Coldcard hack steals $100 million in Bitcoin

A critical vulnerability in a widely used hardware wallet has led to one of the largest cryptocurrency thefts of the year, with losses now exceeding $100 million in Bitcoin. The flaw, which existed in Coldcard wallet firmware for over five years, allowed attackers to remotely drain funds from thousands of addresses without any user error, such as phishing or key leakage.

The breach stems from a firmware bug introduced in Coldcard version 4.0.1, released on March 17, 2021. The bug crippled the device's random number generator, causing some wallet seeds to be generated with drastically reduced entropy-as low as 40 bits instead of the intended 128 bits. This made the private keys vulnerable to brute-force attacks, where attackers could computationally guess the seeds and gain control of the wallets. The wallet manufacturer, Coinkite, disclosed the vulnerability on July 30, 2026, and issued a patched firmware version the following day.

On-chain analysis by Galaxy Digital confirms that attackers stole between 1,596 and 1,719 Bitcoin from approximately 7,300 addresses across at least three confirmed waves of theft. A suspected fourth wave was identified around August 3, potentially...