Cold or cracked: anatomy of the Coldcard breach

The safest place to keep bitcoin was a device that never touches the internet. Attackers emptied thousands of them without touching one. A 2021 firmware error made Coldcard seeds guessable, and roughly 1,816 BTC has left 5,200 addresses. The vault held. The key was the problem.

TL;DR

What happened - A firmware error introduced in March 2021 caused Coldcard hardware wallets to generate seed phrases using a predictable software random number generator instead of the device's hardware chip. Attackers reproduced those seeds offline and began sweeping wallets on 30 July 2026.

The damage - Four waves of thefts have drained approximately 1,816 BTC, worth close to 116 million dollars, from more than 5,200 addresses. Researchers warn the sweeps are continuing.

The reaction - More than 77,000 BTC in long-dormant coins moved on-chain as holders raced to migrate, a shift analysts compared to the aftermath of the FTX collapse.

The response - Coinkite shipped corrected firmware for every affected model, but an update alone does not help. Affected users must generate an entirely new seed and move their funds.

The crux - No device was touched, no phrase was phished, no vault was opened. The keys were guessable from the moment they were born.

How did the Coldcard breach happen?

Coldcard, made by the Canadian firm Coinkite, is a bitcoin-only hardware wallet built around a simple promise: private keys are generated and stored on an offline device, out of reach of the internet.

For years it has been a fixture of the self-custody world, favoured by long-term holders precisely because it removes trust in third parties.

On 30 July that promise met a five-year-old bug. Coinkite published a security advisory the same day that a report from Block's Bitcoin Engineering and Security team traced the incident to a firmware vulnerability dating back to 2021.

The mechanism was almost absurdly small. A single commit in early March 2021 changed the seed generation call from the function that correctly reached the STM32 hardware random number generator to a path that routed through a broken software library.

Instead of hardware-based randomness, the wallet sometimes used a fallback generator that was deterministic in nature, meaning the numbers it produced were not random enough to be cryptographically secure - and attackers could reproduce the keys offline.

The scope, per Coinkite's own advisory:

Mk2 and Mk3 devices on firmware versions 4.0.1 through 4.1.9 inclusive
Mk4 and Mk5 seeds generated before standard version 5.6.0 or Edge version 6.6.0X

Q seeds generated before standard version 1.5.0Q or Edge version 6.6.0QX, where the impact is less severe but still serious

That is five years and four months of affected seed generation

Why could the seeds be guessed?

A standard 12-word seed is supposed to carry 128 bits of entropy - a search space so vast that guessing it is not a practical attack, it is a thermodynamic joke.

The bug collapsed that space. Coinkite estimates effective entropy at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q, against the expected 128 bits

At 40 bits, enumeration is trivial for modern hardware. An attacker does not need the device, the PIN or the user.

Someone who can determine or sufficiently constrain the device state can reproduce candidate output streams offline without ever accessing the device, derive the corresponding addresses, scan the blockchain for balances and sweep whatever is there.

No malware, no brute force in the traditional sense - just weak random numbers at the moment of creation.

Two groups of users were shielded by their own paranoia. Seeds built with at least 50 fair, independent, private dice rolls carried at least 128 bits of entropy from the dice input alone, and a strong, unique BIP-39 passphrase adds an independent barrier that the reduced seed entropy alone cannot cross.

The people who trusted the device least were hurt least.

How much was stolen?

The numbers have moved daily, which is itself part of the story.

The initial estimate on 30 July stood at 594 BTC. By 31 July Galaxy Research was tracking 1,082.65 BTC taken from 1,196 addresses - drained in a single 41-minute window.

A second wave on 1 August lifted the count to 1,158.66 BTC from 2,673 addresses, and a third wave a day later pushed the running total to 1,367 BTC, roughly 89 million dollars, from 4,585 addresses.

Then, on Sunday evening, it happened again - live. Galaxy's Alex Thorn flagged a probable fourth wave on 3 August while the sweep was still in motion inside the mempool, with 388.93 BTC confirmed moved across 218 transactions from 462 vulnerable addresses.

The cumulative total now stands at approximately 1,816 BTC across more than 5,200 addresses, worth close to 116 million dollars.

The victims were not traders. The stolen coins had sat untouched for an average of 3.18 years before being taken, underscoring that those affected were long-term holders.

