The Coldcard hardware wallet exploit that began on July 30, 2026, has created an unusual legal situation for victims: they can pursue recovery through two entirely separate channels, targeting either the attackers themselves or the device manufacturer Coinkite. More than 5,200 individuals have been affected, with losses climbing toward $116 million and approximately 1,816 Bitcoin (BTC) moved by threat actors.

What Exactly Happened to Coldcard Users?

The vulnerability originated in a March 2021 firmware update to Coldcard devices, which are marketed as the gold standard for secure Bitcoin self-custody. During a software library migration, two randomness functions with matching interfaces were confused: one drew on the device's genuine hardware random number generator, while the other was a weak software fallback intended for boards lacking suitable hardware.

The build process checked only whether the hardware path was present, not whether it was switched on. As a result, seed generation silently defaulted to the weaker, predictable generator. Rather than drawing on genuine entropy, affected devices produced seeds following a discoverable pattern. Once attackers identified that pattern, they could replicate it on ordinary computers, generate large numbers of candidate seeds, derive the corresponding addresses, and check them against the public blockchain. This allowed the attackers to extract private keys without ever touching a victim's device.

The theft unfolded in coordinated waves rather than a single event. The first sweep, in the early hours of Thursday, July 30, drained hundreds of single-signature wallets within minutes. Further waves followed over the succeeding days as the attacker or attackers worked through the pool of vulnerable addresses, shifting toward smaller balances and more complex transaction patterns as scrutiny intensified.

Why Is the Stolen Bitcoin Still Sitting Idle?

A substantial portion of the stolen Bitcoin has been consolidated into a small number of addresses that remain unspent. This inactivity is significant for recovery efforts. A decade ago, funds of this scale would typically have passed through a mixing service within hours. Today, with exchange compliance controls tightened and blockchain intelligence firms monitoring flows in close to real time, converting a nine-figure sum of stolen Bitcoin into usable value is a genuinely complex operational problem.

Time lags by the attackers where funds are parked for significant periods tend to assist both law enforcement and civil recovery efforts, provided victims act quickly. Analysts have already flagged hundreds of suspected attacker-controlled addresses to investigators and industry compliance teams, and further white-hat interventions of the kind seen in comparable incidents have already emerged to secure stolen assets arising from this fraud.

What Are the Two Legal Routes to Recovery?

• Blockchain Tracing and Asset Recovery: Victims can pursue traditional blockchain tracing targeting the bad actor or actors, which can proceed almost anywhere in the world. This route does not depend on identifying the attacker, although the information sought may also seek to uncover their identity and physical location. Experts and lawyers are watching the consolidation addresses closely, and any attempt to launder these funds or off-ramp them will likely result in rapid attempts to blacklist or freeze those assets at the point of entry, followed shortly thereafter by proprietary and freezing injunctions and information disclosure orders against exchanges, custodians, or payment processors that later receive the funds.
• Product Liability Against Coinkite: Affected users can consider a tandem approach and may have a claim against Coinkite itself, most likely framed in breach of contract, negligence, or product liability arising from a latent defect that undermined the fundamental security promise of the device. The claim would be that Coinkite failed in meeting its standard of care and contractual obligations to its customers by permitting such a defect to exist and remain undetected, with foreseeable consequences and losses to its users.
• Jurisdictional Advantages: As a Canadian-incorporated manufacturer, Coinkite would ordinarily need to be pursued in Canada to ensure the most efficient and direct recourse for claimants. However, Coinkite's terms contain arbitration clauses, which may be relied upon in an attempt to constrain victims' options. English courts have already demonstrated in Chechetkin v Payward Ltd & Ors that arbitration clauses in standard-form crypto exchange terms will not necessarily be upheld where doing so would offend public policy and undermine mandatory consumer protections. Similar lines of authority in Canada provide cause for hope should Coinkite seek to enforce its arbitration clauses.

How Does This Compare to Other Crypto Liability Cases?

A useful, if imperfect, comparator is the litigation Coinbase faced following its 2025 data breach. Multiple negligence and breach-of-contract claims were filed on behalf of affected customers, though many were ultimately diverted into arbitration under the exchange's terms of service. The Coldcard case differs from most crypto losses in ways that make it significant well beyond its size. The defect sat undetected in open-source, publicly auditable code for five years, raising difficult questions about what a manufacturer reasonably ought to have known.

The number of affected individuals, which is likely to grow as further waves are identified, creates the conditions for coordinated or group litigation. And because the failure originated in the product itself, rather than in user error or a third-party platform, it offers what may be the clearest test yet of a hardware wallet manufacturer's liability to its own customers.

Steps Affected Users Should Take Now

• Seek Legal Advice Immediately: Early legal advice on the applicable contractual and jurisdictional framework is essential to prospective claimants. Victims should understand their options before pursuing either recovery route and be aware of potential arbitration clauses that could limit their recourse.
• Document All Losses: Affected users should carefully document the amount of cryptocurrency lost, the date of the loss, and any communications with Coinkite or other relevant parties. This documentation will be critical for both civil litigation and asset recovery efforts.
• Monitor Blockchain Activity: Claimants and other interest holders are tracking movement in real time on the blockchain. Victims can work with investigators and legal representatives to monitor the consolidation addresses and any attempts to move or launder the stolen funds, which could trigger freezing injunctions and other legal remedies.
• Consider Group Litigation: Given the large number of affected individuals, victims may benefit from coordinated or group litigation efforts. Joining forces with other affected users can increase the leverage and resources available for pursuing claims against Coinkite.

The Coldcard exploit represents a watershed moment for hardware wallet manufacturer accountability. Unlike previous crypto losses rooted in user error or third-party platform failures, this incident stems directly from a product defect in a device marketed as the gold standard for secure self-custody. The combination of a five-year-old undetected vulnerability, over 5,200 affected individuals, and substantial consolidated stolen assets creates conditions for meaningful legal precedent around manufacturer liability in the crypto custody space.