Attackers Sweep 1,367 Bitcoin From Coldcard Wallets After Five-Year Firmware Flaw

TORONTO, 2 AUG 2026 — Attackers have drained 1,367 bitcoin, worth roughly $89 million, from 4,585 addresses belonging to owners of Coldcard hardware wallets, in three automated sweeps that began on 30 July, according to Galaxy Research figures reported by CoinDesk on 2 August.

The wallets were emptied because of a defect in firmware shipped by the Canadian manufacturer Coinkite in March 2021. For more than five years, the Coldcard generated the secret keys protecting users' funds with a predictable software routine rather than the hardware randomness source it was designed to use.

No password was stolen and no device was physically accessed. The keys were derived independently by whoever ran the sweeps.

Figures re-checked 2 August 2026 and still rising. Each is attributed and dated below.

Three waves since 30 July

The first sweep ran between 01:31 and 01:56 UTC on 30 July, taking 1,083 bitcoin from 1,196 addresses in 41 minutes. Two further waves followed over the next three days, lifting the total to 1,367 bitcoin from 4,585 addresses by 2 August.

Galaxy Research, which is mapping the movements on-chain, says the third wave behaves differently from the first two. It parks the proceeds in pay-to-witness-script-hash outputs instead of sending them straight to its own address, groups victims in a new way, and scanned only the default derivation path. It also went after smaller balances, which Galaxy reads as a sign that the more profitable part of the exposed key space had already been worked through.

Galaxy has said it believes each wave is internally the work of a single operator, but that the blockchain does not reveal whether the same party is behind all three. Attribution beyond that is not currently possible from public data.

What went wrong

A hardware wallet's security rests on the unpredictability of the recovery phrase it generates when first set up. Coldcard contains a dedicated hardware random number generator for that purpose.

Block's root-cause analysis, published on 30 July, found that a build-configuration error kept the hardware generator from ever being used for seed creation. A setting meant to disable the software fallback in the MicroPython runtime instead caused it to be compiled in, and a safety check designed to flag that configuration never fired. Key generation ran on a non-cryptographic routine whose starting state was fixed at boot from a handful of predictable values.

That collapsed the effective key space to a size small enough to search. Coinkite's preliminary estimates put Mk2 and Mk3 seeds at roughly 40 bits and the later Mk4, Mk5 and Q at roughly 72 bits, against a design target of 128. Block's independent figures are lower still for the older devices.

Because bitcoin addresses and balances are public, an attacker could test candidate keys offline, at no cost, without ever touching a victim's device or raising an alert. The first indication most owners had was an empty wallet.

The engineering detail — how a macro set to zero defeated six separate safeguards — is examined in our companion analysis, The Coldcard entropy failure was a build-configuration bug, not a cryptography bug.

Coinkite's response

Coinkite published a preliminary advisory for the Mk3 on 30 July and released fixed firmware across every affected product line between 31 July and 1 August.

Chief executive Rodolfo Novak, who goes by NVK, publicly accepted full accountability for the defect and acknowledged that the company's review process had failed to catch it. Coinkite separately raised the possibility that AI tooling surfaced the flaw, calling the episode a feature of a new paradigm. No evidence has been offered for how the bug was found, and security researchers point out that the underlying mistake is a known class of error that ordinary code review can catch. The sweeps themselves involved no AI — they were brute-force computation against public ledger data.

Who is affected

Exposure depends on the firmware that was running when a seed was created, not on the model of device or the firmware installed today. Updating the firmware protects seeds generated afterwards and does nothing for one already in use. A seed that has been exported into another wallet carries the same weakness with it.

Coinkite names two circumstances in which an existing seed is not considered at risk. Either at least 50 independent, private dice rolls were contributed during generation, or a strong, unique BIP-39 passphrase was in use, kept secret and stored separately from the seed backup. Whichever applies had to be true at the moment the seed was created; neither can be added afterwards. The company explicitly excludes passphrases that are short, common, patterned, quoted, reused, exposed or uncertain.

Multisignature arrangements assembled entirely from affected devices inherit the weakness in full, because every key in the quorum came from the same generator.

What is not yet known

Three things remain open. Whether the three waves are the work of one party or several cannot be determined from the chain, on Galaxy's own assessment. How the flaw was discovered has not been established, Coinkite's suggestion notwithstanding. And the totals are not final — the sweeps were continuing when this report was filed, and the affected key space extends to any seed created on vulnerable firmware, whether or not it currently holds a balance.

RECATOOLS will update this report as Galaxy Research and Coinkite publish revised figures.