Coldcard firmware flaw steals 594 Bitcoin, $38 million loss

A critical vulnerability in the firmware of Coldcard hardware wallets has led to the theft of approximately 594 bitcoin, worth about $38 million, from around 500 user wallets. The attack, which unfolded in under 30 minutes early on July 30, 2026, exploited a flaw that made the cryptographic seeds generated by the devices far easier to guess than intended.

The Canadian manufacturer, Coinkite, disclosed the issue on July 31, tracing the vulnerability to a software change made in March 2021. According to the company's technical analysis, a build configuration error during an integration of a Bitcoin library caused affected devices to bypass their secure hardware random number generator. Instead, the wallets fell back to a predictable software-based method that used non-secret chip data, such as the device's serial number, to generate seeds.

This dramatically reduced the effective randomness, or entropy, protecting the wallets. For the Coldcard Mk3 model, the search space for a seed shrank to roughly 40 bits, a fraction of the 128-bit security standard. Newer models, including the Mk4, Mk5, and Coldcard Q, were also impacted, though to a lesser degree, with their entropy reduced to...