Key Takeaways
- • $100M+ in Bitcoin stolen: Hackers exploited a five-year-old firmware vulnerability in Coldcard hardware wallets, draining approximately $100–$130 million in BTC from over 7,300 addresses, with roughly 1,596 BTC confirmed stolen across multiple attack waves.
- • Firmware flaw enabled weak key generation: The exploit centered on a 2021 firmware bug that generated predictable and weak recovery seed phrases, allowing attackers to reconstruct wallet keys without physical access to the devices.
- • Significant on-chain activity spike: The Coldcard exploit drove Bitcoin active addresses to 980,000 and generated approximately 890,000 BTC in weekly on-chain movement, marking a 2026 high for onchain activity levels.
- • Multiple coordinated attack waves: Galaxy Research identified three confirmed attack waves plus additional smaller incidents, indicating sustained exploitation of the vulnerability across a distributed victim base.
- • No internet connectivity bypassed: The attack circumvented Coldcard's core security feature—offline storage without internet connectivity—by compromising the seed phrase generation mechanism at the firmware level.
Summary
Coinkite's Coldcard hardware wallet, widely regarded as one of the most secure self-custody solutions for Bitcoin storage, suffered a significant security breach on August 6, 2026, when the Toronto-based company disclosed a critical firmware vulnerability affecting thousands of users. According to Galaxy Research, a blockchain intelligence firm, hackers exploited the flaw to drain more than $100 million in BTC value from Coldcard users across multiple attack waves. Subsequent on-chain analysis refined the loss estimate to approximately $130 million, with confirmed theft of roughly 1,596 BTC from over 7,300 compromised addresses.
The vulnerability stemmed from a firmware bug dating back to 2021 that generated weak and predictable recovery seed phrases. Seed phrases—sequences of random words serving as master keys to authorize and sign transactions—are fundamental to Bitcoin self-custody security. By reconstructing these keys through the predictable generation mechanism, attackers were able to gain unauthorized access to user wallets without requiring physical possession of the Coldcard device itself. This capability undermined the wallet's primary security proposition: offline storage of private keys that never requires internet connectivity.
Galaxy Research documented three confirmed attack waves and numerous smaller incidents, indicating a sustained and coordinated exploitation campaign rather than isolated breaches. The exploit's impact extended beyond direct losses to create significant on-chain activity spikes. The Coldcard incident drove Bitcoin active addresses to 980,000 and generated approximately 890,000 BTC in weekly on-chain movement, marking a 2026 high for on-chain transaction volume. This elevated activity reflected both legitimate security responses from affected users moving funds and ongoing attacker transactions.
The timing and scale of the exploit underscore residual risks inherent in hardware wallet ecosystems, particularly when firmware vulnerabilities remain undetected for extended periods. Despite the device's reputation for security, the attack demonstrated that compromised key generation at the firmware level can circumvent air-gapped storage architecture. Users of Coldcard and similar hardware wallets are advised to audit their transaction histories and consider moving high-value holdings to newly generated addresses with independently verified key material, pending Coinkite's security remediation.
The vulnerability stemmed from a firmware bug dating back to 2021 that generated weak and predictable recovery seed phrases. Seed phrases—sequences of random words serving as master keys to authorize and sign transactions—are fundamental to Bitcoin self-custody security. By reconstructing these keys through the predictable generation mechanism, attackers were able to gain unauthorized access to user wallets without requiring physical possession of the Coldcard device itself. This capability undermined the wallet's primary security proposition: offline storage of private keys that never requires internet connectivity.
Galaxy Research documented three confirmed attack waves and numerous smaller incidents, indicating a sustained and coordinated exploitation campaign rather than isolated breaches. The exploit's impact extended beyond direct losses to create significant on-chain activity spikes. The Coldcard incident drove Bitcoin active addresses to 980,000 and generated approximately 890,000 BTC in weekly on-chain movement, marking a 2026 high for on-chain transaction volume. This elevated activity reflected both legitimate security responses from affected users moving funds and ongoing attacker transactions.
The timing and scale of the exploit underscore residual risks inherent in hardware wallet ecosystems, particularly when firmware vulnerabilities remain undetected for extended periods. Despite the device's reputation for security, the attack demonstrated that compromised key generation at the firmware level can circumvent air-gapped storage architecture. Users of Coldcard and similar hardware wallets are advised to audit their transaction histories and consider moving high-value holdings to newly generated addresses with independently verified key material, pending Coinkite's security remediation.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.