coldcard

A recent wave of Bitcoin thefts has left 190 victims scrambling, but a new twist shows how attackers are moving the loot.
The Coldcard wallet, a popular hardware device for secure Bitcoin storage, has been exploited to siphon off a staggering 1,779 BTC—about 45% of the total stolen in what experts call “Wave 3” attacks. Galaxy, a leading blockchain analytics firm, uncovered the move as of mid‑August, revealing that the stolen coins have been shuffled through more than 8,600 addresses.
**What’s going on?**
Think of Bitcoin as a bank account that anyone can see, but only the owner has the keys. Coldcard is like a high‑security safe that many users trust to keep their keys offline. The recent exploit shows that attackers can break into the safe, grab the keys, and then move the money to a maze of addresses—making it hard for law‑enforcement to trace the trail. The 45% figure means almost half of the stolen funds are already on the move, which could signal a larger payout plan or a strategy to launder the coins.
**How the theft unfolded**
1. **Initial breach** – Hackers targeted Coldcard users, likely through phishing or supply‑chain attacks, gaining access to the device’s firmware.
2. **Stolen coins** – 1,779 BTC were extracted from 190 victims, a sum that would have made headlines if it stayed in one place.
3. **Moving the loot** – Galaxy traced the coins to over 8,600 addresses, showing a complex chain of transactions that spread the value across the network.
4. **Current status** – The coins are still circulating, and the attackers may be waiting for a market dip or a strategic moment to sell or swap them into other assets.
**Why this matters**
- **For users**: Even the most secure hardware wallets can be compromised if the supply chain or firmware is tampered with.
- **For the ecosystem**: Large‑scale thefts like this test the resilience of blockchain analytics and law‑enforcement tools.
- **For the market**: Moving large amounts of BTC can create volatility, especially if the coins are dumped in a short period.
**What you can do**
- Keep your firmware up to date and only download updates from the official Coldcard website.
- Use multi‑signature setups or additional layers of security, such as a second hardware wallet or a cold storage strategy.
- Stay informed: follow reputable analytics firms like Galaxy for real‑time alerts on suspicious activity.
#Bitcoin #Coldcard #CryptoSecurity
What steps are you taking to protect your crypto assets, and how do you feel about the current state of hardware wallet security?

