Coldcard firmware flaw results in $70M Bitcoin theft

A critical vulnerability in the firmware of Coldcard hardware wallets has led to the theft of tens of millions of dollars in Bitcoin, prompting urgent security warnings for users. The flaw, which reduced the randomness used to generate wallet seeds, was exploited in a coordinated attack on July 30, 2026, draining funds from hundreds of wallets.

Blockchain analytics firms have traced the thefts to the vulnerability. Galaxy Research reported that approximately 1,082.65 Bitcoin, worth around $70 million, were withdrawn from 1,196 addresses in a roughly 40-minute window starting just after 1:10 a.m. UTC on July 30. An earlier analysis by Chainalysis linked the incident to the theft of over $38 million in Bitcoin from a similar number of wallets. The discrepancy in estimates is attributed to different methodologies and transaction sets being analyzed. The attacker reportedly targeted higher-value wallets first before sweeping smaller balances.

The vulnerability stems from a firmware integration error introduced in version 4.0.0, released in March 2021. According to the wallet manufacturer, Coinkite, a build-time check failed, causing affected devices to bypass their secure hardware...