Coldcard Wallet Owners Lose $38 Million in Bitcoin Theft

On July 31, around 500 users of Coldcard hardware wallets experienced a significant security breach, resulting in the theft of 594.48 BTC, valued at approximately $38.2 million. The incident was reported by analysts from Lookonchain.

— Lookonchain (@lookonchain) July 31, 2026

The theft was executed in less than 30 minutes, with all stolen assets being transferred to a single wallet address, which has not been accessed since. Each affected wallet contained a single signature and held over 0.15 BTC, with many being dormant for years, dating from 2021 to 2026.

Coinkite, the manufacturer of Coldcard, indicated on its blog that the theft was linked to vulnerabilities in the wallet's firmware. However, they did not explicitly confirm that user accounts were compromised.

The vulnerability impacts all Mk3 firmware versions starting from 4.0.1 and affects seed phrases generated on Mk4 and Mk5 devices prior to version 5.6.0, as well as on Q devices before version 1.5.0Q.

In light of this incident, the Coldcard team is urging wallet owners to update their firmware immediately and is currently investigating the breach.

This incident follows a previous security breach in December 2025, when the Trust Wallet browser extension was hacked, leading to the loss of $7 million for hundreds of users.