August 2026 was a rollercoaster for the crypto space. Kind of a bad one. Just before the start of that month, some unknown attackers managed to take advantage of a bug in the Coldcard hardware wallets to steal up to 2,055 $BTC (~$130 million) directly from users. This is being considered the largest hardware wallet exploit to date. And it was followed by more attacks on Trezor and SafePal, two other major hardware wallet providers. Self-custody is thus called into question for many.
We’ve been told, repeatedly, that our private keys must remain offline, out of reach for hackers and scammers. Therefore, numerous crypto users have chosen to invest in more security and purchase specialized hardware devices to safeguard their coins. Now, among those who chose a Coldcard as this specialized device, several have lost their funds without even doing anything about it, because the attack was completely remote and out of their control.
It feels unfair. But wait, because there are still things to unpack before losing faith in self-custody.
So, What Happened to Coldcard and Company?
The first thing we must understand is that no, crypto networks aren’t just insecure now. The recent attacks weren’t against strong distributed ledgers, but against specific companies and their products. Let’s start with the Coldcard case: the problem came from the way certain devices generated wallet seeds or private keys.
In an average crypto wallet, just “guessing” seeds by applying brute force (many repetitive attempts) is impossible. A 12-word phrase alone has about 340 undecillion possibilities. This implies, as Knowing Bitcoin explains, that “if every computer on Earth tried a billion seed phrases per second, it would take trillions of times the current age of the universe to try them all." Unfortunately, it wasn’t like that for some Coldcard devices.
A software change introduced in 2021 caused certain devices to use a software-based pseudo-random number generator instead of the hardware-based random number generator intended for creating secure seeds. In other words, the wallet's security relied on insufficient randomness. Attackers were able to guess the private keys when they should never have been able to.
Even after applying a firmware fix, those seeds are just not suitable to use anymore. Anyone who has generated seeds on a Coldcard between 2021 and 2026 is advised to withdraw all their funds to a more secure wallet.
What about Trezor and SafePal?
At the very least, no funds were compromised in these two attacks. However, they can be considered equally serious, because personal data and physical addresses were, indeed, leaked. On August 12, Trezor informed that ShipMonk, one of their shipping providers, suffered a severe data breach that exposed the full names, phone numbers, email addresses, and physical addresses of almost 12,000 of its customers.
In the same fashion, barely some days later, SafePal announced the discovery of a bug that could let someone access or track customer order information without having the proper permission. Which some hackers did. Confidential data like names, phone numbers, emails, and physical addresses from almost 40,000 customers was stolen.
It seems "better" than having funds or private keys taken away, but it isn't. With all this information, hackers can easily find customers, carry out targeted attacks, phishing, and even plan "wrench attacks" or physical break-ins at their homes. Indeed, according to Certik, violent physical attacks against crypto users have increased by 33% in 2026, compared to the previous year.
Should we rush to crypto exchanges, then?
According to CMC, "Coldcard Hack Sends Bitcoiners Scrambling for CEXes." So, are they safer for us, after all? Is that a real solution in the long-term for crypto users? The answer isn't that simple. Centralized exchanges, even with tons of investment in security, can and have been hacked.
In 2025, Coinbase, one of the largest exchanges worldwide, suffered the same type of leak as Trezor and SafePal. In previous years, other firms like Liquid, KeepChange, Celsius, and OpenSea faced major data breaches, too. Beyond that, numerous crypto exchanges have been robbed or bankrupted over the years —or they were just scams from the beginning. Mt. Gox, QuadrigaCX, Cryptopia, and FTX are only some of them. Thousands of users globally suffered massive losses from these cases. That’s why this motto is so common in crypto: Not your keys? Not your coins.
However, now that self-custody appears to be threatened, what is the alternative? Where do we run to? You may think that, well, the flaws were limited to certain brands, so we just change brands and that’s it…! And that’s still not the answer. The answer is that nothing and no one is exempt from failure. Self-custody requires more responsibility, while external custody presents a different set of risks. That’s the thing, though.
Neither arrangement removes risk. They put different risks on different sides of the table, and you need to choose which of these risks is “less risky” for your own circumstances. Which benefits do you prefer (i.e., full ownership vs. convenience) and what are you willing to risk for them? Even fiat currencies and banks have their own risks and disadvantages, and their pitfalls are the whole reason why cryptocurrencies exist. Sad, but true.
New Lesson: Don't Put All Your Eggs in One Basket
Decentralize, like crypto networks themselves! If one device, one manufacturer, one backup, one company, or one process can determine whether your entire stash survives, that's a single point of failure you need to fix ASAP, no matter how secure you believe it is. There are several solutions for this.
A simple starting point is backup redundancy, with copies stored in separate locations so one fire, flood, or defective device doesn't wipe out everything. In Obyte, you can create several textcoins with different amounts in them, and store them offline. However, you’ll have to take care of noting down your textcoins (seeds), copying them to different secure locations, and taking care of them to the best of your ability. The only way for self-custody is high responsibility.
For stronger protection, multisignature wallets can require two or more separate keys before coins can be moved. A 2-of-3 setup, for example, uses three keys but requires any two to approve a transaction. That means losing one key doesn’t automatically lock you out, while compromising one key doesn’t give an attacker enough control. You can also spread keys across different devices or manufacturers, reducing dependence on one technology.
In Obyte, you can create a multisignature (multidevice) account in just a few steps to increase your security and, if you wish, include other people as co-signers, not just your own devices.
There’s also value in testing recovery. A backup that has never been checked is a plan on paper. A successful recovery test provides evidence that the plan works. And complexity deserves its own warning label. Every extra passphrase, device, location, and backup adds another thing to remember and maintain.
So, Is Crypto Self-Custody Dead?
No. If anything, the bumps along the road make the idea more mature. Self-custody avoids potential financial censorship and can give people full control, but control comes with homework, from understanding how keys are created to knowing where backups live and what happens when a device fails. To be prepared for a device to fail, even.
Self-custody means taking ownership of the entire security model, not just buying a device with the words “hardware wallet” on the box. Do your own research (DYOR) on every brand, every software, and every process. This is worth repeating: the only way for self-custody is high responsibility!
Originally Published on Hackernoon
#Coldcard #TrezorWallet #DataLeak #cryptohacks #Obyte

