Coldcard Firmware Flaw Leads to $89 Million Bitcoin Theft

A critical firmware vulnerability in Coldcard hardware wallets has resulted in the theft of approximately $89 million in Bitcoin, shattering the perceived invulnerability of one of the industry's most secure air-gapped storage solutions. The exploit, which began around July 30, 2026, led to the loss of 1,367 BTC across 4,585 distinct addresses.

According to analysis from ZeroLatch, the theft was executed in three distinct waves. The breach was made possible by a build header bug—specifically `MICROPY_HW_ENABLE_RNG (0)`—which disabled the device's hardware True Random Number Generator (TRNG) peripherals. This failure forced the wallets to fall back on a predictable software pseudo-random number generator (PRNG) known as 'Yasmarang.' ZeroLatch noted that this catastrophic loss was enabled by the offline brute-forcing of weak seed phrase derivation paths, allowing attackers to precompute private keys without ever needing physical access to the devices.

The Context of Cold Storage

Coldcard has long been positioned as a gold standard for Bitcoin users prioritizing absolute self-custody due to its air-gapped design, which keeps the device entirely disconnected from the internet. By targeting the very mechanism used to generate the seed phrase—the foundation of wallet security—attackers bypassed the physical security layers that typically protect cold storage. The vulnerability turned a hardware-based security guarantee into software-based predictability, rendering the air-gap irrelevant.

Systemic Implications

This incident undermines the belief in the absolute security of self-custody, demonstrating that firmware and supply chain flaws can create systemic risks for even the most cautious investors. The breach highlights a critical dependency: the security of a private key is only as strong as the randomness used to create it. Industry analysts suggest this may trigger a shift in investor behavior, potentially driving users away from individual hardware management and toward regulated custody solutions or Bitcoin ETFs, which offload the technical burden of key management to institutional providers.

Secondary Attacks and Next Steps

In the wake of the firmware flaw, a predatory phishing campaign emerged to exploit panicked users. According to gBlock, attackers sent fake 'Hardware Audit' emails that tricked victims into installing ConnectWise ScreenConnect, a remote access tool, on their computers. This secondary attack vector sought to gain direct access to user systems while they were already vulnerable and searching for solutions to the RNG exploit. While the technical cause of the initial drain is confirmed, users are urged to verify their firmware versions and remain vigilant against unsolicited security audits.