WORLD 🔗 Part of: Tech and Cybersecurity News (55) · 04 Aug 2026 · 03:29 GMT ·2 min read

How a Firmware Flaw Compromised Coldcard Bitcoin Wallets, Leading to $70 Million in Losses

On July 30, 2026, attackers exploited a firmware vulnerability in Coldcard hardware wallets.

NEUTRALITY 95 · BALANCED· 3 sources

CoinDesk

On July 30, 2026, attackers exploited a firmware vulnerability in Coldcard hardware wallets. The breach resulted in the theft of 1,082.65 BTC, valued at $70.2 million, from 1,196 wallets. The flaw existed since March 2021. It bypassed hardware random number generators by using predictable software-based seeds. Attackers identified vulnerable wallets through blockchain data during a 41-minute window. Coinkite released emergency updates on July 31, 2026. Existing seeds remain compromised. Users must generate new seeds on updated firmware to secure their assets.

Context

The vulnerability began in March 2021 with the release of Coldcard firmware version 4.0.0. The flaw remained in several models for more than five years. Attackers exploited the security gap in July 2026.

Supportive perspectives

Coinkite issued emergency firmware updates on July 31, 2026. The patches fix a configuration error that previously bypassed the device's hardware random number generator.
The manufacturer instructed users to secure their remaining assets. Users must generate new seeds on the patched firmware to prevent private key prediction.
Not every user faces this vulnerability. Coinkite confirmed that seeds generated using at least 50 independent, private dice rolls remain secure from this exploit.
Coinkite expanded its list of affected hardware beyond the initial warning for the Mk3. The affected devices include Mk2 and Mk3 units running versions 4.0.0 through 4.1.9. The list also covers Mk4 and Mk5 units with software versions before 5.6.0, as well as Q models with versions before 1.5.0Q.

Critical perspectives

A software vulnerability exposed users for more than five years. Developers introduced the flaw in March 2021. Thousands of digital wallets operated with predictable entropy during this period.
The firmware contained a flaw in its random number generator. It relied on a software-based pseudorandom number generator seeded by device IDs and timer registers. These inputs are not secret.
Attackers drained 1,082.65 BTC from 1,196 wallets on July 30, 2026. The unauthorized transfer occurred between 01:10 and 01:51 UTC. This operation lasted 41 minutes.
Attackers identified targets using external blockchain data. During the theft, they reportedly queried a blockchain data provider to identify vulnerable wallets via source addresses.