< Back to situations

Get alerts on this situation

We’ll email you as it develops, and you can follow the whole thread from day one.

Unsubscribe anytime.

[SITUATION] · [ACTIVE]

3 clusters · 71 sources · 3 days · First seen 3 days ago · Last updated about 17 hours ago

Categories: TECHNOLOGY

Coldcard flaw fuels $88M Bitcoin theft

Entities: Coldcard · Bitcoin · Galaxy Research · Coldcard hardware wallet · Coinkite

Overview

The March 2021 firmware update for Coldcard hardware wallets (Mk2‑Mk5 and Q) reduced seed‑phrase entropy, making private keys mathematically predictable. Galaxy Research traced three coordinated attack waves that have siphoned roughly 1,367 BTC (about $88‑$89 million) from 4,585 addresses. The first two waves drained about 1,160 BTC from 2,674 wallets using shared P2WPKH collector addresses. A third wave, observed in late July‑early August 2026, withdrew 207.73 BTC from 1,912 wallets, routing funds to individual P2WSH vaults and averaging 6.37 victim wallets per transaction.

Most of the stolen coins remain unspent, concentrated in a few attacker wallets, suggesting a hold‑before‑liquidation strategy. The breach triggered a surge in on‑chain activity, with sub‑1 BTC transfers spiking to roughly 39,600 BTC in a single day—the highest level since the FTX collapse. Victims, largely long‑term holders (average dormancy ≈ 3.2 years), are moving Bitcoin to centralized exchanges, creating the strongest retail inflow since February.

Researchers warn that any single‑signature Coldcard address generated after the March 2021 update remains vulnerable. Users are urged to stop creating new wallets on the flawed firmware, update to the patched version, generate fresh seeds, and relocate funds to secure addresses or reputable exchanges. The episode continues to fuel debate over self‑custody versus exchange storage and prompts calls for immediate hardware upgrades or replacement.

Claims

What the coverage asserts, and how well corroborated each claim is across sources.

[● 32 SOURCES] Approximately 594.48 BTC was transferred from about 500 single‑signature addresses within a three‑block window on July 30‑31 2026. (clm_b407d0c8-f0c0-4017-8d6e-8d9aedaf1b6a)
[● 32 SOURCES] Coldcard Mk4, Mk5 and Q models are not affected by the seed‑generation flaw. (manufacturer clarification)
[● 31 SOURCES] Around 562 BTC was later consolidated into a single address and has not moved since. (clm_762e7429-e182-426a-af8e-8c182691109d)
[● 29 SOURCES] Bitcoin’s price stayed near $62‑$64 k during the theft period. (market data)
[● 28 SOURCES] Coldcard Mk3 firmware versions 4.0.1‑5.0.3 have a seed‑generation vulnerability due to a software fallback RNG that reduced entropy. (Coinkite advisory and multiple technical analyses)
[● 26 SOURCES] The theft occurred on 30 July 2026. (Chronology of events.)
[● 24 SOURCES] Coinkite issued a security advisory warning users of the Coldcard vulnerability on July 30 2026. (Coinkite)
[● 24 SOURCES] Block independently identified the RNG issue in Coldcard devices. (Block)
[● 22 SOURCES] No definitive public evidence links the seed‑generation flaw to the sweep of 594 BTC. (Coinkite statement.)
[● 21 SOURCES] The theft is estimated at roughly $70 million based on the higher on‑chain valuation. (clm_74228284-bee2-47b0-8940-99843944c835)

Timeline

about 17 hours ago

[TECHNOLOGY] 26 sources
Coldcard Flaw Sparks $88 Million Bitcoin Theft from 4,585 Wallets
Coldcard’s March 2021 firmware flaw let attackers steal ~1,367 BTC (~$88 M) from 4,585 wallets in three waves; the funds stay unspent and users are urged to update firmware and relocate their Bitcoin.
2 days ago

[TECHNOLOGY] 6 sources
Bitcoin Sentiment Plummets After Coldcard Firmware Exploit
Santiment reports Bitcoin sentiment at record lows after a Coldcard firmware exploit drained $40 M, pushing the positive‑to‑negative comment ratio to 0.58 and Bitcoin price down about 1%.
3 days ago

[TECHNOLOGY] 56 sources
Coldcard Wallet Flaw Triggers $70‑$89 Million Bitcoin Theft Across Hundreds of Addresses
Coldcard Mk3 firmware flaw let attackers steal 1,082‑1,367 BTC ($70‑$89 M) in July 2026; Coinkite warned users, while Mk4‑Mk5‑Q remain safe. Bitcoin price stayed near $63 k and small investors rushed to exchang

Sources

abmedia.io · aktienkurs-orderbuch.finanznachrichten.de · altonivel.com.mx · ambcrypto.com · analyticsinsight.net · assodigitale.it · b2bnn.com · bitcoin-kurier.de · bitcoin.fr · bitcoinmagazine.com · bitcoinsistemi.com · blockchainreporter.net · blockonomi.com · blocktempo.com · blogtienao.com · borncity.com · borsaefinanza.it · btc-echo.de · calaboucodamorticiablog.wordpress.com · catania7.com · coin-turk.com · coinacademy.fr · coincu.com · coindeskjapan.com · coindoo.com · coinedition.com · coinkurier.de · coinpedia.org · cointelegraph.com · criptoinforme.com · criptotendencias.com · cryptoast.fr · cryptobreaking.com · cryptobriefing.com · cryptoevents.global · cryptonomist.ch · cryptopolitan.com · cryptoSlate.com · cyberinsider.com · decrypt.co · dev.to · en.bitcoinsistemi.com · en.coin-turk.com · falko-beitz.de · financiarul.ro · finbold.com · flagthis.com · forexlive.com

This summary has been updated 6 times: see revision history