ByDOR OFFIR

AUGUST 3, 2026 16:05

The Bitcoin community faces one of the largest security incidents in the cold-wallet space. Across multiple attack waves, more than 1,367 Bitcoins valued near 88 million dollars were taken from 4,585 addresses tied to Coldcard hardware wallets made by Canadian firm Coinkite.

The event did not involve any compromise of the Bitcoin network. Instead, it arose from a flaw inside the wallet software that produced private keys with insufficient randomness. Code meant to generate nearly impossible-to-guess secrets sometimes created predictable ones that could be rebuilt through computation and automated checks.

Losses keep growing, and research groups caution that users who set up wallets with affected versions remain at risk even if their holdings have not been taken yet.

Hundreds of wallets drained in roughly 25 minutes

The opening attack wave moved with speed and precision. In about 25 minutes, hundreds of Bitcoins left separate wallets, and the transfers packed into a limited set of network blocks. The intruder had likely scanned vulnerable addresses in advance, derived the matching keys, and launched an automated drain.

Early on, most stolen coins gathered in a handful of addresses that blockchain analysts could follow with relative ease. Later stages showed a shift in tactics.

During the third wave, roughly 208 more Bitcoins left 1,912 addresses, though the average amount taken per victim dropped sharply. Galaxy Research noted this pattern may show the attacker had already cleared larger holdings and was now sweeping for any remaining balances, even small fractions of a Bitcoin.

Software flaw that left cold wallets open to attack

Understanding the issue requires knowing how Bitcoin wallets are created. Setting up a new wallet produces a seed phrase backup. Private keys that control the coins are then derived from that phrase.

Security rests on strong randomness. A wider range of possible values makes it far harder for an attacker to guess the phrase or key.

Technical reports show a configuration error in Coldcard stopped the hardware random number generator from working correctly. The system fell back to a weaker software generator that used the chip serial number and internal clock as starting points.

Such data is not truly secret. An attacker with the right knowledge can shrink the search space, run heavy calculations, and match addresses already on the blockchain. The flaw appeared in version 4.0.0 released in March 2021 and persisted across later releases for years.

Exposure levels differ by model

Impact varies across Coldcard models. In Mk2 and Mk3 units, randomness dropped sharply. Newer models such as Mk4, Q, and Mk5 include an extra component that adds randomness during generation.

Coinkite states this component strengthens protection. Researchers offered a more measured view, noting that even newer models still carry limits in how the added randomness is handled.

Not every new device was breached, and not every Coldcard holder will lose funds. The full scope of exposure remains unclear, so users cannot assume safety based only on model type without reviewing creation details and timing.

Bitcoin network untouched, product flaw exposed

Despite the theft scale, the Bitcoin network continues normal operation. Transactions carried valid signatures once the attacker rebuilt the weak keys. From the network viewpoint, the transfers were legitimate.

The incident shows that self-custody involves more than buying a hardware wallet. It also requires confidence in the maker, the code, the key creation process, and the user's readiness to act on alerts and shift to a fresh wallet when needed.

The attack therefore represents more than the loss of tens of millions of dollars. It serves as a clear reminder that a cold wallet offers no automatic shield, and that in a setting where users act as their own bank, security responsibility stays firmly with them.