The attacker did not need physical access, phishing emails, or malware. By reverse-engineering the weakened entropy output, they could reconstruct victims' 12- or 24-word seed phrases remotely and drain wallets that had never been connected to the internet .

Coldcard CEO Rodolfo Novak confirmed the issue on July 30, 2026, and suggested that the vulnerability may have been discovered using AI tools capable of scanning open-source firmware for entropy weaknesses at scale .

Scale & Timeline of Theft

The attack unfolded in multiple coordinated waves:

• July 30 — First wave: In a 25-minute sweep starting around 21:56 ET, the attacker drained roughly 594 BTC (~$38M) from approximately 500 wallets, targeting the largest balances first . Chainalysis found that $30 million was stolen in the first 10 minutes alone .
• July 31 – August 4 — Second and third waves: Additional sweeps pushed losses to 1,596 BTC (~$100M+) across roughly 7,300 addresses .
• Suspected fourth wave: Galaxy Research flagged a possible fourth wave that, if confirmed, would bring the total to 2,055 BTC (~$130M) .

By early August, TRM Labs classified the Coldcard incident as the third-largest crypto hack of 2026 . Galaxy Research identified at least 15 separate attackers now racing to exploit any unmigrated vulnerable wallets .

August 7 Fund Movement: 30.185 BTC ($1.94M)

On August 7, 2026, a wallet linked to the Coldcard hacker transferred 30.185 BTC (~$1.94M) to a newly created address, according to on-chain tracker Lookonchain . This was the first movement of stolen funds since the initial exploits began.

• The transfer represented roughly 1.5% of the total 2,055 BTC loot .
• Analysts interpreted it as a potential test transaction or preliminary step toward a larger cash-out .
• Bitcoin price barely reacted, trading near $64,152 at the time .

90% of Stolen Funds Remain Unmoved

After the August 7 transfer, approximately 98.5% of the stolen ~2,055 BTC remains untouched in the hacker's wallets . This pattern is consistent with sophisticated attackers who wait for months or years before attempting to launder large sums. Blockchain forensic firms and exchanges are tracking the addresses closely .

Coinkite's Response & Firmware Update

Coinkite moved quickly after discovering the vulnerability on July 30:

• July 30 — Issued an urgent security advisory publicly disclosing the bug .
• July 31 — Shipped emergency patched firmware for every affected model and release track :

Critical warning: Installing the patched firmware does not repair an already-compromised seed. Coinkite told all affected users to generate a new seed on patched firmware and move their coins immediately . The company also destroyed remaining inventory manufactured with vulnerable firmware and halted shipments .

Affected Firmware Versions

• Highest risk: Mk3 firmware 4.0.1 through 4.1.9, seeds generated without at least 50 independent dice rolls or a strong, unique BIP-39 passphrase
• Also affected: Mk4, Mk5, and Q models before the fixed firmware versions listed above
• Not affected: Seeds generated before the vulnerable firmware window; seeds using 50+ dice rolls; seeds protected by a unique BIP-39 passphrase; TAPSIGNER, OPENDIME, and SATSCARD devices (different codebases); and multisig setups with at least one non-vulnerable key

Implications for Self-Custody & the Crypto Community

• Hardware wallets are not bulletproof. The Coldcard incident shattered the assumption that offline wallets are immune to remote seed theft . The flaw lived undetected in firmware for over five years.
• Seeds generated on vulnerable firmware are permanently compromised. Even after installing the fix, old seeds remain guessable . Users must create entirely new wallets and migrate funds.
• Wider market fear. Glassnode reported that approximately 210,000 BTC was moved from long-term holder wallets (dormant for 155+ days) in the week following the hack — the largest such shift since 2024 — suggesting broad loss of confidence among self-custody Bitcoin holders .
• AI-driven auditing is accelerating. Security researchers noted that the attack was likely aided by AI tools that can scan open-source firmware for entropy weaknesses at scale, a capability now rapidly being adopted across all hardware wallet projects .
• "I did everything right" is no longer enough. Many victims followed best self-custody practices and still lost everything, underscoring that firmware integrity is the new frontier of hardware wallet risk .

The attacker did not need physical access, phishing emails, or malware. By reverse-engineering the weakened entropy output, they could reconstruct victims' 12- or 24-word seed phrases remotely and drain wallets that had never been connected to the internet .

