A flaw buried in Coldcard hardware wallet firmware for over five years exposed thousands of users to theft, resulting in approximately $116 million in losses during July 2026. The incident reveals a critical vulnerability in the infrastructure layer meant to protect self-custody, showing that securing a private key alone no longer guarantees the safety of digital assets.

What Happened to Coldcard Users?

In late July 2026, attackers drained roughly 1,816 Bitcoin (BTC), worth about $116 million, from more than 5,200 Coldcard addresses across four suspected waves beginning July 30. The root cause was not a stolen device or a guessed PIN. Instead, Coinkite, the Canadian manufacturer of Coldcard, disclosed that affected firmware versions relied on a predictable software random-number generator instead of the hardware-based source designed to create wallet seeds securely.

The vulnerability affected firmware versions 4.0.1 through 4.1.9 on Coldcard Mk2 and Mk3 devices, a window stretching back to March 2021. This means the flaw sat undetected for more than five years before disclosure. The technical damage was severe: seeds generated on vulnerable Mk2 and Mk3 devices carried only about 40 bits of effective entropy instead of the promised 128 bits, according to Coinkite's advisory. A properly randomized 128-bit seed is effectively unbreakable by brute force; at 40 bits, the field of possibilities shrinks to around one trillion combinations, searchable by specialized computing systems once attackers understood how the seed-generation process worked.

Why Did Some Users Escape the Attack?

Not every Coldcard user was exposed. The key difference came down to a manual security step that many users skipped. Bobby Gray, founder of TEXITcoin, explained the divide between victims and those who remained safe.

"Coldcard sat on a broken seed generator for five years, and it still cost people $116 million. Some of these wallets were generating seeds with as little as 40 bits of entropy instead of the 128 they promised," Gray said, adding that "the people who bothered adding their own dice rolls for extra entropy walked away untouched, while the people who just trusted the device to handle it got wiped out."

Bobby Gray, Founder of TEXITcoin

Coinkite's advisory confirms this protection: users who entered at least 50 fair, private, independent dice rolls during setup are not considered at risk from the flaw alone. Between 50 and 98 rolls add at least 128 bits of entropy, while 99 or more rolls add roughly 256 bits. This detail highlights an uncomfortable truth in crypto security: the devices marketed as the easiest path to self-custody still required users to understand and implement additional manual safeguards to achieve the promised protection level.

How Does This Expose Broader Wallet Security Risks?

The Coldcard incident illustrates a fundamental shift in how crypto security works. A modern crypto transfer now depends on multiple interconnected layers: a hardware wallet, its firmware, wallet software, a frontend interface, smart contracts, bridges, oracles, RPC providers (remote procedure call services that connect users to blockchain networks), and third-party code libraries. Each additional link is another potential point of compromise, which means protecting a private key alone no longer guarantees the safety of the entire transaction chain.

July 2026 saw $247 million stolen from crypto users, making it the second-worst month on record for theft that year, according to data highlighted by Cryptorank. The bulk of that damage traces back to the single Coldcard flaw, demonstrating how infrastructure built specifically to improve security can itself become a systemic point of failure affecting thousands of unrelated users simultaneously, even though none of them made an individual mistake.

How to Protect Yourself Against Hardware Wallet Vulnerabilities

• Add Manual Entropy: If using a hardware wallet, add your own independent randomness during seed creation, such as dice rolls or coin flips, to ensure the device does not rely solely on its internal random-number generator.
• Monitor Firmware Updates: Regularly check for and install firmware updates from your hardware wallet manufacturer, and review security advisories to understand what vulnerabilities may have affected your device model and firmware version.
• Migrate Vulnerable Seeds: If your hardware wallet was affected by a known vulnerability at the seed-generation stage, plan a complete wallet migration to a new device with patched firmware, as the flaw exists at the moment of seed creation, not in ongoing operations.
• Diversify Custody Methods: Consider splitting assets across multiple custody approaches rather than relying on a single hardware wallet model, reducing the impact of any single infrastructure failure.

Are AI-Powered Attacks Making This Worse?

While hardware vulnerabilities expose users to direct theft, attackers are simultaneously escalating social engineering tactics using artificial intelligence. North Korean-linked hacking group UNC1069 has reportedly used Google's Gemini AI model for crypto-focused reconnaissance, researching wallet data, generating social-engineering material, and attempting to develop code aimed at stealing digital assets. The group has also deployed deepfake images and videos impersonating known figures in the crypto industry to trick targets into installing malicious software.

AI does not necessarily create entirely new categories of vulnerability. What it does is make phishing, reconnaissance, impersonation, and malware development significantly easier to scale, turning what used to require a skilled team into something a smaller group can automate. That adds another layer of risk on top of an already complex security stack, at exactly the moment when hardware-level flaws like Coldcard's are showing how much damage a single weak link can cause. A patched firmware bug does not protect against a convincing deepfake video, and better phishing awareness does not fix a broken random-number generator.

What Does This Mean for the Future of Self-Custody?

The Coldcard incident reflects what Bobby Gray described as "a failure of trust rather than a failure of Bitcoin itself." The underlying Bitcoin protocol remains secure; the vulnerability existed in a third-party device designed to make self-custody easier. This distinction matters because it shows that the path to safer self-custody is not simply buying the right hardware, but understanding the full stack of dependencies and maintaining active oversight of firmware updates, security advisories, and manual safeguards.

For institutional and retail users alike, the July 2026 theft data underscore a broader shift in crypto infrastructure. While security incidents dominate headlines, capital is quietly flowing toward tokenized real-world assets, with tokenized US Treasuries reaching $15.3 billion in supply. This structural shift suggests that some users may be moving away from self-custody of volatile assets toward on-chain instruments that offer yield and regulatory clarity, even as hardware wallet manufacturers work to rebuild confidence in their security models.