Key Takeaways
- • A Toronto-based entrepreneur lost $1.6 million CAD in Bitcoin (18.25 BTC) on July 29, 2026, when his Cold Card hardware wallet was compromised in a coordinated attack on Coinkite devices.
- • Approximately $140 million worth of Bitcoin was stolen across roughly 7,300 accounts in the Cold Card wallet hack, representing a significant breach of offline cryptocurrency storage devices.
- • An artificial intelligence system identified a critical vulnerability in the Cold Card's open-source code within 8 minutes—a flaw that had existed undetected for five years despite the code being publicly available for verification.
- • The attack drained funds from victims' accounts in minutes (ranging from 7 to 10 minutes in documented cases), exploiting a seed-generation weakness that compromised private keys stored in hardware wallets marketed as secure cold storage solutions.
- • The breach underscores systemic risks in cryptocurrency security infrastructure, where widely-used hardware wallets can contain dormant vulnerabilities despite open-source code availability and years of operational history.
Summary
On July 29, 2026, Jonathan Goodman, a 40-year-old Toronto-based entrepreneur and personal trainer, discovered that 18.25 BTC (valued at approximately $1.6 million CAD) had been drained from his Cold Card hardware wallet. The loss occurred as part of a broader coordinated attack targeting Cold Card devices manufactured by Canadian company Coinkite. According to available reports, approximately $140 million worth of Bitcoin was stolen across roughly 7,300 accounts in the incident, representing one of the largest hardware wallet breaches in recent cryptocurrency history.
The attack exploited a critical vulnerability in the Cold Card's open-source code that had remained undetected for five years. According to Vaibhav Sisinty, an individual affected by the breach, an AI system identified the flaw in just 8 minutes, despite the code being publicly available for verification throughout that period. The vulnerability compromised the wallet's seed-generation mechanism, which is fundamental to securing private keys. This suggests that the security flaw was not a result of obscure coding but rather something that should have been caught through standard code review practices.
The speed of the theft was striking. In documented cases, attackers drained funds from victims' Cold Card wallets in as little as 7 to 10 minutes once the vulnerability was exploited. The breach affected Cold Card MK3 wallets and other single-signature wallet variants, with losses ranging from over $1 million to $1.6 million per individual account. The attack specifically targeted the offline-password devices, which are designed to store cryptocurrency in cold storage—a method traditionally considered among the most secure approaches to protecting digital assets from online threats.
For institutional investors and wealth managers evaluating cryptocurrency custody solutions, this incident presents a critical risk assessment case study. It demonstrates that even mature hardware solutions with open-source code, extended operational history, and broad adoption can harbor fundamental security weaknesses. The breach raises questions about the adequacy of code review processes in the cryptocurrency hardware wallet industry and the effectiveness of community-driven security validation for critical financial infrastructure.
The attack exploited a critical vulnerability in the Cold Card's open-source code that had remained undetected for five years. According to Vaibhav Sisinty, an individual affected by the breach, an AI system identified the flaw in just 8 minutes, despite the code being publicly available for verification throughout that period. The vulnerability compromised the wallet's seed-generation mechanism, which is fundamental to securing private keys. This suggests that the security flaw was not a result of obscure coding but rather something that should have been caught through standard code review practices.
The speed of the theft was striking. In documented cases, attackers drained funds from victims' Cold Card wallets in as little as 7 to 10 minutes once the vulnerability was exploited. The breach affected Cold Card MK3 wallets and other single-signature wallet variants, with losses ranging from over $1 million to $1.6 million per individual account. The attack specifically targeted the offline-password devices, which are designed to store cryptocurrency in cold storage—a method traditionally considered among the most secure approaches to protecting digital assets from online threats.
For institutional investors and wealth managers evaluating cryptocurrency custody solutions, this incident presents a critical risk assessment case study. It demonstrates that even mature hardware solutions with open-source code, extended operational history, and broad adoption can harbor fundamental security weaknesses. The breach raises questions about the adequacy of code review processes in the cryptocurrency hardware wallet industry and the effectiveness of community-driven security validation for critical financial infrastructure.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.