A major security breach targeting Coldcard hardware wallets has resulted in losses approaching $130 million, as attackers drained approximately 2,100 Bitcoin across multiple attack waves. This vulnerability, discovered in late July, marks one of the most consequential hardware wallet exploits in Bitcoin’s recent history, leading to widespread fund migrations and heightened scrutiny on wallet security.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLDetails of the Coldcard exploit
The exploit affected Coldcard devices—offline hardware wallets designed and manufactured by Canadian company Coinkite—which are relied upon by users for self-custody and high-grade security. According to onchain analysis, the breach originated from a firmware bug introduced in March 2021. This flaw forced the devices to generate private keys using a weak software random number generator, bypassing the intended secure hardware component. The compromised method reduced private key security from 128 bits to approximately 40, drastically increasing vulnerability to key-guessing attacks.
Attackers began targeting addresses one by one, stealing Bitcoin from vulnerable wallets. Analytics by Galaxy Research identified three distinct waves of attacks, with at least 1,596 BTC stolen from more than 5,200 addresses. Some estimates place the total losses even higher, nearing 2,100 BTC.
Coinkite has publicly urged users who created wallet seeds with firmware versions 4.0.1 through 4.1.9—released from March 2021 to July 2026—to treat their wallets as compromised and move their funds immediately.
Mini dictionary: Coldcard is a hardware wallet developed by Coinkite that allows users to securely store Bitcoin private keys offline, emphasizing air-gapped operation for strong security.
Massive Bitcoin migration follows breach
Onchain data from analytics platforms such as Checkonchain and Glassnode documented a dramatic wave of Bitcoin movement in response to the Coldcard incident. Approximately 233,000 BTC—valued at about $15 billion at current market prices—were transferred out of long-term holder wallets within days of the breach, representing a significant reassessment of self-custody practices.
Casa CEO Nick Neuman reported, referencing conversations with users, that a sizable portion of these transfers originated not only from Coldcard owners but also from individuals using competing hardware wallets, including Ledger and Trezor. Many of these users reacted by upgrading their security setups, often implementing multisignature solutions for increased protection against similar vulnerabilities.
| Metric | Amount | Source |
|---|---|---|
| BTC stolen from Coldcard wallets | 2,100 BTC | Onchain, Galaxy Research |
| BTC moved to exchanges | 22,000 BTC | Checkonchain |
| BTC moved from long-term holders | 233,000 BTC | Checkonchain, Glassnode |
| Long-term holder supply drop | 1.38% (~233,000 BTC) | Glassnode |
Long-term holder supply decreased by nearly 1.38%, falling from close to 15 million BTC to about 14.7 million BTC, marking the largest weekly drop since December 2024. Despite this outflow, onchain analysts characterized the movement as proactive risk management, with self-custody users responding quickly to defend assets rather than panicking after irreversible losses.
Impact on self-custody and network resilience
The incident drew renewed attention to the importance of self-custody in securing digital assets. Market observers noted that, in contrast to centralized exchange breaches—where entire balances can be lost instantly—the slow, piecemeal nature of the Coldcard hack allowed many users to move their funds to safety before attackers could access them all.
“The onchain metrics around the Coldcard incident reinforce how important self-custody is to the resilience of Bitcoin as an asset class,” commented Casa CEO Nick Neuman on X.
Neuman further noted that “somewhere between ~10x-100x the amount of bitcoin stolen was moved to safety as people sounded the alarm,” highlighting the benefits of decentralized asset management. Many users adopted multisignature solutions, which require multiple separate keys for transaction approval, offering additional defense against single-device compromises.
This event “is a giant flashing neon sign showcasing the resilience that self-custody adds to the network,” he emphasized. Neuman contrasted this with custodial breaches, where far greater losses might occur if similar vulnerabilities emerged at major exchanges.
Analysts continue to assess residual risks and recommend that anyone with potentially affected Coldcard wallets migrate their holdings immediately. The event has sparked industry discussions about hardware wallet standards, update protocols, and user education to prevent similar incidents in the future.
