A critical firmware vulnerability in Coldcard hardware wallets caused over $116 million in Bitcoin losses, even as the network experienced its highest wallet activity of 2026. The incident underscores how rapidly security flaws can spread across the Bitcoin ecosystem, affecting thousands of users simultaneously despite widespread adoption of self-custody tools.

What Happened to Coldcard Hardware Wallets?

In late July 2026, Coinkite, the company behind Coldcard hardware wallets, discovered a critical flaw in its seed generation process. The vulnerability affected Coldcard Mk3, Mk4, Mk5, and Q models, where the firmware relied on a software-based random number generator instead of a properly randomized entropy source. This reduced the actual entropy, or randomness, to approximately 40 or 72 bits, compared to the 256 bits that Bitcoin security standards require.

Entropy is the foundation of cryptographic security. When a wallet generates a private key, it needs to create a number so random that no attacker could ever guess it. A reduction from 256 bits to 40 or 72 bits made affected wallets vulnerable to brute-force attacks, where hackers could systematically test possible private keys until they found the correct one. Since the vulnerability was disclosed on July 30, attackers exploited it to drain over $116 million in Bitcoin from affected users.

How Did This Impact Bitcoin's Network Activity?

The timing of the vulnerability coincided with a significant surge in Bitcoin wallet creation and on-chain activity. During the week of August 8, Bitcoin saw 2.27 million new wallets added, with 751,000 active wallets, marking the highest on-chain activity in several months. Active addresses had peaked near 978,000 on July 31, approximately 1.6 times the daily average for July. The first week of August averaged about 751,000 active addresses, surpassing July's daily average of roughly 610,000.

Much of this activity reflected users responding to the Coldcard vulnerability. Affected users rushed to transfer their Bitcoin from compromised devices to new addresses, generating significant on-chain movement. Daily exchange inflows averaged $1.55 billion during this period, down from $1.67 billion in July, with no corresponding buying activity on exchanges, suggesting users were consolidating and securing their holdings rather than trading.

How to Protect Your Bitcoin After a Hardware Wallet Vulnerability?

• Verify Firmware Updates: Check the manufacturer's official website for security patches and firmware updates. Coinkite released a patch and detailed entropy remediation disclosure to address the Coldcard vulnerability, allowing users to verify whether their devices were affected.
• Transfer Funds Immediately: If your hardware wallet is affected by a known vulnerability, move your Bitcoin to a new, uncompromised device or address as quickly as possible. Affected Coldcard users transferred their funds to new addresses to prevent further losses.
• Use Multiple Security Layers: Consider using multisignature wallets, which require multiple private keys to authorize transactions, or hardware wallets from different manufacturers to reduce the risk that a single vulnerability compromises all your holdings.
• Monitor Official Channels: Follow the official social media accounts and websites of your hardware wallet manufacturer to stay informed about security disclosures and patches before they become public knowledge.

Why Does This Matter for On-Chain Security?

The Coldcard incident reveals a critical vulnerability in the self-custody ecosystem. Hardware wallets are designed to be the most secure way for individuals to hold Bitcoin, isolating private keys from internet-connected devices. However, a firmware-level flaw can undermine that security entirely. The vulnerability was not a defect in the Bitcoin protocol itself, but rather in how Coldcard implemented the random number generation that creates private keys.

This distinction is important. Bitcoin's underlying cryptography remains secure. The problem was in the execution layer, where a single company's firmware update affected thousands of users simultaneously. The $116 million loss demonstrates that even well-regarded hardware wallet manufacturers can introduce critical flaws that persist until discovered and patched.

The incident also highlights the importance of responsible disclosure and rapid response. Coinkite released a patch and detailed remediation guidance, allowing users to assess their risk and take corrective action. However, the delay between when the vulnerability was introduced and when it was discovered meant that attackers had a window to exploit affected wallets before users could respond.

Bitcoin's network activity data shows that users are actively managing their security in response to threats. The surge in wallet creation and on-chain movement during early August reflects a healthy ecosystem where users take self-custody seriously and move quickly to protect their holdings when vulnerabilities emerge. However, the scale of the loss also underscores the need for continued vigilance, regular security audits of hardware wallet firmware, and user education about the importance of keeping devices updated.