Coldcard Firmware Flaw Leads to $89 Million Bitcoin Theft

A critical firmware vulnerability in Coldcard hardware wallets has resulted in the theft of approximately $89 million in Bitcoin, shattering the perceived immunity of air-gapped storage. The exploit allowed attackers to remotely reconstruct private keys by targeting the mathematical predictability of the devices' seed generation process.

In a series of coordinated waves, attackers drained funds from roughly 4,585 addresses. The most aggressive phase occurred on July 30, 2026, when 1,082.65 BTC—valued at approximately $70 million—was swept from 1,196 wallets in just 41 minutes. According to Clay Garrett of Block, the attacker utilized a paid account at a well-known blockchain data provider to query source addresses during these sweeps, enabling a rapid and systematic extraction of funds.

The Entropy Failure

The breach originated from a firmware build setting that inadvertently bypassed the device's hardware randomness generator. Instead of producing truly random seeds, the device fell back to a software substitute derived from the chip's serial number and clock registers. This created a predictable pattern that attackers could computationally enumerate. By guessing the possible seeds and matching them against the public blockchain, the attackers derived private keys without ever needing physical access to the hardware.

A Blow to Cold Storage

This event fundamentally challenges the industry's "cold storage" security model. Coldcard, produced by Coinkite, has long been regarded as a gold standard for security due to its air-gapped architecture, which is designed to keep private keys entirely offline. The exploit proves that physical isolation is irrelevant if the entropy used to create the keys is flawed. The vulnerability effectively turned a high-security vault into a predictable lock, rendering the air-gap useless.

Industry Implications

The fallout extends beyond the immediate financial loss. Because users cannot easily verify if their specific seed was generated using the compromised firmware, a significant number of holders may remain at risk without knowing it. This uncertainty undermines trust in hardware-based self-custody and highlights a systemic risk: the reliance on opaque firmware for the most critical stage of asset security. The industry now faces a reckoning regarding how to audit and verify the randomness of seed generation in "secure" hardware.