A check in a supporting library tested only whether that setting existed, not whether it was enabled, so the bug went undetected for years . The result was that seed phrases — the master keys to a user's Bitcoin — were generated using a predictable software substitute seeded from non-secret chip data like the device serial number and clock registers . Instead of the intended 128 bits of entropy, affected devices produced seeds with roughly 72 bits, a keyspace small enough for an attacker to brute-force offline .

Affected Devices and Scale of Losses

Coinkite confirmed that the vulnerability affected a wide range of Coldcard models running specific firmware versions:

• Mk3 devices running firmware versions 4.0.1 through 5.0.3
• Mk4 and Mk5 devices before firmware 5.6.0
• Coldcard Q devices before firmware 1.5.0Q

Any seed generated on an affected device since March 2021 was potentially compromised .

The attacker struck in at least three waves beginning around July 30, 2026, draining funds from more than 4,500 addresses . One particularly aggressive wave saw 594 BTC stolen in just 25 minutes . Early estimates from Galaxy Research pegged losses at roughly $70 million, but as more compromised addresses were identified, later reports converged on ~$89 million to $116 million depending on the Bitcoin price at time of reporting .

No physical access, phishing, or malware was required — the attacker reconstructed private keys entirely from outside by predicting the weakened seed phrases .

Market Response: Whales vs. Retail Divergence

The Coldcard hack triggered a clear split in investor behavior, visible in on-chain data from Santiment.

Bitcoin whales — wallets holding between 10 and 10,000 BTC — added 19,610 BTC to their combined holdings between July 29 and early August, a 0.14% increase worth roughly $1.25 billion at prevailing prices . Other reports placed the accumulation at 19,696 to 19,700 BTC over an eight-day window ending in late July . This signaled "smart money" conviction that the selloff was an overreaction.

Smaller retail investors did the opposite. Wallets holding less than 0.01 BTC reduced their balances by 0.55% in the same period . Spot BTC trading volume fell 75% as retail dip-buying activity cooled . Panic-selling by smaller holders was described as reaching levels not seen since the FTX collapse in November 2022 .

Broader Self-Custody Scrutiny

The Coldcard hack did not occur in isolation. It landed against the backdrop of a grim first half of 2026 for crypto security:

• 207 crypto hacks occurred in H1 2026 — a record for any six-month period, more than double the 85 incidents in H1 2025 .
• Total losses reached ~$972 million, per TRM Labs and Immunefi reports — less than half the $2.3 billion lost in H1 2025, but the incident count surged dramatically .
• North Korea-linked groups were blamed for ~66% of stolen funds (~$643 million) .
• Smart contract exploits drove the surge in incident count, accounting for 125 of the 207 breaches (~60%) .
• Infrastructure and operational compromises made up only 15% of incidents but drove about 76% of total value stolen .

Because Coldcard was widely regarded as a gold standard for cold storage, the revelation that a silent firmware bug had compromised key generation for over five years without detection shattered confidence in hardware wallet safety. Security researchers and exchanges issued urgent warnings for all Coldcard users to rotate their seed phrases and migrate funds to new wallets . The incident reignited a critical debate: whether even air-gapped hardware wallets are sufficient when the supply-chain and firmware integrity chain can be broken by a single coding error.

A check in a supporting library tested only whether that setting existed, not whether it was enabled, so the bug went undetected for years . The result was that seed phrases — the master keys to a user's Bitcoin — were generated using a predictable software substitute seeded from non-secret chip data like the device serial number and clock registers . Instead of the intended 128 bits of entropy, affected devices produced seeds with roughly 72 bits, a keyspace small enough for an attacker to brute-force offline .

Affected Devices and Scale of Losses

Coinkite confirmed that the vulnerability affected a wide range of Coldcard models running specific firmware versions:

• Mk3 devices running firmware versions 4.0.1 through 5.0.3
• Mk4 and Mk5 devices before firmware 5.6.0
• Coldcard Q devices before firmware 1.5.0Q

Any seed generated on an affected device since March 2021 was potentially compromised .

The attacker struck in at least three waves beginning around July 30, 2026, draining funds from more than 4,500 addresses . One particularly aggressive wave saw 594 BTC stolen in just 25 minutes . Early estimates from Galaxy Research pegged losses at roughly $70 million, but as more compromised addresses were identified, later reports converged on ~$89 million to $116 million depending on the Bitcoin price at time of reporting .

No physical access, phishing, or malware was required — the attacker reconstructed private keys entirely from outside by predicting the weakened seed phrases .

Market Response: Whales vs. Retail Divergence

The Coldcard hack triggered a clear split in investor behavior, visible in on-chain data from Santiment.

Bitcoin whales — wallets holding between 10 and 10,000 BTC — added 19,610 BTC to their combined holdings between July 29 and early August, a 0.14% increase worth roughly $1.25 billion at prevailing prices . Other reports placed the accumulation at 19,696 to 19,700 BTC over an eight-day window ending in late July . This signaled "smart money" conviction that the selloff was an overreaction.

Smaller retail investors did the opposite. Wallets holding less than 0.01 BTC reduced their balances by 0.55% in the same period . Spot BTC trading volume fell 75% as retail dip-buying activity cooled . Panic-selling by smaller holders was described as reaching levels not seen since the FTX collapse in November 2022 .

Broader Self-Custody Scrutiny

The Coldcard hack did not occur in isolation. It landed against the backdrop of a grim first half of 2026 for crypto security:

• 207 crypto hacks occurred in H1 2026 — a record for any six-month period, more than double the 85 incidents in H1 2025 .
• Total losses reached ~$972 million, per TRM Labs and Immunefi reports — less than half the $2.3 billion lost in H1 2025, but the incident count surged dramatically .
• North Korea-linked groups were blamed for ~66% of stolen funds (~$643 million) .
• Smart contract exploits drove the surge in incident count, accounting for 125 of the 207 breaches (~60%) .
• Infrastructure and operational compromises made up only 15% of incidents but drove about 76% of total value stolen .

Because Coldcard was widely regarded as a gold standard for cold storage, the revelation that a silent firmware bug had compromised key generation for over five years without detection shattered confidence in hardware wallet safety. Security researchers and exchanges issued urgent warnings for all Coldcard users to rotate their seed phrases and migrate funds to new wallets . The incident reignited a critical debate: whether even air-gapped hardware wallets are sufficient when the supply-chain and firmware integrity chain can be broken by a single coding error.