Coldcard Bitcoin Wallet Hack Grows to $75 Million as Firmware Flaw Drains Over 2,600 Wallet Addresses

Bitcoin held broadly steady above $64,000 this weekend even as security researchers revealed the scale of a major hardware wallet exploit continued to grow, with the total amount stolen from Coldcard wallet users climbing to roughly $75.1 million as investigators traced additional theft transactions tied to the same underlying firmware flaw.

The attack began late Thursday, July 30, with an initial 25-minute sweep that drained approximately 594 bitcoin, worth about $38 million at the time, from around 500 single-signature wallets secured by Coldcard hardware devices. Galaxy Research, a blockchain analytics firm, later identified a second, larger wave of theft transactions tied to the same attacker, ultimately tracking a combined total of 1,158.66 bitcoin, worth roughly $75.1 million, taken from 2,673 separate wallet addresses across two related sweeps.

The vulnerability responsible for the theft traces back to a firmware integration error introduced in Coldcard firmware version 4.0.0 in March 2021, according to security analysis published by Block, the fintech firm founded by Jack Dorsey. The flaw caused affected devices to bypass their dedicated hardware random number generator, the component specifically designed to ensure a wallet’s recovery seed cannot be predicted or reproduced by anyone other than the device’s owner, and fall back instead to a less secure, software-based method of generating that seed. According to Block’s analysis, the resulting seeds carried roughly 72 bits of entropy rather than the 128 bits normally expected, a weakness significant enough that an attacker with knowledge of certain non-secret device information could reconstruct candidate seed values and check them against public blockchain records to identify wallets holding funds.

Bitcoin Core developer instagibbs independently reproduced the underlying vulnerability using a fresh Mk3 device, confirming the affected code path described in Block’s research. Security researcher James O’Beirne warned that any user holding a single-key Coldcard Mk3 wallet generated between 2021 and 2023 without additional protections such as a passphrase, physical dice rolls or a multisignature setup should treat their funds as being at immediate risk.

Coinkite, the Canadian company that manufactures Coldcard hardware wallets, confirmed the vulnerability in a public statement and urged affected customers to move their funds to newly generated wallets as a precaution. The company said the issue specifically affects seeds generated on Mk3 devices running firmware version 4.0.1 or later, and separately disclosed that seeds generated on Mk4 and Mk5 devices before firmware version 5.6.0, and on Q devices before version 1.5.0Q, also carried reduced entropy compared to what the devices were designed to provide, though Coinkite said those device generations appeared unaffected by the actual theft. Coinkite has since released patched firmware addressing the underlying flaw, though the company and outside security researchers have stressed that a firmware update alone cannot fix a seed that was already generated under the vulnerable code, since the compromised randomness was baked into the wallet’s recovery phrase at the moment of creation. Anyone affected has been advised that generating an entirely new seed on updated firmware is the only reliable remedy.

Every wallet identified in the theft was a single-signature wallet holding more than 0.15 bitcoin, and many of the affected wallets had remained dormant for years before the attack. The creation dates of the compromised wallets spanned from 2021 to 2026, closely matching the period during which the flawed firmware had been publicly available as open-source code, a detail security researchers said indicates the attacker specifically targeted wallets based on when they were created rather than through any conventional hacking method such as phishing or malware.

Despite the scale of the theft, roughly $75 million and counting, Bitcoin’s overall market price showed little sustained reaction. The cryptocurrency closed out July 2026 up roughly 7% for the month, its strongest monthly performance since the current market recovery cycle began, and remained range-bound near $64,000 to $65,000 in the days following the exploit’s disclosure. Analysts have pointed to that resilience as a sign of continued underlying market confidence, even as the incident has drawn comparisons to the 2023 “Milk Sad” vulnerability, another widely publicized case in which weak random number generation compromised cryptocurrency wallet security.

Of the funds swept from the initial wave of theft, approximately 562 bitcoin was consolidated into a single address shortly after the attack and had not moved as of the most recent reporting, according to Block’s analysis, leaving open the possibility that authorities or blockchain investigators could eventually trace or freeze the stolen funds if the attacker attempts to move or cash out the consolidated holdings.

Bitcoin now enters August, historically the cryptocurrency’s weakest calendar month over each of the past four years, with the Coldcard incident adding a fresh layer of uncertainty to broader market sentiment already shaped by expectations around Federal Reserve interest rate policy and other macroeconomic factors heading into the fall.