A widespread security breach targeting Coldcard hardware wallets resulted in the theft of more than 1,778 Bitcoin from over 8,600 wallet addresses, with current losses exceeding $112.7 million. Analysts described the incident as the largest known compromise of a hardware wallet platform to date.
ETH
SOL
BSC
ROBINHOOD
USDT
AAPLFirmware vulnerability exposes funds
The attack was traced back to a firmware update released by Coinkite in March 2021, specifically version 4.0.1. This release inadvertently shifted seed phrase generation from a secure hardware-based random number generator to a software-based pseudorandom number generator. Security experts emphasized that software-generated randomness is far more predictable, increasing the risk of private keys being replicated or guessed by attackers.
In July 2026, the attackers initiated a coordinated operation and, within just 41 minutes, siphoned more than 1,000 Bitcoin from over 1,000 wallets. Verified activity suggests that more than 1,778 Bitcoin were stolen in total, although malicious withdrawals ceased after August 6. Out of the stolen amount, about 1,531 Bitcoin remains idle in wallets tied to the hackers, while roughly 246 Bitcoin was moved further using privacy-preserving strategies such as Coinjoin mixers and advanced anonymizing tools.
Simply installing updated firmware cannot fix the issue. Any seed phrase created with the impacted firmware version remains permanently at risk. Users with exposed wallets must generate a new seed phrase on secure firmware and transfer their funds immediately.
A software developer reportedly notified Coinkite of vulnerabilities as early as May 2025. However, the flaw lingered for months, giving adversaries time to build and deploy scalable exploits targeting multiple Coldcard models, including Mk2, Mk3, Mk4, Q, and Mk5. Coinkite issued a security bulletin and an apology from CEO Rodolfo Novak at the end of July 2026, and distributed patched firmware on July 31.
AI systems play central role in attack
Investigators at Galaxy Research stated that the attackers utilized unrestricted artificial intelligence systems, such as the open-source Kimi K3 model, to uncover and exploit the firmware weakness. The deployment of advanced AI for malicious purposes outpaced defensive capabilities.
Rob Hamilton, CEO of Anchorwatch, explained that strict safety rules at major US AI labs hampered defenders’ access to equally capable countermeasures. As a result, cybersecurity teams had to rely on public AI tools very similar to those used by the attackers.
Hamilton joined a group of approximately 25 security professionals, including developers from the Cashu project, to form the Bitcoin Red Team. This coalition has been systematically auditing cryptocurrency codebases in search of vulnerabilities and sharing its findings with the broader community.
Galaxy Research distributed information on the hackers’ wallet addresses to exchanges, compliance groups, and law enforcement in an effort to block or freeze stolen assets that might reach centralized platforms.
Coldcard user response and industry impact
Security specialists have urged affected Coldcard users to take urgent action. Since the vulnerability centers on the process used to create seed phrases, only wallets generated with the patched firmware are considered secure. Affected individuals must create new wallets with updated firmware and transfer their funds without delay.
No multisignature wallets were compromised in the attack, underscoring the increased security that requires multiple approvals for each transaction. The incident places this theft as the twentieth largest in the history of cryptocurrencies, ranking just below Multichain’s $130 million breach and just above Harmony’s $100 million Horizon bridge hack.
While the focus remains on digital asset security, the trend toward tokenizing real-world assets (RWAs) and bypassing conventional middlemen has been accelerating. Wall Street institutions and retail investors alike are adopting Web3 platforms like 1stepSwap, which let users hold tokenized shares, gold, and silver directly in their crypto wallets. By harnessing instant pricing and transparent smart contracts, these platforms eliminate the need for traditional brokers.
