Hackers have stolen over $112 million in Bitcoin from Coldcard wallets, raising concerns about self-custody security in the crypto space.
Hackers have successfully compromised Coldcard hardware wallets, stealing at least 1,778.84 BTC, valued at around $112.7 million. No new hacking incidents have been reported since August 6, according to Galaxy Research.
Details of the Coldcard Attack
Researchers have contacted 190 victims and confirmed that bitcoins were taken from over 8,600 addresses. The overall loss could exceed 2,417.35 BTC, equivalent to approximately $153 million, based on unverified reports.
The hacking spree reportedly began on July 30, 2026, with attackers exploiting a software vulnerability that allowed them to retrieve seed phrases from compromised Coldcard devices, leading to the unauthorized transfer of funds to their wallets.
The flaw stemmed from a 2021 firmware update by Coinkite, the manufacturer of Coldcard, which inadvertently affected the random number generator used for creating cryptographic keys. This led to a critical weakness, making it possible for attackers to replicate the private keys of the affected wallets.
End of the Hacking Wave
According to Galaxy, the last confirmed attack occurred on August 6. Although new reports from victims have surfaced, no additional hacking incidents have been verified. Researchers believe this may be due to users successfully moving their funds or the majority of accessible assets already being stolen.
Galaxy's findings indicate that at least 33 distinct activities were traced, suggesting the involvement of multiple attackers rather than a single hacker.
Stolen Funds Remain in Hacker Control
Of the stolen bitcoins, approximately 1,531 BTC are still held by the hackers, with only about 246 BTC moved post-theft. A significant portion of the transfers utilized CoinJoin, complicating efforts to trace the funds, while others were moved using the Peel Chain method, which is often associated with money laundering.
Some of the stolen bitcoins have appeared on centralized exchanges and cross-chain bridges. Galaxy has provided relevant addresses to exchanges, compliance firms, and law enforcement.
Implications for Self-Custody
This incident raises significant concerns about self-custody, particularly as the affected users had taken measures to secure their bitcoins in hardware wallets, traditionally viewed as safe. Following the attacks, there was a noticeable increase in small bitcoin transfers to exchanges, with over 22,000 BTC moving to centralized platforms shortly after.
Rise of Multi-Signature Wallets
Interestingly, the attack has prompted a heightened interest in multi-signature wallets, with no confirmed thefts reported from these types of addresses. Companies like Casa and Anchorwatch have reported a surge in new customers and bitcoin transfers to their multi-signature solutions.
Dhruv Bansal, co-founder of Unchained, emphasized that the issue lies not in custodial versus non-custodial solutions but in the presence of a single point of failure. Users are encouraged to diversify their security measures across multiple keys and systems.
AI's Involvement in the Attack
Concerns have been raised regarding the potential use of artificial intelligence by the attackers, with suggestions that some may have utilized AI models lacking robust cybersecurity measures. Meanwhile, Bitcoin Red Team researchers, who began reviewing the ecosystem for vulnerabilities post-attack, faced challenges in accessing powerful AI tools due to restrictions from major U.S. companies.
This incident highlights the growing accessibility of code exploitation techniques, not only for developers but also for malicious actors. In the first half of 2026, crypto projects reportedly lost about $1.1 billion to hacks, marking a record number of confirmed exploits during this period, according to Blockaid.
