More than 1,755 bitcoin, worth about $110 million at the time, have been drained from roughly 5,000 wallets whose security was supposed to be unbreakable. The wallets were created with Coldcard hardware devices, which for years carried a reputation as the safest way to store cryptocurrency offline.
The thefts trace to a flaw in the random-number generator inside certain Coldcard units, according to analysis firms tracking the attacks. A random-number generator produces the entropy from which a wallet’s recovery phrase is derived; if the generator is weak, the phrase can be guessed. In this case, researchers said, the flawed generator allowed an attacker to systematically reproduce the seed phrases of wallets created on affected devices.
By Aug 3, attackers had emptied more than 1,755 bitcoin from about 5,000 affected wallets, according to analysis firms’ data, with the funds moved out in patterns consistent with automated sweeps. Coinkite, the Canadian company that makes Coldcard, confirmed the vulnerability and released a corrected firmware, urging users to update their devices and move funds to wallets created with fresh randomness.
Coldcard’s selling point has always been paranoia. The device is built around a deliberately spartan design — a small screen, a keypad, no Bluetooth, and no USB data unless the user asks for it. Security reviewers have long ranked it among the most trusted hardware wallets, and its users tend to be the most security-conscious people in the industry, the ones who lectured others about keeping keys off internet-connected devices.
The attack targets the one link in the chain users could not control. Even a perfectly stored device is only as safe as the numbers it generates when it creates a wallet. Analysts said the incident shows that cold storage — the practice of keeping keys on a device that never touches the internet — protects against online thieves, but not against flaws inside the hardware itself.
Random-number failures have a long history in cryptography. Weak generators have compromised everything from early Bitcoin wallets to game consoles, and the lesson is always the same: a system is only as strong as its source of randomness. In this case, the flaw sat in a product marketed to people who trusted it with their life savings.
The scale of the attack is what makes it unusual. Thousands of wallets emptied through a single flaw, at a time when the price of bitcoin made each wallet worth more than a year’s salary for many owners. Analysis firms said the attacker appeared to have identified affected wallets and waited, draining them over time rather than all at once, a pattern that kept the theft quiet for longer.
The incident adds to a brutal year for crypto security. In the first half of 2026, hackers stole $972 million of cryptocurrency across 207 separate attacks, the highest half-year total on record, according to industry data. Exchange hacks accounted for the biggest single losses, but the Coldcard case cuts deeper: it undermines the hardware layer that the industry tells newcomers to trust.
Hardware wallets have had scares before. Ledger, the market leader, suffered a data breach that exposed customers’ contact details, and phishing attacks against wallet owners are constant. But the Coldcard episode is different: the failure was inside the cryptographic core of the device itself, not in the company’s servers or in a user’s habits.
Users of affected devices face a straightforward but tedious remedy: update the firmware, create a new wallet with a freshly generated seed phrase, and move the funds. Analysts said anyone who generated a seed phrase on an affected unit should treat the old wallet as compromised, whether or not funds have moved yet. The attack is likely still running, they said, with automated systems watching for new wallets created on vulnerable devices.
The episode lands as regulators and institutions push more money into crypto. The industry’s pitch to newcomers has leaned on hardware wallets as the answer to exchange failures, and a flaw that undermines the hardware layer complicates that pitch. Analysts said the case shows that no layer of the stack is beyond attack, and that the safest device is still only as safe as the math inside it.
For Coinkite, the incident is a test of trust built up over years. The company moved quickly to confirm the flaw and ship a fix, and its prompt response limits the damage, analysts said. But the questions will linger: how the flaw got in, how long it went unnoticed, and why no one caught it during the reviews that built Coldcard’s reputation.
The incident will also be studied by the broader hardware security industry, which has made randomness a point of pride. The failure is a case study in how a single weak component can defeat every other protection, and wallet makers are expected to respond with public audits of their entropy sources. Some competitors have already said their devices use multiple independent sources of randomness, a design choice that the Coldcard case is likely to make standard practice.
For the owners of cold wallets, the lesson is uncomfortable. The safest storage in the industry failed where it mattered most, and the fix starts with the same thing the attack exploited: the seed.
