Coldcard wallet hack update: over $116 million in Bitcoin stolen from thousands of “cold storage” wallets across three attack waves since July 30, 2026. A 2021 firmware error caused weak seed generation, letting attackers reconstruct private keys without touching devices. Coinkite has patched the flaw, but affected owners must migrate funds immediately, updating firmware alone won’t protect existing wallets.
Cold storage is supposed to be the safest place to keep Bitcoin. The device never touches the internet. The private keys never leave it. In theory, an attacker would need to physically hold the device to steal anything. That idea just took a serious hit. The Coldcard wallet hack has drained more than $116 million in Bitcoin from thousands of supposedly secure wallets, and attackers never touched a single device. Here’s everything crypto investors need to know.
What Happened, in Plain English
Coldcard is a popular Bitcoin-only hardware wallet made by Canadian manufacturer Coinkite. Attackers began draining funds from Coldcard wallets in coordinated waves starting July 30, 2026. The first wave alone hit 1,196 addresses in just 41 minutes, taking roughly 1,083 BTC worth about $70.2 million at the time.
The attacks didn’t stop there. Galaxy Research identified a second wave on August 1, adding hundreds more compromised wallets. A third wave followed shortly after. By early August, total confirmed losses reached 1,367 BTC across 4,585 addresses, worth close to $89 million. Some reports place total losses even higher, near $116 million, once investigators factor in additional flagged wallets.
The Root Cause: A Five-Year-Old Coding Error
Here’s the part that makes this incident genuinely unusual. This wasn’t a phishing scam. Nobody tricked a user into revealing their seed phrase. Nobody physically stole a device. According to Block’s engineering and security team, a single code change made back on March 1, 2021, caused certain Coldcard firmware to quietly generate wallet seeds using weaker, more predictable methods, instead of relying on the device’s built-in randomness source. Coinkite has confirmed the issue and is still studying its full scope.
That gap matters a lot. A truly random seed should be nearly impossible to guess. A weaker method can shrink that guessing pool dramatically, making it possible for a skilled attacker to rebuild affected wallets’ private keys. Chainalysis traced the sweep and found clear signs of planning. The attacker went after the biggest wallets first, including one holding $1.8 million, and had already grabbed roughly $30 million within the first ten minutes.
Why This Attack Went Undetected for So Long
The sweep ran for nearly 30 hours before Coinkite issued its first public warning. Affected owners only learned something was wrong once the coins were already gone. That gap between the theft and the warning helps explain why losses grew so large across three separate waves, instead of stopping after the first one.
This Doesn’t Mean Self-Custody Is Broken
It’s tempting to read this story as proof that holding your own Bitcoin is riskier than keeping it on an exchange. Security researchers push back hard on that idea. Blockaid’s co-founder and CEO, Ido Ben-Natan, has pointed out that most crypto losses in the first half of 2026 came from compromised keys and basic security mistakes, not smart contract exploits. The Coldcard incident fits that broader pattern exactly.
The real lesson here runs deeper than “self-custody bad, exchanges good.” Self-custody carries a different kind of risk than exchange custody, not necessarily a bigger one. Exchange hacks and platform collapses, like FTX and Mt. Gox before them, prove custodial platforms can fail too. Coldcard’s exposure shows that firmware and supply-chain trust carry their own risks, ones users rely on daily but never actually see or check themselves.
What Coinkite Has Done in Response
Coinkite has moved fast since the flaw came to light. The company released emergency firmware fixes for every affected model and destroyed remaining vulnerable stock still in its warehouse. Shipments of affected units stopped almost immediately. Coinkite also published a public security notice explaining exactly what the fix covers.
Here’s the critical catch, though: installing the updated firmware only protects wallets created after the fix. Existing seed phrases generated before the patch stay exposed. If your wallet’s seed phrase came from vulnerable firmware, updating alone won’t secure your current funds. You need to move those funds to a newly generated, verified-secure wallet instead.
What Coldcard Owners Should Do Right Now
If you own a Coldcard device, security researchers and Coinkite itself point to a few concrete steps worth taking immediately.
- Check your firmware version. Open your Coldcard and look under settings to see which firmware version generated your current wallet.
