OVERVIEW
For years Coldcard was the hardware wallet that serious Bitcoin holders pointed to when asked where large amounts should go. Made by Canadian company Coinkite since 2017, it built a reputation as the paranoid Bitcoiner's cold storage of choice. Air gapped. Bitcoin only. Open source firmware. Dual secure elements. The kind of wallet that made people feel genuinely safe.
Then on July 30 2026 everything changed.
On the morning of July 30 2026 a single attacker emptied 1,196 Bitcoin addresses in about 41 minutes. Roughly 1,082 BTC worth around $70 million at the time moved out of wallets that had never once touched the internet.
By the time the dust settled the confirmed take had passed $130 million across more than 5,200 addresses and it was still climbing. It is the largest hardware wallet exploit in crypto history and the third largest crypto hack of 2026.
WHAT IS COLDCARD
Coldcard is made by Canadian company Coinkite since 2017. It built a reputation on Bitcoin only design, dual secure elements, open source firmware and layered physical security features that most competitors did not offer.
It was not a wallet for beginners. It was the wallet serious self custody advocates recommended for people storing significant amounts of Bitcoin. The kind of device that made users feel like they had done everything right.
As one victim put it after losing $1.6 million: "Perhaps the hardest part about this is that I did everything right. I never shared my seed phrase with anybody. My devices never touched the internet. Everything was kept in multiple safes and safety deposit boxes. None of it mattered. All because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability."
That single line of code from 2021 is where the story really begins.
THE BUG THAT WAS HIDING SINCE 2021
A build configuration error in Coldcard firmware version 4.0.1 shipped in March 2021 routed seed generation to a deterministic software pseudorandom number generator instead of the device's STM32 hardware random number generator, reducing effective entropy from 128 bits to approximately 40 bits on Mk3 devices and 72 bits on Mk4, Mk5 and Q models.
Let us unpack that in plain language.
When you set up a hardware wallet for the first time it generates a seed phrase. That seed phrase is derived from a random number. The randomness of that number is everything. The more random it is the harder it is for anyone to guess or recreate your private key.
Coldcard's firmware was supposed to use its hardware random number generator to create that randomness. Instead a code error sent it to a software generator that was far less random and used predictable constants. The result was seed phrases that looked normal but were mathematically much weaker than they should have been.
The secure elements were never breached. The seeds they protected had been weak from the moment of creation.
Nobody knew. The wallets looked fine. The seed phrases looked fine. The security looked fine. But underneath every wallet generated on affected firmware between March 2021 and the patch release in July 2026 was a private key that could theoretically be brute forced by anyone with enough computing power and knowledge of the flaw.
HOW THE ATTACK UNFOLDED
An attacker began sweeping wallets on July 30 2026 draining 1,082 BTC from 1,196 addresses in 41 minutes during the first wave.
Twenty five minutes into that first wave hundreds of Bitcoin holders had already lost everything in their cold storage wallets. The speed was possible because the attacker did not need physical access to any device. They simply used the knowledge of the firmware flaw to computationally recreate the weakened private keys and drain the wallets remotely.
What started as what appeared to be a single coordinated attack quickly became something else entirely. The Coldcard exploit fragmented from a handful of coordinated waves into an open free for all with Galaxy Research estimating that at least 15 separate attackers are draining vulnerable wallets.
Blockchain analytics firm TRM Labs traced the activity to at least 15 distinct threat actors, some likely opportunistic copycats. Stolen funds have been routed through privacy tools including Wasabi and Tornado Cash according to CertiK.
Once the vulnerability became known it was not just the original attacker exploiting it. Others who understood the flaw piled in looking for vulnerable wallets that had not yet been drained.
THE VICTIMS DID NOTHING WRONG
This is the part of the story that makes it particularly difficult to process.
The uncomfortable part is that none of the victims did anything wrong. They did not click a phishing link, paste a seed phrase into a fake website or sign a malicious transaction.
