1,816 bitcoins, $116 million, stolen remotely—the thieves never even touched your hardware wallet.
What we’re talking about today:
What happened today deserves the title of “2026’s biggest hardware wallet heist.” On October 16, 2026, blockchain security firm TRM Labs published a report revealing a massive theft targeting Coldcard hardware wallets.
The background / what exactly happened:
Coldcard is a Bitcoin hardware wallet marketed as “geek-grade cold storage,” with a solid reputation among longtime users. In theory, generating private keys offline and never connecting to the internet is the safest way to store your coins, right? And yet, it still happened: starting on July 30, 2026, attackers made off with 1,816 BTC from more than 5,200 addresses in four waves, worth about $116 million (Source: TRM Labs report, 2026-10-16).
In plain English: the problem was with firmware version 4.0.1, released in March 2021. A bug in the build configuration caused the device to bypass its hardware true random number generator when generating recovery phrases, and fall back to a very weak software random number generator instead. The private keys should have had 128 bits of randomness, but their strength dropped to as little as 40 bits.
What does 40 bits mean? A 128-bit random number has so many possible combinations that it’s essentially impossible to brute-force; with 40 bits, a decent computer can crack it given enough time. So hackers didn’t need to touch your wallet at all. They could stay home, work out the private keys, and transfer the coins straight out.
Key analysis:
- Scale: 1,816 BTC, worth about $116 million (source: TRM Labs report, 2026-10-16); the third-largest cryptocurrency theft of 2026. There have been 276 security incidents so far this year, with total losses exceeding $1.2 billion (source: TRM Labs).
- Within 25 minutes of the first wave of attacks, about 594 BTC had been transferred to the hackers’ collection address. This suggests the hackers had already calculated the private keys in bulk; the actual attacks were just the final step.
- Laundering: Most of the stolen funds are still sitting untouched in the hackers’ addresses. So far, only 64.9 BTC has been traced to Wasabi and 200 ETH to Tornado Cash (August 4, 2026). TRM says the four waves of attacks used somewhat different transaction methods, suggesting they may have been carried out by multiple independent groups rather than one crew.
- For comparison: the Gamdom casino was robbed of $4.3 million a few days ago (I wrote about it the day before yesterday). Compared with this $116 million heist, that’s barely a drop in the bucket.
Xiaokai’s take:
As a longtime crypto bagholder, I used to think, “Keep your coins in a hardware wallet and you’re safe.” I’ve learned that lesson the hard way, so take it from me: hardware wallets just shift the risk from “the exchange goes bust” to “something goes wrong with one of your own steps.” If the foundation—true randomness—is compromised, the wallet is just for show. One more thing: installing the official firmware update only protects newly generated recovery phrases. You must retire your old recovery phrase and move your coins to a new address to be truly safe.
Risks to watch out for:
1. If you generated your Coldcard recovery phrase using firmware version 4.0.1 from March 2021 (or a later, unpatched version), generate a new recovery phrase using the latest firmware immediately and transfer your assets to it (source: TRM Labs).
2. Scammers are still exploiting the story: on October 16, SlowMist warned about phishing pages posing as Ledger firmware updates and tricking people into entering their 24-word recovery phrase. Remember: write your recovery phrase down on paper only. Any website that asks you to enter it is a scam.
3. Hardware wallet supply-chain risk: hardware tampering was reported at Southeast Asian reseller CryptoBilis, with around $93 million reportedly involved (source: SlowMist threat intelligence alert, 2026-10-16, and reports from multiple media outlets). Ledger has stopped working with the reseller. Bottom line: buy hardware wallets only from the official website; don’t be tempted by cheap second-hand deals.
Who this is for / not for:
For: Anyone with an older Coldcard device—check it right away. And everyone who uses a hardware wallet: send this to that friend who “screenshots their recovery phrase and saves it on their phone.”
Not for: Anyone hoping to use this article to go long or short on BTC. Security incidents have little to do with short-term price movements, so don’t read too much into it.
In one sentence:
The $116 million loss is a reminder: hardware wallets protect against hackers, not bad randomness—the moment a recovery phrase is generated is the real make-or-break point.
— Xiaokai, a web3 crypto bagholder
⚠️ This article is for informational purposes only and does not constitute investment advice. Crypto is risky; invest with caution.