The largest single drained address held 51 BTC - someone's entire cold storage, gone in one block.

Curiously, the loot is not moving. The bulk of the stolen coins still sits unspent in attacker-controlled addresses, which Galaxy called unusual for a theft of this size - either the operator is waiting for scrutiny to fade, or has no viable way to launder a sum this visible.

Roughly 600 suspected attacker addresses have been reported to federal investigators, industry compliance firms and cross-industry cyber investigators. Attribution remains unknown - investigators have not linked the incident to any specific actor.

What did holders do when the news broke?

They ran - carefully, and in enormous numbers.

Since the vulnerability was disclosed, 77,402 BTC that had been dormant for an extended period moved on-chain, which analysts stressed reflects wallet hardening rather than panic selling.

CryptoQuant recorded transactions involving outputs of less than 1 BTC reaching 39,600 BTC on 31 July alone - the signature of thousands of individual holders migrating savings, not whales repositioning.

The migration produced two second-order effects worth understanding.

First, it broke the dashboards. Analysts warned that the forced movement of old coins distorts long-term holder supply, coin days destroyed, spent output age bands and related metrics. For the next few weeks, on-chain charts that appear to show veteran holders "distributing" may show nothing of the sort.

Second, it inverted a mantra. Many affected users raced to move bitcoin off self-custody and back onto centralised exchanges or freshly generated addresses - a reversal of the industry's usual "not your keys, not your coins" ethos. Exchange deposits surged in the days after disclosure.

Sentiment followed. Santiment measured 0.58 bullish comments for every bearish one across major platforms, the lowest ratio since its modern social tracking began.

The market itself was far calmer than the timeline. Bitcoin and ether fell less than 1 percent in the days following the disclosure, with BTC grinding through the low 60,000s, though bitcoin ETFs did record 265 million dollars in redemptions on 31 July, led by BlackRock's IBIT.

The rush carried its own hazards. Moving funds under time pressure creates fresh opportunities for user error, phishing and rushed mistakes - and security researchers spent the weekend urging people to slow down precisely when every instinct said hurry.

Prominent voices such as Jan3's Samson Mow urged anyone using a Coldcard, on any firmware or model, to migrate funds immediately.

How has Coinkite responded?

Faster than most, though not without stumbles.

The company initially scoped the confirmed risk to older devices, describing newer models as unaffected based on early analysis, before expanding the advisory on 1 August to state that pre-fix Mk4, Mk5 and Q seeds carried about 72 bits of entropy instead of the expected 128.

The concrete measures since then:

Corrected firmware for every affected model and release track, with customers urged not to generate new seeds on affected models until updated
An open letter from CEO Rodolfo Novak telling anyone who generated a seed on a Coldcard to move funds first and read the details later
A commitment to help affected customers file police reports or insurance claims, and cooperation with blockchain investigators and law enforcement
Destruction of remaining vulnerable inventory and a halt on shipments
A refusal to speculate on scope or attribution before the full technical evaluation is complete

One admission stands out. The bug existed in open-source code for over five years, and Coinkite says it has to assume someone used AI to review previous versions of its firmware to uncover the flaw - while noting that the company itself ran a leading AI model over the code weeks earlier and it did not flag the problem

Where was the real flaw?

Here is the uncomfortable part: everything the marketing promised worked.

The air gap held. The secure element held. The PIN held. The attacker never touched a single device.

What failed was something no user could see, verify or influence - the quality of the randomness in the first second of the wallet's life.

That is the actual lesson of this breach. A hardware wallet is not a fortress protecting your key; it is a machine for making a key and then a fortress around whatever it made.

If the making is broken, the fortress guards a number an attacker can compute at leisure, offline, years later.

As Blockaid's co-founder put it, a hardware wallet's security ultimately comes down to firmware and systems users interact with but never see. Most crypto losses in the first half of 2026 came not from smart contract hacks but from compromised keys and operational security failures, with Coldcard fitting that pattern because the exposure originated at the key generation stage.

The design sin has a name in security engineering: fail-open. When the hardware generator was not used, the device fell back silently to the weak one instead of refusing to work.

A wallet that crashed on seed generation in March 2021 would have been an embarrassing bug report. A wallet that quietly degraded became a 116 million dollar time bomb.

