Coldcard seed-generation flaw drains 1,816 BTC across four waves

What happened

Attackers have taken roughly 1,816 Bitcoin — close to $116 million — from more than 5,200 Coldcard hardware wallet addresses in four separate waves beginning 30 July 2026, according to reporting by Fortune on the Coinkite exploit.

Galaxy Research tracked the first wave: 1,082.65 BTC, about $70 million, moved out of 1,196 addresses inside 41 minutes on 30 July. Later waves added the remainder. Coinkite, which makes the Coldcard device, has told affected users to generate new seeds and move funds immediately, and says the attack is ongoing.

The flaw

The root cause is not a break in Bitcoin itself or in the hardware's secure element. Fortune's account traces it to a March 2021 firmware release that generated wallet seeds using a deterministic pseudorandom number generator rather than the device's hardware RNG. Deterministic means reproducible: given the same starting conditions, the same output. That turns a 12- or 24-word recovery phrase from something effectively unguessable into something an attacker can search for.

That explains the shape of the theft. A 41-minute sweep across 1,196 addresses is not phishing or social engineering, both of which scale slowly and require a victim to act. It is a list being worked through.

Why it matters

Hardware wallets are the standard answer to exchange and custodian risk — self-custody, keys never online. This incident is a reminder that self-custody moves the risk rather than removing it, from counterparty failure to firmware and supply-chain integrity. Anyone who generated a seed on a Coldcard in the affected window inherited the flaw at the moment of setup, and no amount of careful cold storage afterwards would have helped.

It also matters that the window is five years wide. Funds sitting untouched since 2021 have no natural prompt to be reviewed. Coinkite's remedy — new seed, new addresses, move the coins — only works for users who hear about it.

The figures above are as reported as of 4 August 2026 and the total may move while the sweeps continue.