Firmware Flaw Leads to $70 Million Bitcoin Theft from Coldcard Wallets
A critical entropy vulnerability allowed attackers to reconstruct private keys and drain funds from air-gapped hardware devices.
A catastrophic firmware failure in Coinkite's Coldcard hardware wallets led to the theft of approximately 1,082.65 BTC, valued at roughly $70 million, on July 30, 2026. The coordinated attack drained 1,196 wallets in a narrow 41-minute window between 01:10 and 01:51 UTC.
The theft was executed without the attackers gaining physical access to the devices. The vulnerability stemmed from a firmware build setting that bypassed the hardware randomness generator. Instead of true entropy, the devices fell back to a software substitute based on the chip's serial number and clock registers, making the resulting private keys computationally enumerable. Investigators found that the attacker utilized a paid account at a prominent blockchain data provider to query source addresses, which helped map the target wallets before sweeping the funds.
The Failure of Air-Gapping
Coldcard devices are marketed as high-security, "air-gapped" solutions designed to keep private keys entirely offline. The fundamental security premise of these devices is that the seed phrase is generated with such high entropy that guessing the key is mathematically impossible. In this instance, that promise failed. Because the keys became predictable due to the software bug, the physical isolation of the devices—whether stored in a safe or kept offline—provided no protection against the reconstruction of the keys.
Industry Implications
This incident undermines the perceived absolute security of hardware wallets and highlights a systemic risk where a single line of flawed code can compromise thousands of users simultaneously. The attack specifically targeted single-signature wallets; however, those using BIP-39 passphrases or seeds generated from physical dice rolls are considered safe from this specific flaw. This suggests that the generation process itself has become a primary point of failure.
What's Next
The breach serves as a stark warning for the industry, suggesting a necessary shift toward multi-signature custody for high-value assets to mitigate the risk of single-point firmware failures. Users of affected Coldcard models are urged to migrate their funds to new wallets generated with verified entropy. Investigators continue to track the movement of the stolen BTC, though the speed of the 41-minute sweep suggests a highly automated and sophisticated operation.