And there is a new accelerant. Thorn wrote that the sweeps look deliberate and programmatic, probably orchestrated with a large language model, and cautioned that every vulnerable single-sig Coldcard address will eventually be drained.

Five-year-old code used to be protected by obscurity and human attention spans. It no longer is - machines now read history at scale, on both sides of the fight.

What happens to self-custody now?

Two scenarios, one event.

The hardening scenario. Holders respond the way the dice-roll users already did: by trusting devices less and verifying more.

Independent entropy, strong passphrases and multisignature setups spread across devices from different manufacturers become standard practice rather than enthusiast folklore. Self-custody comes out of this more resilient, because its weakest assumption - blind trust in a single vendor's firmware - has been publicly falsified and repaired.

The outsourcing scenario. The operational burden proves too much.

Industry observers already suggest the incident may accelerate adoption of regulated custodians and spot bitcoin ETFs, on the logic that if you do not want to worry yourself, you need to pay someone else to be worried. Convenience wins, and the base of holders who actually control their keys quietly shrinks.

Which scenario prevails will not be decided by the attacker. It will be decided by education - by how many holders learn what entropy is, why dice beat chips and how to structure custody so that no single point of failure, human or silicon, can end the story.

Worth noting for perspective: the first half of 2026 saw 207 separate attack incidents, the most ever recorded in a half-year period, yet total losses of about 972 million dollars came to less than half of the 2.3 billion stolen in the first half of 2025.

The industry is getting harder to rob. Individuals, this week, learned they must get harder too.

Key terms

Seed phrase - the human-readable master key (typically 12 or 24 words) from which every address in a wallet is derived. Whoever can reproduce it owns the coins.

Entropy - the measure of unpredictability in a random value. 128 bits is the bitcoin standard; every bit lost halves the attacker's work.

TRNG vs PRNG - a true random number generator draws on physical noise in hardware; a pseudorandom number generator computes numbers from an internal state. If the state is knowable, so is the output.

Fail-open - a design that continues operating in a degraded, insecure mode when a component fails, instead of stopping. The opposite, fail-closed, refuses to proceed.

BIP-39 passphrase - an additional user-chosen secret combined with the seed, creating a separate wallet. Distinct from the device PIN.

Dice-roll entropy - randomness supplied by the user through physical dice, independent of the device's generator.

Sweep - a transaction that empties an address completely in one move, the standard pattern of automated theft.

FAQ

Does updating the firmware fix an existing wallet?

No. Updating corrects future seed generation but does not repair a seed already created on affected firmware - users must generate a new seed on patched hardware and migrate all funds.

Are other hardware wallets affected?

Tapsigner, Opendime and Satscard use different code and are not affected, and Block, Trezor and Ledger have confirmed their products are not affected - the vulnerability is specific to Coldcard's firmware build process. Users who migrated seed words from a Coldcard to another wallet, however, may still be exposed.

Are dice-roll seeds safe?

Coinkite says a seed built with at least 50 fair, independent, private dice rolls is not at risk from this bug alone - and recommends migrating if the number or privacy of the rolls is uncertain.

Who is behind the attack?

Unknown. Recent large thefts have often been attributed to state-backed groups, but investigators have not linked this incident to any specific actor.

Is this the end of self-custody?

It is the end of unexamined self-custody. The holders protected this week were the ones who assumed their device could fail and layered defences accordingly.

Security is a practice, not a purchase

This breach will be discussed for years, because it cuts to the core question of bitcoin ownership: what, exactly, are you trusting when you trust yourself?

At Bitcoin Poland Conference 2026 - 5 - 6 October at the Poznań Congress Center - self-custody, key management and operational security are on stage precisely because weeks like this one prove they cannot be an afterthought.

Poland's first bitcoin-only conference brings together the people who build, break and defend these systems, in a format designed for substance over spectacle.

Read also: our earlier look at custody risk in "Frozen or stolen" on the Bitcoin Poland blog.

About Bitcoin Poland Conference

Bitcoin Poland Conference is a bitcoin-only conference taking place on 5-6 October 2026 at the Poznań Congress Center. The programme covers bitcoin as a monetary network and the technology, security and governance questions that surround it.

Follow Bitcoin Poland Conference