Key Takeaways
- • Hackers stole approximately 1,800 bitcoin (BTC), worth roughly $116 million, from Coldcard hardware wallets over the week beginning July 30, 2026, marking a significant breach of devices long considered secure storage solutions.
- • A 2021 software update to Coldcard wallets weakened the password randomness generator, reducing cryptographic security and remaining undetected for five years until the breach exposed the vulnerability.
- • Users who manually generated passwords using physical dice or other independent randomization methods appear to have avoided the vulnerability, suggesting the flaw was specific to the wallet's built-in password generation function.
- • Block's bitcoin engineering and security teams, working with anonymous independent researchers, identified the root cause within hours of the initial breach and published a full technical breakdown, while manufacturer Coinkite confirmed the five-year scope on August 3.
- • Bitcoin's price declined approximately $2,000 in the three days following the July 30 hack, though it has since recovered; the Crypto Fear and Greed Index stood at 39 out of 100 on August 6, reflecting market anxiety compounded by Federal Reserve policy and seasonal weakness.
Summary
The cryptocurrency industry faced a significant security crisis in early August 2026 when hackers exploited a critical flaw in Coldcard hardware wallets, draining an estimated $116 million in bitcoin from affected users. According to Galaxy Research data, approximately 1,800 BTC were stolen over a seven-day period beginning July 30. The breach is particularly notable because it targeted Coldcard devices, which have maintained a reputation as among the most secure storage options for digital assets, raising urgent questions about hardware wallet security standards across the industry.
The vulnerability originated from a 2021 software update that silently degraded the wallet's random-number password generator. The flaw persisted undetected for five years before the theft exposed the weakness. Within hours of the initial breach reports, Block's bitcoin engineering and security teams collaborated with independent researchers to reverse-engineer the firmware and identify the broken randomization mechanism. The team disclosed their findings to Coinkite, the Toronto-based manufacturer of Coldcard devices, and published a comprehensive technical analysis publicly. Coinkite issued a preliminary advisory the same day and confirmed on August 3 that the vulnerability had existed for five years.
A counterintuitive aspect of the incident emerged during the investigation: users who generated their own passwords through independent means—such as rolling physical dice or using other manual randomization methods—appear to have successfully avoided the vulnerability. This pattern suggests the attack specifically exploited Coldcard's compromised internal password generation function, leaving users who bypassed the automated system unaffected.
The breach triggered measurable market disruption. Bitcoin's price declined approximately $2,000 during the three-day period immediately following the July 30 attack, though the asset has since recovered some losses. Market sentiment deteriorated substantially, with the CoinMarketCap Crypto Fear and Greed Index registering 39 out of 100 on August 6, reflecting investor fear. Contributing factors to the weakness include hawkish Federal Reserve positioning and historical seasonal volatility in August cryptocurrency markets, though timing of the breach coincides directly with the sentiment deterioration.
The vulnerability originated from a 2021 software update that silently degraded the wallet's random-number password generator. The flaw persisted undetected for five years before the theft exposed the weakness. Within hours of the initial breach reports, Block's bitcoin engineering and security teams collaborated with independent researchers to reverse-engineer the firmware and identify the broken randomization mechanism. The team disclosed their findings to Coinkite, the Toronto-based manufacturer of Coldcard devices, and published a comprehensive technical analysis publicly. Coinkite issued a preliminary advisory the same day and confirmed on August 3 that the vulnerability had existed for five years.
A counterintuitive aspect of the incident emerged during the investigation: users who generated their own passwords through independent means—such as rolling physical dice or using other manual randomization methods—appear to have successfully avoided the vulnerability. This pattern suggests the attack specifically exploited Coldcard's compromised internal password generation function, leaving users who bypassed the automated system unaffected.
The breach triggered measurable market disruption. Bitcoin's price declined approximately $2,000 during the three-day period immediately following the July 30 attack, though the asset has since recovered some losses. Market sentiment deteriorated substantially, with the CoinMarketCap Crypto Fear and Greed Index registering 39 out of 100 on August 6, reflecting investor fear. Contributing factors to the weakness include hawkish Federal Reserve positioning and historical seasonal volatility in August cryptocurrency markets, though timing of the breach coincides directly with the sentiment deterioration.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.