A five-year-old bug in Coldcard hardware wallets allowed hackers to steal over $130 million from users who followed every security protocol correctly. The vulnerability, hidden in firmware version 4.0.0 since March 2021, bypassed the device's randomness chip when generating seed phrases, making them predictable rather than truly random. Since July 31, 2026, multiple groups of attackers have systematically drained affected wallets in coordinated sweeps.

What Exactly Went Wrong With Coldcard?

The Coldcard, made by Canadian company Coinkite, has been regarded for years as one of the safest ways to store Bitcoin offline. The device generates a seed phrase, a sequence of words that acts like a master password to access cryptocurrency. For five years, users who generated seeds on Coldcard devices in firmware version 4.0.0 unknowingly created predictable sequences instead of truly random ones.

The technical flaw is straightforward but devastating: the device was supposed to use a dedicated randomness chip to generate seeds, but instead used a software substitute whose output could be mathematically predicted. Once attackers discovered this vulnerability, they could recalculate the keys for any wallet created during that period. The distinction matters because a firmware update cannot fix seeds that were already generated with the flawed randomness. Anyone affected must create an entirely new seed and move all holdings to a new wallet.

The scale of the theft unfolded in waves. On July 31, approximately 594 Bitcoin (BTC), worth roughly $38 million at the time, left about 500 wallets within 25 minutes. By August 2, the total reached 1,367 BTC. A fourth sweep on August 3 took another 449 BTC. Security researchers estimate that at least a dozen different hacker groups are participating in the thefts, though it remains unclear whether they are coordinating or independently exploiting the same vulnerability.

Why Did Security-Conscious Users Become Targets?

What makes this breach particularly striking is who it affected. The victims were not careless or negligent. They were the careful ones: people who stored their seeds offline, stamped them into steel, never photographed them, and kept devices in safes and safety deposit boxes. One victim, Jonathan Goodman, described the frustration of losing $1.6 million despite doing everything right.

"Perhaps the hardest part about this is that I did everything right. I never shared my seed phrase with anybody. My devices never touched the internet. Everything was kept in multiple safes and safety deposit boxes. None of it mattered. All because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability," Goodman wrote on X.

Jonathan Goodman, Coldcard Wallet User

This vulnerability represents the most serious category of hardware wallet failure because the damage cannot be repaired after the fact. The randomness flaw affected multiple Coldcard models, including the Mk2, Mk3, Mk4, Mk5, and Q versions, depending on which firmware was running when users generated their seeds.

How Are Other Hardware Wallet Manufacturers Responding?

The Coldcard incident has forced the crypto custody industry to reconsider how users evaluate wallet safety. Manufacturers all advertise similar security features: secure elements, open-source code, air-gapped design (meaning the device never connects to the internet), PIN protection, and passphrase options. These specifications sit on practically every product sheet and compare about as usefully as horsepower figures on cars, according to security analysts.

What matters more than specifications is a manufacturer's track record when something goes wrong. Ledger, the French market leader, has the longest incident list in the hardware wallet sector, but notably, none of those incidents directly compromised the hardware itself. Past Ledger breaches involved customer data from online shops and malicious code in developer tools, not the wallets themselves. Tangem, which uses card-based technology instead of traditional devices with screens and cables, has maintained an unremarkable security record across more than one million cards shipped, with independent audits from Kudelski Security, Riscure, and Cure53 finding no vulnerabilities.

How to Protect Your Cryptocurrency After the Coldcard Breach

• Generate Seeds From Multiple Sources: Users can generate seed phrases using dice rolls, which several hardware wallets support, eliminating reliance on any single manufacturer's randomness implementation.
• Use Multisig Across Different Brands: A 2-of-3 multisig setup spanning two different manufacturers means a vendor-wide firmware defect no longer results in total loss, since an attacker would need to compromise both brands simultaneously.
• Monitor Your Wallets Quarterly: Check balances through a block explorer four times a year, review the manufacturer's firmware changelog, and verify where your backup is stored. This takes approximately 15 minutes per quarter and can catch unauthorized access early.

Coinkite has published corrected firmware and advised users to migrate to newly generated wallets. However, the company faces significant credibility damage given that the flaw went undetected for five years despite the Coldcard's reputation as a security-focused product.

What Does This Mean for Self-Custody as a Long-Term Strategy?

The Coldcard breach has reignited debate about whether self-custody, the practice of holding your own private keys rather than trusting an exchange or custodian, remains a viable long-term strategy for average users. Following the collapse of FTX exchange in 2022, many Bitcoin holders moved to self-custody specifically to avoid exchange failures. The Coldcard incident demonstrates that self-custody introduces different risks: users must trust that hardware manufacturers have implemented randomness correctly, that firmware updates are secure, and that no undiscovered vulnerabilities exist in devices they may have owned for years.

The breach has also spiked activity on the Bitcoin network. The number of transactions waiting for miner confirmation reached 89,031 on August 5, 2026, the highest level since February 2025, as affected users and cautious holders moved coins between wallets and to exchanges. The number of active addresses hit a three-month high of 712,000, and large holder transactions climbed to a five-month high of 61,800.

For users evaluating hardware wallet options, security researchers recommend searching for a manufacturer's name alongside terms like "incident," "breach," or "vulnerability." Zero results are not necessarily a good sign, as they often indicate poor documentation. What matters is the response: how quickly the disclosure came, whether it was complete, and whether an independent audit followed. Manufacturers who publicly dissect their own failures are generally the safer bet.