Over $70 million in Bitcoin was stolen from Coldcard wallets due to a firmware flaw, raising serious security concerns.
In a significant security breach, over 1,000 bitcoins, worth around $70 million, were stolen from 1,196 Coldcard wallets on July 30. This incident, which occurred within just 41 minutes, has revealed a critical flaw in the wallet's firmware.
According to Galaxy Research, the theft involved 1,082.65 BTC and took place between 01:10 and 01:51 UTC, suggesting that the transactions were processed in batches. The stolen bitcoins are currently held in four inactive addresses, a number that was revised from earlier reports that identified only one address.
While this breach is not the largest of the year, the method of attack raises significant concerns. Unlike typical crypto thefts, which often involve compromising systems to access private keys, this incident exploited a vulnerability in the Coldcard wallets that allowed for predictable seed phrase generation.
Concerns Over Coldcard Wallet Security
Coldcard devices are designed to keep private keys offline, which theoretically enhances security. However, a flaw in the firmware led to a reliance on a basic software alternative for seed phrase generation, utilizing the device's serial number and clock data instead of a high-quality randomness generator. This resulted in a limited range of potential keys, making them susceptible to brute-force attacks.
Older models, particularly the Mk2 and Mk3, were found to be especially at risk, while newer models like Mk4, Q, and Mk5 still produced a manageable number of potential keys for attackers. Galaxy's analysis indicated that most affected wallets were using the SegWit address format, hinting at a systematic and deliberate attack approach.
Galaxy Research has warned that further attacks could occur if users do not secure their funds promptly.
Potential for Ongoing Attacks
Coinkite, the manufacturer of Coldcard, has alerted users of the Mk3 devices, stating that newer models are not impacted. However, there are concerns that Mk2, Mk4, Q, and Mk5 models may also be vulnerable. Users are advised to treat their wallets as compromised until this issue is resolved.
Interestingly, the attacker made a significant error by using a paid service from a well-known blockchain data provider to monitor source addresses during the theft. This has allowed investigators to link the attacker's actions precisely, including the timing and number of requests made.
1/ During our investigation of the Coldcard drain yesterday, we identified an unusual pattern in the sweeps. That pattern led us to a hypothesis that has since been confirmed: the operator used a paid account at a well-known blockchain-services provider to query the source… https://t.co/l5McyhhcNn
— Clay Garrett (@clay_garrett) July 31, 2026
This provider has not flagged the unusual nature of the requests, and Block has shared this information with law enforcement authorities.
As cold storage solutions are presumed to provide unguessable keys, this incident highlights that physical security alone may no longer guarantee safety. Research has also pointed out vulnerabilities in post-quantum algorithms, indicating that security measures can quickly become inadequate.
In conclusion, safeguarding private keys has become increasingly complex, necessitating heightened vigilance among cryptocurrency users.