Most traders focus on price, but the real signal is how the biggest wallets adapt to threats.
Coldcard, the hardware wallet brand that has long been the gold standard for institutional holders, just rolled out a firmware update that forces users to inject their own randomness when generating seed phrases. The move follows a $130 million Bitcoin exploit that exposed vulnerabilities in the device’s seed‑generation process.
#Coldcard #BTC #HardwareWallet
The new firmware requires a user‑supplied entropy source, effectively eliminating the risk of predictable seed generation that attackers exploited. In addition, the update patches several other cryptographic flaws uncovered during a three‑week audit that included both internal and external security teams.
What does this mean for the market?
1️⃣ Institutional confidence in hardware wallets is likely to rise, as the upgrade removes a major attack vector that could have undermined trust in custodial solutions.
2️⃣ The $BTC price may see a short‑term uptick as whale activity shifts toward more secure storage, reducing the risk of large‑scale thefts that historically have triggered panic selling.
3️⃣ On‑chain analytics show a spike in cold storage addresses after the breach, suggesting that many users are already migrating their holdings to more robust devices.
Watch List: Keep an eye on the #Coldcard firmware release notes and the on‑chain activity of addresses that have recently upgraded. A sudden surge in new seed‑generation transactions could signal a wave of users moving their assets out of vulnerable wallets.
If you’re still using a legacy hardware wallet, now is the time to upgrade. Are you ready to lock in the next layer of security before the next wave of exploits hits?

Popular hardware wallet manufacturer Coldcard has released new firmware versions to address a seed phrase exposure vulnerability. According to CryptoSlate, versions 5.6.1 and 1.5.1Q significantly harden the new wallet creation process. Users must now press keys 65 times when initializing a new wallet, a measure designed to strengthen entropy sources and narrow potential attack vectors.
The most critical aspect of the update is the warning that seed phrases created on affected firmware versions cannot be repaired. Users who initialized wallets using the vulnerable releases must move their funds to a secure wallet. This highlights that hardware wallet security requires both software patches and user action.
Security researchers note that such vulnerabilities typically require physical access but still pose serious risks. The Coldcard team maintained transparent communication throughout the detection and patching process. Users can download firmware updates through official channels to secure their devices.
This incident demonstrates that security auditing of crypto custody solutions is an ongoing process. For hardware wallet users, regular firmware monitoring and following official announcements remains essential.
#Coldcard #HardwareWallet #Security
Sources: CryptoSlate
This news digest was compiled with AI assistance; it is not financial advice. Always do your own research (DYOR).

Popular hardware wallet manufacturer Coldcard has released new firmware versions to address a seed disclosure security vulnerability. According to CryptoSlate, the 5.6.1 and 1.5.1Q releases significantly harden the new wallet creation process. Users now have to press the button 65 times when starting a new wallet; this is intended to strengthen randomness sources and narrow possible attack vectors.
The most critical point of the update is the warning that seed phrases created with the affected firmware versions cannot be repaired. It emphasizes that users who set up a wallet using one of the affected versions should move their funds to a secure wallet. This serves as a reminder that hardware wallet security must be ensured not only through software updates, but also through user actions.