Coldcard CEO Rodolfo Novak confirmed the issue on July 30, 2026, and suggested that the vulnerability may have been discovered using AI tools capable of scanning open-source firmware for entropy weaknesses at scale .

Scale & Timeline of Theft

The attack unfolded in multiple coordinated waves:

• July 30 — First wave: In a 25-minute sweep starting around 21:56 ET, the attacker drained roughly 594 BTC (~$38M) from approximately 500 wallets, targeting the largest balances first . Chainalysis found that $30 million was stolen in the first 10 minutes alone .
• July 31 – August 4 — Second and third waves: Additional sweeps pushed losses to 1,596 BTC (~$100M+) across roughly 7,300 addresses .
• Suspected fourth wave: Galaxy Research flagged a possible fourth wave that, if confirmed, would bring the total to 2,055 BTC (~$130M) .

By early August, TRM Labs classified the Coldcard incident as the third-largest crypto hack of 2026 . Galaxy Research identified at least 15 separate attackers now racing to exploit any unmigrated vulnerable wallets .

August 7 Fund Movement: 30.185 BTC ($1.94M)

On August 7, 2026, a wallet linked to the Coldcard hacker transferred 30.185 BTC (~$1.94M) to a newly created address, according to on-chain tracker Lookonchain . This was the first movement of stolen funds since the initial exploits began.

• The transfer represented roughly 1.5% of the total 2,055 BTC loot .
• Analysts interpreted it as a potential test transaction or preliminary step toward a larger cash-out .
• Bitcoin price barely reacted, trading near $64,152 at the time .

90% of Stolen Funds Remain Unmoved

After the August 7 transfer, approximately 98.5% of the stolen ~2,055 BTC remains untouched in the hacker's wallets . This pattern is consistent with sophisticated attackers who wait for months or years before attempting to launder large sums. Blockchain forensic firms and exchanges are tracking the addresses closely .

Coinkite's Response & Firmware Update

Coinkite moved quickly after discovering the vulnerability on July 30:

• July 30 — Issued an urgent security advisory publicly disclosing the bug .
• July 31 — Shipped emergency patched firmware for every affected model and release track :

Critical warning: Installing the patched firmware does not repair an already-compromised seed. Coinkite told all affected users to generate a new seed on patched firmware and move their coins immediately . The company also destroyed remaining inventory manufactured with vulnerable firmware and halted shipments .

Affected Firmware Versions

• Highest risk: Mk3 firmware 4.0.1 through 4.1.9, seeds generated without at least 50 independent dice rolls or a strong, unique BIP-39 passphrase
• Also affected: Mk4, Mk5, and Q models before the fixed firmware versions listed above
• Not affected: Seeds generated before the vulnerable firmware window; seeds using 50+ dice rolls; seeds protected by a unique BIP-39 passphrase; TAPSIGNER, OPENDIME, and SATSCARD devices (different codebases); and multisig setups with at least one non-vulnerable key

Implications for Self-Custody & the Crypto Community

• Hardware wallets are not bulletproof. The Coldcard incident shattered the assumption that offline wallets are immune to remote seed theft . The flaw lived undetected in firmware for over five years.
• Seeds generated on vulnerable firmware are permanently compromised. Even after installing the fix, old seeds remain guessable . Users must create entirely new wallets and migrate funds.
• Wider market fear. Glassnode reported that approximately 210,000 BTC was moved from long-term holder wallets (dormant for 155+ days) in the week following the hack — the largest such shift since 2024 — suggesting broad loss of confidence among self-custody Bitcoin holders .
• AI-driven auditing is accelerating. Security researchers noted that the attack was likely aided by AI tools that can scan open-source firmware for entropy weaknesses at scale, a capability now rapidly being adopted across all hardware wallet projects .
• "I did everything right" is no longer enough. Many victims followed best self-custody practices and still lost everything, underscoring that firmware integrity is the new frontier of hardware wallet risk .

• Mk3: version 4.2.0 or later
• Mk4/Mk5 standard: version 5.6.0 or later
• Q standard: version 1.5.0Q or later
• Mk4/Mk5 Edge: version 6.6.0X or later
• Q Edge: version 6.6.0QX or later

• Mk3: version 4.2.0 or later
• Mk4/Mk5 standard: version 5.6.0 or later
• Q standard: version 1.5.0Q or later
• Mk4/Mk5 Edge: version 6.6.0X or later
• Q Edge: version 6.6.0QX or later