KoinlyticsBetween 01:31 and 01:56 UTC on July 31, 2026, an attacker moved 594 BTC out of roughly 500 Coldcard hardware wallets in 500 separate transactions, then consolidated 562 of those coins into a single address that has not moved since. At the Bitcoin price of the day, the haul was worth about $38 million. Galaxy Research now estimates that the pool of vulnerable addresses could hold as much as $70.2 million if the attacker keeps pulling.
What the firmware bug actually did
Coldcard, made by Coinkite, ships with a dedicated true random number generator (TRNG) whose entire job is to produce the unguessable entropy that becomes your seed phrase. In firmware 4.0.0, a build configuration change caused affected devices to skip that TRNG during key generation and fall back to a software-based generator seeded with non-secret chip data. In practice, that turned a 256 bit seed into a seed with a search space small enough to brute force on commodity hardware.
The attack, block by block
The transfers landed in three consecutive Bitcoin blocks. The attacker fragmented each victim balance into pieces, moved them through 500 separate transactions, and then consolidated 562 BTC into a single wallet. As of the last public update, that consolidation address had not touched its holdings.
Why it went undetected for five years
Seed generation is a one-shot event you almost never audit after the fact. Once your Coldcard hands you a 24 word phrase, you write it down and get on with life. A weak seed and a strong seed produce identical looking addresses until the day someone sweeps them.
What Coldcard users should do right now
Coinkite is urging every Coldcard holder on an affected model to move their Bitcoin to a freshly generated wallet, ideally one created on unaffected hardware or on a multisig setup where any single compromised key cannot drain funds on its own.
What to watch
Whether the consolidation address moves. How quickly Galaxy Research refines the estimate of exposed funds beyond the $70.2 million figure. Whether other hardware wallet vendors respond with independent audits.
Source: CoinDesk