Coldcard Hacker Moves 45% of Third-Wave Bitcoin Haul

Coldcard, a hardware wallet designed to keep Bitcoin private keys offline, has faced scrutiny over thefts linked in reports to a random-number-generation flaw dating to 2021. The weakness may have allowed attackers to derive keys and drain vulnerable wallets. The episode is significant because it challenges the security premise of hardware custody and highlights the persistent risk facing older devices whose funds were never migrated.

Galaxy Research said the theft campaign targeting Coldcard Bitcoin holders has recently slowed, possibly because the most vulnerable users have moved their assets or affected wallets have already been emptied. Reported losses now exceed $115 million, according to the latest account. Galaxy estimates the cumulative total could ultimately surpass $150 million, leaving a substantial gap between confirmed losses and the potential final toll.

Coldcard, made by Canada-based Coinkite, is an air-gapped hardware wallet designed to let Bitcoin holders control their own keys. A software integration error introduced in March 2021 caused some devices to use a weak pseudorandom-number path when generating seed phrases, sharply reducing their effective entropy. Attackers could therefore reconstruct vulnerable private keys by brute force without touching the devices, undermining a central assumption of self-custody: that an offline seed created by trusted hardware is practically unguessable.

Coinkite disclosed the incident on July 30, 2026, and told users whose Mk3 seeds were created with firmware 4.0.1 through 4.1.9 to generate new seeds and move their funds; installing updated firmware alone does not secure an existing seed. Investigators initially examined a 594.48-Bitcoin transfer, but Galaxy Research said by Aug. 25 that 1,789.28 Bitcoin, worth about $114.7 million, had been stolen across 8,865 addresses. About 87.3% of the traced funds, or roughly 1,561 Bitcoin, remained unmoved in attacker-controlled addresses.