- Move your funds if you’re on affected firmware. Don’t just update the firmware and assume you’re safe. Generate a brand-new seed on patched, verified firmware, and transfer your Bitcoin to that new wallet.
- Audit every wallet tied to the same device. A single Coldcard often generates multiple addresses and accounts. Treat all of them as compromised if even one was affected, and migrate everything.
- Watch out for follow-up scams. Fake “fund recovery” services and fake support agents tend to target victims after any high-profile hack like this one. No real company or service will ever ask for your seed phrase, under any circumstance.
- Stay alert for further waves. This attack has already unfolded in three separate rounds. Security researchers warn the risk of further exploitation hasn’t fully passed, so keep watching even after you’ve moved your own funds.
The Bigger Pattern: Key Security, Not Code Exploits
This incident fits a much larger trend shaping crypto security in 2026. Most crypto losses so far this year trace back to compromised keys and basic security mistakes, according to Blockaid, rather than smart contract bugs or exchange hacks. The Coldcard case is an especially severe version of that pattern, since the flaw sat all the way back at the key generation stage, the very first step of setting up a wallet.
That’s a genuinely sobering realization for anyone who assumed hardware wallets removed this kind of risk entirely. A hardware wallet’s real security ultimately comes down to firmware and systems most owners never see or verify directly. That holds true no matter how solid the physical device feels in your hand.
Has This Shaken Confidence in Cold Storage?
Despite the scale of this hack, the broader market reaction has stayed fairly calm. Bitcoin and Ethereum prices moved less than 1% in the days following the news, even as the story dominated crypto social media and industry commentary. Total losses near $116 million sit at less than half the $2.3 billion stolen across all of crypto in the first half of 2025, which puts this incident in serious but not unprecedented territory.
Some analysts think incidents like this could push more cautious investors toward regulated custody options, including Bitcoin ETFs, rather than reinforcing confidence in self-custody. Others argue the opposite. They see fast vendor action and open disclosure as proof the security ecosystem works, even if only after the fact.
What This Means Going Forward
- Firmware transparency matters more than ever. Expect louder demand for auditable, open-source firmware across the hardware wallet industry after this incident.
- “Cold” doesn’t mean risk-free. Offline storage guards against certain threats, like remote hacking or malware, but it can’t erase risks baked in during manufacturing or firmware development.
- Vendor response speed matters. Coinkite’s fairly quick patch, public notice, and inventory destruction likely kept losses from growing even larger.
- Diversify custody where it makes sense. Leaning on a single wallet, brand, or storage method for everything you own concentrates risk in one place. Spreading meaningful holdings across different custody setups limits your exposure to any single point of failure.
Final Thoughts
The Coldcard wallet hack stands as one of the largest documented thefts from cold storage devices in Bitcoin’s history, and a genuine wake-up call for anyone who assumed hardware wallets made this category of risk disappear. The root cause wasn’t a clever new attack trick. A five-year-old coding error quietly undermined the one thing cold storage promises: truly random, unguessable keys. For Coldcard owners, the message stays urgent and simple: check your firmware, move your funds if needed, and skip waiting for a fourth wave to find out whether you were affected.
We’ll keep tracking this story as Coinkite, Galaxy Research, and Chainalysis continue investigating the full scope of the flaw.
Frequently Asked Questions
What caused the Coldcard wallet hack?
A firmware coding error introduced in March 2021 caused certain Coldcard devices to generate Bitcoin wallet seeds using weaker, more predictable methods instead of the device’s built-in randomness source, making some wallets’ private keys rebuildable by attackers.
How much money was stolen in the Coldcard hack?
Reported losses have grown across multiple waves of attacks, from an initial $70.2 million to roughly $89 million, with some reports citing total losses closer to $116 million as investigators keep digging.
Is my Coldcard wallet still safe if I update the firmware?
Updating firmware alone won’t protect your funds if your wallet’s seed phrase was generated before the patch. Generate a new seed on updated, verified firmware and move your Bitcoin to that fresh wallet.
Does the Coldcard hack mean self-custody is unsafe?
Not according to most security researchers. The incident points to a specific risk tied to firmware and supply-chain trust, not proof that self-custody is riskier than exchange custody, which carries its own well-documented history of failures.