Key Takeaways
- • 594 bitcoin ($38 million) stolen in coordinated 25-minute sweep from approximately 500 Coldcard single-signature wallets on July 31, 2026, between 01:31 and 01:56 UTC, with 562 BTC consolidated into a single address that remains unmoved.
- • Firmware vulnerability introduced March 2021 in Coldcard 4.0.0 caused devices to bypass hardware randomness generators and revert to predictable software-based key generation seeded by non-secret chip data, rendering "impossible to guess" seeds into guessable ones.
- • Mk3 devices most vulnerable, with Coinkite warning users who created seeds on Mk3 hardware running firmware 4.0.1 or later, while Mk4, Q, and Mk5 generations appear unaffected; affected wallets held dormant coins spanning 2021 to 2026, each containing more than 0.15 BTC.
- • Self-custody debate reignited as breach exposes risks in hardware wallet architecture; Coldcard CEO NVK attributed theft to imported compromised seeds rather than device-wide flaw, though security specialists continue examining the coordinated attack mechanism.
- • Bitcoin market resilience demonstrated with minimal visible price impact despite $38 million theft, suggesting institutional confidence in broader market fundamentals unshaken by isolated hardware wallet security failures.
Summary
A critical vulnerability in Coldcard hardware wallets has resulted in the theft of approximately 594 bitcoin ($38 million) from roughly 500 separate single-signature wallets in a coordinated attack executed within a 25-minute window on July 31, 2026. The attacker moved 1,324 chunks of bitcoin across 500 transactions within a three-block window, with 562 BTC subsequently consolidated into address bc1qnk, which has remained stationary. The breach has reignited institutional debate surrounding the security and practicality of self-custody arrangements for bitcoin holdings.
The underlying vulnerability stems from a firmware flaw introduced in Coldcard version 4.0.0 released in March 2021. The defect caused affected devices to bypass their dedicated hardware randomness generator and fall back to predictable software-based key generation seeded by non-secret chip data. This degradation of entropy transformed cryptographic seeds that should have been computationally impossible to guess into derivable keys vulnerable to brute-force attacks. The vulnerability affected Mk3 devices running firmware 4.0.1 or later, with Coinkite explicitly warning users in this cohort to migrate funds immediately.
The theft pattern reveals sophisticated targeting: every drained wallet operated as a single-signature address, each contained more than 0.15 BTC, and many had remained dormant for years—suggesting attackers conducted historical scans of blockchain data to identify vulnerable wallets created during the vulnerable firmware window. The temporal overlap between coin custody dates (2021 to 2026) and the vulnerability's age indicates systematic harvesting of affected key material.
Coinkite has stated that Mk4, Q, and Mk5 hardware generations appear unaffected, limiting the incident's scope to a discrete user population. However, Coldcard CEO NVK has disputed characterization of a device-wide vulnerability, arguing instead that compromised wallets resulted from users importing previously-exposed seeds rather than a hardware-level flaw. Regardless of attribution, the breach underscores structural risks in hardware wallet architecture and has prompted renewed scrutiny of self-custody models among institutional investors managing significant bitcoin allocations.
Despite the magnitude of the theft, bitcoin's market price has experienced minimal visible impact, suggesting the institutional market has compartmentalized this security incident and maintained confidence in broader market fundamentals. The event, however, will likely accelerate adoption discussions around multisig custody solutions and institutional custodial services among family offices and hedge funds currently evaluating direct bitcoin exposure.
The underlying vulnerability stems from a firmware flaw introduced in Coldcard version 4.0.0 released in March 2021. The defect caused affected devices to bypass their dedicated hardware randomness generator and fall back to predictable software-based key generation seeded by non-secret chip data. This degradation of entropy transformed cryptographic seeds that should have been computationally impossible to guess into derivable keys vulnerable to brute-force attacks. The vulnerability affected Mk3 devices running firmware 4.0.1 or later, with Coinkite explicitly warning users in this cohort to migrate funds immediately.
The theft pattern reveals sophisticated targeting: every drained wallet operated as a single-signature address, each contained more than 0.15 BTC, and many had remained dormant for years—suggesting attackers conducted historical scans of blockchain data to identify vulnerable wallets created during the vulnerable firmware window. The temporal overlap between coin custody dates (2021 to 2026) and the vulnerability's age indicates systematic harvesting of affected key material.
Coinkite has stated that Mk4, Q, and Mk5 hardware generations appear unaffected, limiting the incident's scope to a discrete user population. However, Coldcard CEO NVK has disputed characterization of a device-wide vulnerability, arguing instead that compromised wallets resulted from users importing previously-exposed seeds rather than a hardware-level flaw. Regardless of attribution, the breach underscores structural risks in hardware wallet architecture and has prompted renewed scrutiny of self-custody models among institutional investors managing significant bitcoin allocations.
Despite the magnitude of the theft, bitcoin's market price has experienced minimal visible impact, suggesting the institutional market has compartmentalized this security incident and maintained confidence in broader market fundamentals. The event, however, will likely accelerate adoption discussions around multisig custody solutions and institutional custodial services among family offices and hedge funds currently evaluating direct bitcoin exposure.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.