Vulnerability Cause: A Build Flag That Broke Randomness

The root cause was a firmware integration error introduced in a March 2021 Coldcard update. Affected versions — particularly Coldcard Mk2 and Mk3 running firmware 4.0.0 through 5.0.3 — bypassed the device's dedicated hardware random number generator (RNG) during wallet seed creation . Instead of the intended 128 bits of entropy, the firmware routed seed generation through a software pseudo-random number generator that produced seeds with as little as 40 bits of entropy, reducing the possible seed space to roughly 4 billion values .

This made seeds remotely predictable and brute-forceable from public data like device serial numbers and clock readings, requiring no physical access to the wallet . Users who rolled their own dice during setup (bypassing the device-generated seed) were not affected .

Attack Timeline: Four Waves in Five Days

• March 2021 — The faulty firmware code was introduced in a Coldcard update.
• July 30, 2026, 01:10–01:51 UTC — The first major sweep: 1,082.65 BTC (worth ~$70 million at the time) drained from 1,196 addresses in just 41 minutes . The attack began nearly 30 hours before Coinkite issued a public warning .
• July 30, 2026 evening (ET) — A second 25-minute sweep drained approximately 594 BTC (~$38 million) from roughly 500 wallets .
• Late July through August 3, 2026 — At least two more coordinated waves unfolded, with Galaxy Research tracking three confirmed waves and 14 smaller incidents .
• July 31, 2026 — Coinkite shipped emergency firmware patches across all affected models and release tracks .
• August 1–4, 2026 — Public warnings escalated as the attacker continued draining wallets. Galaxy Research revised loss estimates upward repeatedly .
• August 7–12, 2026 — On-chain fallout data emerged, showing large-scale holder migration and record wallet creation .

Total Amount Stolen

Estimates varied across the unfolding incident, but the most comprehensive figure comes from TRM Labs and Galaxy Research: approximately 1,816 BTC (~$116 million) stolen from over 5,200 addresses across four attack waves . Earlier reports cited lower totals (1,367 BTC from 4,585 addresses, or $89 million) as the investigation was still incomplete . Some sources estimated total losses could ultimately reach 2,055 BTC ($130 million) if a suspected fourth wave was fully verified .

The $15 Billion Migration: 233,000 BTC Leaves Long-Term Wallets

In the days following the breach, on-chain analytics firms recorded a massive flight to safety:

• Checkonchain data showed 233,000 BTC left long-term holder wallets, valued at roughly $15 billion .
• Glassnode reported approximately 210,000 BTC (~$13.69 billion) exiting wallets that had been dormant for 155+ days — the most significant weekly drop in Bitcoin held for an extended period since December 2024 .

The migration reflected both Coldcard users moving funds to new wallets and a broader panic as long-term holders — including Ledger and Trezor users, according to Casa CEO Nick Neuman — shifted coins to different custody arrangements .

Record Wallet Creation: 2.27 Million New Wallets in a Week

In the week ending approximately August 8, 2026, Bitcoin set a 2026 high for on-chain activity:

• 2.27 million new wallets were created.
• 751,000 active wallets were recorded.

This spike was directly driven by holders racing to move funds off Coldcard devices and generate entirely new wallets on different hardware .

The Self-Custody Debate

The exploit triggered intense debate about the security assumptions of hardware wallets and self-custody:

• Casa CEO Nick Neuman reported that some customers, citing the Coldcard breach, were reconsidering self-custody entirely and moving to qualified custodians .
• Security experts noted that even

Vulnerability Cause: A Build Flag That Broke Randomness

The root cause was a firmware integration error introduced in a March 2021 Coldcard update. Affected versions — particularly Coldcard Mk2 and Mk3 running firmware 4.0.0 through 5.0.3 — bypassed the device's dedicated hardware random number generator (RNG) during wallet seed creation . Instead of the intended 128 bits of entropy, the firmware routed seed generation through a software pseudo-random number generator that produced seeds with as little as 40 bits of entropy, reducing the possible seed space to roughly 4 billion values .

This made seeds remotely predictable and brute-forceable from public data like device serial numbers and clock readings, requiring no physical access to the wallet . Users who rolled their own dice during setup (bypassing the device-generated seed) were not affected .

Attack Timeline: Four Waves in Five Days

• March 2021 — The faulty firmware code was introduced in a Coldcard update.
• July 30, 2026, 01:10–01:51 UTC — The first major sweep: 1,082.65 BTC (worth ~$70 million at the time) drained from 1,196 addresses in just 41 minutes . The attack began nearly 30 hours before Coinkite issued a public warning .
• July 30, 2026 evening (ET) — A second 25-minute sweep drained approximately 594 BTC (~$38 million) from roughly 500 wallets .
• Late July through August 3, 2026 — At least two more coordinated waves unfolded, with Galaxy Research tracking three confirmed waves and 14 smaller incidents .
• July 31, 2026 — Coinkite shipped emergency firmware patches across all affected models and release tracks .
• August 1–4, 2026 — Public warnings escalated as the attacker continued draining wallets. Galaxy Research revised loss estimates upward repeatedly .
• August 7–12, 2026 — On-chain fallout data emerged, showing large-scale holder migration and record wallet creation .

Total Amount Stolen

Estimates varied across the unfolding incident, but the most comprehensive figure comes from TRM Labs and Galaxy Research: approximately 1,816 BTC (~$116 million) stolen from over 5,200 addresses across four attack waves . Earlier reports cited lower totals (1,367 BTC from 4,585 addresses, or $89 million) as the investigation was still incomplete . Some sources estimated total losses could ultimately reach 2,055 BTC ($130 million) if a suspected fourth wave was fully verified .

The $15 Billion Migration: 233,000 BTC Leaves Long-Term Wallets

In the days following the breach, on-chain analytics firms recorded a massive flight to safety:

• Checkonchain data showed 233,000 BTC left long-term holder wallets, valued at roughly $15 billion .
• Glassnode reported approximately 210,000 BTC (~$13.69 billion) exiting wallets that had been dormant for 155+ days — the most significant weekly drop in Bitcoin held for an extended period since December 2024 .

The migration reflected both Coldcard users moving funds to new wallets and a broader panic as long-term holders — including Ledger and Trezor users, according to Casa CEO Nick Neuman — shifted coins to different custody arrangements .

Record Wallet Creation: 2.27 Million New Wallets in a Week

In the week ending approximately August 8, 2026, Bitcoin set a 2026 high for on-chain activity:

• 2.27 million new wallets were created.
• 751,000 active wallets were recorded.

This spike was directly driven by holders racing to move funds off Coldcard devices and generate entirely new wallets on different hardware .

The Self-Custody Debate

The exploit triggered intense debate about the security assumptions of hardware wallets and self-custody:

• Casa CEO Nick Neuman reported that some customers, citing the Coldcard breach, were reconsidering self-custody entirely and moving to qualified custodians .
• Security experts noted that even