Every piece of standard self custody advice had been followed. Keep your seed phrase offline. Never share it with anyone. Use a hardware wallet. Store it in multiple secure locations.
All of it was irrelevant because the problem was not with how users handled their wallets. The problem was baked into the device itself at the moment the wallet was first set up. A vulnerability introduced by a single line of code five years before the attacks began.
That reality has shaken the self custody community deeply. The promise of hardware wallets is that if you do everything right your funds are safe. The Coldcard exploit proved that doing everything right is not always enough if the hardware itself has a flaw you cannot see.
WHICH DEVICES WERE AFFECTED
Attackers exploited firmware versions 4.0.1 through 4.1.9 spanning from March 2021 to the patch release in July 2026.
This means any Coldcard user who generated their seed phrase on firmware within that range is potentially vulnerable. The flaw affected Mk3, Mk4, Mk5 and Q models to varying degrees with Mk3 devices having the weakest key strength at approximately 40 bits.
Updating firmware does not fix existing wallets. Anyone who generated a seed on a Coldcard between March 2021 and the patch should treat it as compromised and migrate to a new seed.
This is critical. Installing the latest firmware does not undo the damage. If your wallet was set up during the affected period the seed phrase it generated is still weak regardless of what version of firmware you are running now. The only safe action is to generate a completely new seed on a patched device and transfer funds to the new wallet.
THE BROADER QUESTIONS THIS RAISES
The incident is the largest hardware wallet exploit in crypto history and it is forcing the entire Bitcoin self custody model to answer a question it has avoided since inception: who audits the code that generates your keys?
Hardware wallets are trusted because they are supposed to be more secure than software wallets or exchange accounts. Users buy them specifically because they want to remove their funds from any online attack surface. The Coldcard exploit shows that the security of a hardware wallet depends entirely on the integrity of its firmware and the quality of its code at every step of development.
Coinkite's firmware is open source which is generally considered a security advantage because anyone can review the code. But open source does not mean every line of code gets reviewed thoroughly by independent experts. The flaw introduced in March 2021 sat undiscovered for over five years.
Onramp CEO Michael Tanguma noted that self custody and ETFs share the same flaw: a single point of failure. With an ETF that single point is the custodian. With self custody that single point is the device and the code running on it.
Neither is perfectly safe. They just have different failure modes.
WHAT AFFECTED USERS SHOULD DO RIGHT NOW
If you have a Coldcard that was set up between March 2021 and July 2026 here is what the security community is recommending:
Assume your current seed is compromised regardless of whether your funds have moved
Set up a brand new Coldcard on the latest patched firmware and generate a completely new seed
Transfer all funds from your old wallet addresses to new addresses generated on the new seed
Do this urgently because vulnerable wallets that have not yet been drained may still be targeted
Do not simply update the firmware on your existing device and consider yourself safe. The seed that was generated under the vulnerable firmware is still weak. You need a new seed generated under clean conditions.
CONCLUSION
The over $116 million in losses came not from a broken secure element but from weak seed generation, showing that hardware wallet security is not simply about the device's architecture. It is about the full stack: seed generation quality, firmware update hygiene and the user's ability to verify and respond to security advisories.
The Coldcard exploit does not mean hardware wallets are not worth using. It means the assumption that any device is completely infallible needs to be retired permanently.
Self custody is still one of the most powerful tools available to crypto users. But it comes with responsibility that goes beyond just buying the right device. It requires staying informed about security advisories, understanding what firmware your device is running and being willing to migrate funds when a vulnerability is discovered even years after your wallet was first set up.
The hardest lesson of the Coldcard exploit is that doing everything right today is not a guarantee of safety if something went wrong at the moment your wallet was first created.
In crypto that kind of hidden risk is real and it always has been.
IF YOU WANT MORE OF THESE INFORMATION, THERE'S WAY MORE COMING RELATED TO THE CRYPTO SPACE.
FOR NOW, FOLLOW US ON TWITTER: SMCRESEARCHERS
BNB
694.95
+0.96%