USDColdcard Exploit Losses Top $100 Million as Phishing Threats Spread
Weak Seed Generation Exposed Thousands of Bitcoin Wallets
TL;DR
- A Coldcard firmware defect produced predictable wallet seeds, exposing thousands of Bitcoin addresses to theft.
- Three confirmed attack waves involved 1,596 BTC, while suspected losses could reach 2,055 BTC.
- Scammers are exploiting the incident through fake hardware audits and remote-access software.
Trade smarter on Jupiter, Solana’s leading DEX built for fast execution and deep liquidity.
Swap tokens at competitive rates, route across multiple liquidity sources automatically, and access perpetuals, DCA, and advanced trading tools — all in one place!
A Coldcard firmware defect weakened the randomness used to generate Bitcoin recovery phrases, allowing an attacker to reconstruct private keys and steal more than $100 million across three confirmed waves. Investigators had associated the thefts with approximately 7,300 addresses by August 4, 2026, while a suspected fourth wave could push the total losses to roughly $130 million.
Block’s Bitcoin Engineering and Security team and independent Bitcoin Core developers traced the vulnerability to seed generation on affected Coldcard devices. The defect redirected randomness away from the STM32 hardware random-number generator and into MicroPython’s deterministic Yasmarang fallback generator, reducing the number of possible recovery phrases an attacker needed to search.
The weakness affected Coldcard Mk2 and Mk3 devices running firmware versions 4.0.1 through 4.1.9. Seeds created under those conditions were drawn from a comparatively small, searchable set, making it possible for an attacker to derive private keys through computation without obtaining the owner’s written recovery phrase.
Coldcard Mk4, Q and Mk5 devices were less severely affected, but their seed-generation process still provided about 72 bits of entropy rather than the intended 128-bit security level. The problem arose when the recovery phrase was created, meaning secure offline storage, an untouched device and careful handling of the mnemonic could not correct a seed that was predictable from the outset.
Affected users could therefore lose funds without being phished, infected with malware or physically separated from their hardware wallets. Importing the same phrase into another manufacturer’s device would not remove the weakness because the vulnerability remained embedded in the original mnemonic.
Confirmed and Suspected Losses Expanded in Waves
The first confirmed theft emerged on July 31, when about 594.5 BTC was swept from roughly 500 addresses across four Bitcoin blocks. Investigators later connected three waves to about 4,585 addresses holding approximately 1,367 BTC, valued at roughly $88.6 million to $89 million at the time.
Another 1,912 affected addresses subsequently added 207.73 BTC to the identified losses. Those newly identified coins remained unspent, indicating that the attacker had obtained control of them without immediately moving them through additional transactions.
The confirmed total later increased as investigators identified more affected wallets and related thefts.
Reports circulating on August 3 initially placed the possible fourth-wave loss near $114 million. An update citing Galaxy Research the following day raised the potential total, though the additional addresses had not all been definitively connected to the same Coldcard vulnerability.
Alex Thorn of Galaxy Digital cautioned that similar transaction patterns on the Bitcoin blockchain were not sufficient by themselves to establish that every swept address came from vulnerable Coldcard firmware. That left part of the suspected fourth wave provisional rather than confirmed.
Approximately 90% of the stolen Bitcoin remained unmoved during the latest reporting period. Funds linked to the first three confirmed waves were still held at addresses controlled by the attacker, allowing investigators to continue mapping the thefts and comparing transaction behavior across suspected wallets.
Galaxy Research shared confirmed attacker addresses with U.S. law-enforcement agencies, crypto exchanges and blockchain investigation companies. The distribution of those addresses could allow compliant services and investigators to flag later movements involving the identified coins.
Market commentator Joe Consorti said the public visibility of Bitcoin transactions could make the stolen funds difficult to use. “The thief who stole $100 million in BTC is going to have a hard time spending most of it. Every coin is sitting in plain sight, tracked by Galaxy, the FBI, and thousands of others,” Consorti said.
Consorti added that Bitcoin “might be the worst money for crime ever invented,” distinguishing the compromise of private keys from the ability to move stolen assets without leaving an observable blockchain record. He said the incident resulted from wallet software released after March 2021 rather than a failure of Bitcoin’s consensus rules or cryptography.
Bitcoin traded near $64,000 and was up approximately 2% over 24 hours when that assessment was reported. Consorti cited the limited market response as evidence that traders were separating the Coldcard failure from the Bitcoin network.
Crypto commentator Shagun also said surveillance systems, compliance controls and potential operational errors could complicate attempts to monetize the stolen funds. Shagun suggested that the attacker return the assets in exchange for a negotiated security bounty.
Other commentators disputed the view that the funds were effectively trapped. They pointed to mixers, privacy-focused cryptocurrencies, Taproot transaction structures, the Lightning Network and other tools as possible ways to fragment or obscure the transaction trail. The available information did not establish that the attacker was unable to spend the Bitcoin, only that moving an identified nine-figure balance could create substantial surveillance and compliance obstacles.
We’ve launched the all-new COIN360 Perp DEX, built for traders who move fast!
Trade 130+ assets with up to 100× leverage, enjoy instant order placement and low-slippage swaps, and earn USDC passive yield while climbing the leaderboard. Your trades deserve more than speed — they deserve mastery.
Firmware Updates Cannot Repair Existing Weak Seeds
Coinkite released emergency firmware, paused device shipments and instructed affected users to generate new recovery phrases before moving their funds. Updating the firmware could correct seed generation for future wallets, but it could not add randomness to a phrase created under the defective process.
Users therefore needed to create an entirely new seed through an unaffected method and transfer their Bitcoin to addresses derived from it. Continuing to use an existing phrase after installing updated firmware would leave the original weakness intact.
