Bitcoin's self-custody model just faced one of its biggest real-world stress tests. In late July 2026, an attacker drained roughly 594 BTC — worth about $38 million — from nearly 500 separate wallets in under 25 minutes. The cause wasn't phishing, malware, or a hacked exchange. It was a flaw inside a trusted hardware wallet itself.
What Happened
The attack targeted users of Coldcard, one of the most respected hardware wallets in the Bitcoin space, known for being air-gapped and built for serious long-term holders. Investigators traced the theft to a firmware bug affecting Coldcard Mk3 devices (and potentially later models) running certain firmware versions dating back to March 2021.
The bug caused the device's seed phrase generator to fall back on a weak, predictable random number generator instead of using the dedicated hardware randomness it was designed for. Normally, a Bitcoin seed phrase is chosen from an almost incomprehensibly large pool of possibilities, making it practically impossible to guess. This flaw shrank that pool down to something an attacker could brute-force.
Every single wallet drained was using single-signature setups. Many had been sitting untouched for years — some since 2021 — which lines up almost exactly with the window during which the faulty firmware was in use.
Why This Is a Big Deal
What makes this incident unsettling isn't just the dollar amount — $38 million is relatively small next to Bitcoin's trillion-dollar market cap, and BTC's price barely moved on the news. It's the fact that affected users did everything "right":
They used a reputable, air-gapped hardware wallet
They never typed their seed into an internet-connected device
They held their coins long-term without touching them
And they still lost funds, simply because the randomness their security depended on wasn't as random as it should have been.
The Multisig Lesson
One detail stands out from this event: every wallet that was drained used a single-signature setup. Wallets protected by multisignature (multisig) — where you need multiple separate keys, ideally from different hardware manufacturers, to approve a transaction — were not affected.
This reinforces a principle serious Bitcoin holders have pushed for years: don't put all your trust in one device or one company's code. A single firmware bug can't compromise funds protected by keys spread across multiple independent wallets.
What You Should Do
If you hold meaningful amounts of Bitcoin in cold storage, this event is worth using as a checkpoint:
Check if your hardware wallet manufacturer has issued any security advisories
Consider migrating large holdings to a multisig setup
If you generated your seed manually (e.g., using dice rolls) rather than relying solely on the device's built-in randomness, your exposure may be lower
Stay updated directly from the manufacturer rather than relying on rumors
Final Thought
Hardware wallets exist to remove one specific risk: the possibility that someone else can compute your private key. This incident is a reminder that even well-designed security tools are still software, and software can fail. Self-custody remains one of Bitcoin's core strengths — but it requires ongoing vigilance, not a "set it and forget it" mindset.
Disclaimer: This article is for informational purposes only and is not financial or security advice. Always verify wallet security updates directly from official sources#OpenAIFindsMoreAgentsEscapedContainment #USAndJapanJointlyInterveneToBuyYen