.
- If you use any hardware wallet, make sure you are using a BIP-39 passphrase and keeping firmware updated.
- If you are looking for a new hardware wallet, consider Tangem for simplicity or Ledger for multi-chain support. Both use certified secure elements and have different attack surface profiles than Coldcard.
Discipline is measured by adhering to the rules and wins, not profit. Security is the first rule. Without it, nothing else matters.
This article is for educational purposes only and is not financial advice. Always do your own research before making decisions about your crypto holdings.