Key Takeaways
- • A firmware vulnerability in older Coldcard (Mk3 series) hardware wallets reduced seed phrase entropy to approximately 40 bits, enabling attackers to reconstruct private keys and drain between 1,367 and 1,816 BTC ($89M–$116M) from over 5,200 wallet addresses between late July and early August 2026.
- • Spot Bitcoin ETFs including IBIT, FBTC, BITC, ARKB, and MSBT recorded combined inflows of $620 million in the days following the July 30 disclosure, suggesting a material shift in investor preference toward regulated custody solutions over self-custody hardware wallets.
- • Coinkite CEO Rodolfo Novak issued an immediate advisory on July 31, 2026, instructing users whose seed phrases were generated on affected devices to transfer funds urgently; newer Coldcard models experienced partial entropy reduction, limiting but not eliminating their exposure.
- • Galaxy Research identified approximately 1,367 BTC drained from 4,585 affected addresses by early audit publication, with theft activity concentrated in the immediate aftermath of the vulnerability's public discovery.
- • The incident has reignited the custody debate within the cryptocurrency market, with no direct causal link proven between the Coldcard breach and ETF inflows, but observable correlation during a critical window in the self-custody infrastructure narrative.
Summary
On July 30, 2026, Coinkite, the Canadian hardware wallet manufacturer, disclosed a critical firmware vulnerability affecting older Coldcard models, particularly the Mk3 series. The flaw did not involve physical theft but rather compromised the entropy—randomness—used during seed phrase generation, reducing it to approximately 40 bits rather than the cryptographic standard. This dramatic weakness made it mathematically feasible for attackers to reconstruct private keys from scratch without ever possessing the physical device.
The exploitation was swift and severe. Galaxy Research estimates that between 1,367 and 1,816 BTC were drained from over 5,200 wallet addresses in the days following public disclosure, representing losses of $89 million to $116 million at prevailing market prices. By early tallies, approximately 1,367 BTC had been confirmed drained from 4,585 addresses, with the bulk of losses concentrated between late July and early August 2026. Coinkite CEO Rodolfo Novak responded publicly on July 31, advising users whose seed phrases were generated on the affected hardware to transfer funds immediately to mitigate further risk.
The disclosure triggered a significant institutional capital shift toward regulated custody solutions. Spot Bitcoin ETFs including ARK 21Shares Bitcoin ETF ($ARKB), Fidelity Bitcoin ETF ($FBTC), iShares Bitcoin ETF ($IBIT), Bitwise Bitcoin ETF ($BITC), and Invesco Bitcoin Mini Trust ($MSBT) collectively recorded $620 million in net inflows across multiple consecutive days following the breach announcement. While no direct causal link has been formally established between the Coldcard vulnerability and these inflows, the temporal correlation occurred during a heightened custody debate within the self-custody community, suggesting that institutional and high-net-worth investors reassessed the risk-benefit profile of hardware wallet solutions versus professionally managed ETF structures.
Newer Coldcard models experienced reduced but non-negligible exposure. The entropy reduction on more recent hardware was partial rather than complete, limiting relative vulnerability compared to older units but underscoring the systemic nature of the firmware issue. Bitcoin's price remained stable through the incident, indicating that market-wide risk sentiment was not materially impaired despite the substantial dollar losses concentrated among self-custody users.
The exploitation was swift and severe. Galaxy Research estimates that between 1,367 and 1,816 BTC were drained from over 5,200 wallet addresses in the days following public disclosure, representing losses of $89 million to $116 million at prevailing market prices. By early tallies, approximately 1,367 BTC had been confirmed drained from 4,585 addresses, with the bulk of losses concentrated between late July and early August 2026. Coinkite CEO Rodolfo Novak responded publicly on July 31, advising users whose seed phrases were generated on the affected hardware to transfer funds immediately to mitigate further risk.
The disclosure triggered a significant institutional capital shift toward regulated custody solutions. Spot Bitcoin ETFs including ARK 21Shares Bitcoin ETF ($ARKB), Fidelity Bitcoin ETF ($FBTC), iShares Bitcoin ETF ($IBIT), Bitwise Bitcoin ETF ($BITC), and Invesco Bitcoin Mini Trust ($MSBT) collectively recorded $620 million in net inflows across multiple consecutive days following the breach announcement. While no direct causal link has been formally established between the Coldcard vulnerability and these inflows, the temporal correlation occurred during a heightened custody debate within the self-custody community, suggesting that institutional and high-net-worth investors reassessed the risk-benefit profile of hardware wallet solutions versus professionally managed ETF structures.
Newer Coldcard models experienced reduced but non-negligible exposure. The entropy reduction on more recent hardware was partial rather than complete, limiting relative vulnerability compared to older units but underscoring the systemic nature of the firmware issue. Bitcoin's price remained stable through the incident, indicating that market-wide risk sentiment was not materially impaired despite the substantial dollar losses concentrated among self-custody users.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.