Chronology of the Incident

On July 30, 2026, the Bitcoin community suffered one of the most severe hardware wallet exploits in cryptocurrency history. In a span of just 41 minutes, automated attacker scripts drained 1,196 Bitcoin addresses holding over 1,082 BTC—worth approximately $70.2 million to $88.6 million at current market prices. On-chain investigations conducted by Galaxy Research and engineering teams at Block quickly tied the coordinated wallet drain to a critical firmware flaw in Coldcard hardware signing devices manufactured by Canadian firm Coinkite.

The root cause was traced back to a build configuration bug introduced in a March 2021 firmware release (version 4.0.1). A preprocessor directive error unintentionally disabled the device's connection to its true hardware random number generator (TRNG) on the STM32 chip during wallet seed creation. Instead, the firmware silently fell back to a deterministic software Pseudorandom Number Generator (PRNG). Because the PRNG relied on a constrained set of predictable variables (such as device UIDs and timer states), threat actors were able to reconstruct potential seed phrases offline, compute derived public addresses, and match them against public blockchain records before executing automated asset transfers.

Scope and Technical Impact

The flaw affects Coldcard Mk3 devices running firmware version 4.0.1 through 5.0.3, as well as Mk4, Mk5, and Q models running firmware releases prior to emergency hotfixes published on July 31, 2026. Galaxy Research identified three separate attack waves targeting weak single-signature wallets.

A critical detail for crypto holders is that the vulnerability is tied to the seed phrase generation process, not the physical hardware unit itself. If a user created a seed phrase on an affected Coldcard device and later imported those recovery words into a different hardware wallet (such as a BitBox or Ledger), that wallet remains equally vulnerable to offline calculation and theft.

Remediation and Protection Guidance

Coinkite released emergency firmware updates on July 31, 2026—version 4.2.0 for Mk3, 5.6.0 for Mk4/Mk5, and 1.5.0Q for Q devices. However, security researchers emphasize that updating firmware alone does not fix an existing compromised seed phrase. Affected users must immediately take the following steps:

1. Do Not Rely Only on Firmware Updates: Updating your Coldcard ensures future seed generations are secure, but your existing seed phrase remains vulnerable. 2. Generate a Completely New Wallet: Create a new seed phrase on patched firmware or generate entropy manually using 50+ private dice rolls. 3. Migrate Funds Immediately: Transfer all Bitcoin assets from old addresses to newly generated, secure addresses as quickly as possible. 4. Leverage BIP-39 Passphrases: Users who added strong, custom BIP-39 passphrases to their wallets faced minimal risk, as passphrase entropy prevents brute-force derivation even if the primary seed is predictable.