The vulnerable implementation entered distributed firmware in 2021 and remained available until disclosure in July 2026. The code was publicly accessible during that period, but the flaw remained undetected for about five years.
Coinkite said previous reviews had confirmed that the correct hardware-randomness function existed in the firmware binary. Those reviews did not verify that the seed-generation routine actually called and used the function when producing recovery phrases.
The case exposed a limitation of reproducible firmware builds. Reproducibility can demonstrate that software installed on a device matches publicly available source code, but it does not establish that the code itself correctly uses every security component.
Coldcard had emphasized Bitcoin-only firmware, air-gapped signing, dual secure elements, public source code and reproducible builds. Those controls did not prevent the exploit because the recovery phrase had already been weakened before the device’s other protections became relevant.
Users who added a strong and unique BIP-39 passphrase had another protective layer because the final wallet keys depended on both the mnemonic and the passphrase-derived salt. Reconstructing the weak recovery words alone would not automatically expose those wallets, though Coinkite still recommended migration.
A BIP-39 passphrase is separate from the device PIN. The PIN unlocks the hardware wallet, while the passphrase changes the wallet’s cryptographic derivation and creates a different set of addresses.
Coldcard users who generated seeds with at least 50 fair, independent and private dice rolls were excluded from this specific weakness. External entropy prevented the defective internal generator from being the only source of randomness.
Independent Keys Matter in Multisignature Custody
Andrew Mannoukas, chief information security officer at Xapo Bank, said the incident showed the risk of relying on a single seed-generation event.
“The lesson of this incident isn't that hardware wallets are bad; it's that concentration is. When the security of your Bitcoin is reduced to a single secret, created on a single device, in a single unrepeatable moment, you've inherited every assumption that is baked into that moment,” Mannoukas said.
Mannoukas said industry data increasingly showed crypto losses arising from operational and key-management failures rather than attackers defeating the underlying cryptography.
Multisignature custody could reduce exposure only when the keys were created independently. A 2-of-3 wallet could tolerate one compromised key, but multiple keys generated by the same defective implementation could share the same vulnerability.
Coldcard documentation allowed one device to create multiple multisignature cosigners through different passphrases. Those cosigners could still depend on the same hardware, firmware and randomness process. Greater separation would require keys produced through unrelated devices, implementations and independent entropy sources.
Security data cited alongside the exploit showed that infrastructure and operational compromises, led primarily by private-key and seed-phrase theft, accounted for about 76% of the value stolen in crypto hacks during the first half of 2026 while representing approximately 15% of incidents.
Separate data identified wallet compromise as the costliest attack category during the period, with more than $444 million stolen across 33 incidents.
Coinkite Apologizes as Scammers Exploit User Fears
Coinkite founder Rodolfo Novak apologized publicly and said the company accepted full accountability. Coinkite offered to help affected users prepare police reports, insurance claims and blockchain investigations.
Reimbursement was not among the publicly listed remedies as of August 3. Coinkite does not hold customers’ Bitcoin, leaving users without the same recovery structure that may exist when assets are lost through a custodial service with reserves or insurance.
The exploit also produced a separate phishing threat as scammers targeted users concerned about their hardware wallets. Trezor and Foundation warned of campaigns seeking recovery phrases or attempting to install malicious software.
Trezor instructed users to enter wallet backups only on the physical hardware device and said its products were not affected by the Coldcard firmware defect.
Foundation said attackers were sending emails that impersonated the company and linked recipients to fraudulent websites and malicious downloads. Foundation said it would never request a recovery phrase or instruct users to install software to secure a wallet.
Proofpoint documented a Coldcard-themed campaign on August 3 that used spoofed email addresses and asked recipients to join a supposed “coordinated hardware audit.” The language copied terminology surrounding the real investigation and presented the request as a security response.
The emails directed users to a cloned Coldcard website containing a “Start Hardware Audit” button. Proofpoint’s Threat Insight account warned: “A COLDCARD hardware wallet vulnerability is being exploited by threat actors. The reported firmware flaw has led to tens of millions worth of Bitcoin stolen.”
Threat Insight said it had observed email-based social-engineering campaigns that impersonated Coldcard and relied on “hardware audit” themes.
Clicking the fraudulent audit button downloaded a batch file hosted on GitHub. The file installed ScreenConnect, a legitimate remote-access application that attackers could misuse to control a victim’s computer.
Proofpoint said that access could support data theft, financial theft or the installation of additional malware, including ransomware. The cloned website also included a customer-service chat handled by a real person who guided victims through the installation process.
Proofpoint said the campaign “preys on the fear and concern” of hardware-wallet owners following the Coldcard disclosures.
Galaxy Research said the Coldcard exploitation remained ongoing and advised users to move assets to a fresh seed or a custodian. The continuing migration effort created an opportunity for scammers to disguise phishing attempts as urgent security procedures.
The phishing campaign was separate from the firmware exploit. The original vulnerability exposed predictable seeds, while the secondary campaign tried to persuade users to install remote-access software or surrender sensitive recovery information.
Previous hardware-wallet phishing cases included a February 2026 physical-mail campaign that targeted Trezor and Ledger users with holograms, forged executive signatures and artificial deadlines. A counterfeit Ledger application drained millions from users in April, while a March campaign used fake GitHub issues to direct developers to a spoofed website.
The strongest protections identified after the Coldcard incident were replacing every potentially affected seed, moving funds before attackers could sweep them, using a strong BIP-39 passphrase, adding independently generated entropy and distributing multisignature keys across unrelated hardware and software implementations. Users were also warned not to provide recovery phrases, join unsolicited wallet audits or install software through unexpected messages.
This article has been refined and enhanced by ChatGPT.
