Standing reference. Checked against vendor advisories and published forensic reports on 19 August 2026. The dominant wallet security event of 2026 is the Coldcard seed-entropy failure, and most of this page is about it, because it is the case that breaks the assumptions people were relying on. Loss estimates are still moving; the table below shows who says what, and when they said it.
What happened, in one paragraph
On 30 July 2026, between 01:10 and 01:51 UTC, an automated tool swept more than a thousand bitcoin out of roughly 1,200 addresses in 41 minutes. Nobody was phished. No device was touched. No malware was involved. The wallets were Coldcards — air-gapped hardware wallets, some of them in safe deposit boxes, some of them never once connected to a computer. A firmware defect dating to March 2021 had caused the devices to generate their seed phrases from a weak software random number generator instead of the dedicated hardware one, and the attackers simply worked out what the keys were.
The loss figures, by source
There is no single agreed number, and anyone quoting one without a date is quoting something stale. The estimates rose as victims came forward, and different firms drew the boundary of the incident differently.
| Source | As at | BTC | Addresses | USD |
|---|---|---|---|---|
| Galaxy Research, wave 1 only | 1 August | 1,082.65 | 1,196 | ~70m |
| Galaxy Research, waves 1–3 | 1–2 August | 1,367 | 4,585 | ~88.6m |
| TRM Labs, four waves | 5 August | ~1,816 | 5,200+ | ~116m |
| CoinDesk, citing Galaxy | 17 August | 1,596 | ~7,300 | >100m |
| Galaxy Research, high confidence | latest | 1,778.84 | 8,600+ | ~112.7m |
| Galaxy Research, including unconfirmed wave 4 and medium-confidence footprints | latest | 2,417.35 | — | ~153m |
The dollar figures do not scale with the BTC figures because the bitcoin price moved across the period. The address counts rise faster than the BTC because later waves caught smaller holdings. And the confidence bands are not decoration: Galaxy separates what it can confirm from what it suspects, which is the correct way to publish a moving number and the reason its lower figure is the one we lead with.
An independent reconstruction by Bitquery, built from the public ledger without reference to any published figure, found 1,199 victim addresses and 1,050.14 BTC in the first wave, against Galaxy’s 1,196 and 1,082.65. Two methods, arrived at separately, within 3% of each other. That is about as good as corroboration gets in this field.
The defect
A Bitcoin wallet is a very large secret number. Every address and private key derives from it by fixed public rules, so the entire security of the wallet rests on one question: how many numbers would an attacker have to try?
The intended answer was 2 to the power of 128 — a search space with no useful physical comparison. What the affected devices actually produced was very much smaller.
| Model | Intended entropy | Actual, per Coinkite and Block |
|---|---|---|
| Mk2, Mk3 | 128 bits | About 40 bits. Block describes generation on these boards as deterministic given a known device ID, timer state and call history. |
| Mk4, Mk5, Q | 128 bits | About 72 bits per Coinkite. Block put the effective secure-element search space at 2^32 candidates — roughly four billion, averaging about 2^31 trials. |
Forty bits is around a trillion possibilities. Four billion is less than that. Both are numbers a competent operator with ordinary hardware can work through, and every step of the work happens on the attacker’s machine: generate candidate seeds, derive the addresses each would produce, check those addresses against the public blockchain, sweep whatever has a balance. The victim’s device is not involved and can be powered off on another continent.
The cause was a build flag
In 2021 Coinkite moved Coldcard’s cryptography onto libsecp256k1, the library Bitcoin Core uses. That was a reasonable decision. The integration is where it failed.
According to Block’s engineering and security team, a build guard used #ifndef, which tests whether a setting is defined rather than whether it is switched on. Coinkite had defined the setting as zero — meaning off. Zero is still defined, so the guard passed, the build completed, and seed generation silently routed to MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware random number generator sitting on the board. Both versions of the function had identical signatures, so nothing looked wrong to a reader.
The hardware random number generator was present in the shipped firmware the entire time. It just stopped being asked.
Why five years of open source did not catch it
This is the part with implications beyond one vendor. Coldcard’s source was public, its builds were reproducible, and its whole pitch rested on don’t trust, verify. Reviewers confirmed the correct generator existed in the binary. Nobody traced the seed-generation path end to end to establish which generator the device actually called.
CoinDesk reported on 17 August that developer James O’Beirne raised the possibility of exactly this defect with Coinkite in May 2025 while auditing the code, and that the company’s response was that a real problem would probably have been found already. Coinkite has separately said that AI-assisted reviews it ran before the theft did not find the error either, and that models run over the same code afterwards also missed it — while suspecting that an attacker found it with the same class of tool.
Am I affected, and what do I do
| Model | Seeds at risk if generated on | First fixed version |
|---|---|---|
| Mk2, Mk3 | 4.0.1 through 4.1.9 | 4.2.0 |
| Mk4, Mk5 | anything before 5.6.0 | 5.6.0 (Edge: 6.6.0X) |
| Q | anything before 1.5.0Q | 1.5.0Q (Edge: 6.6.0QX) |
| TAPSIGNER, OPENDIME, SATSCARD | not affected — different codebases | — |
Four points that are easy to get wrong, and expensive to get wrong.
- Updating the firmware does not repair an existing seed. The weakness is in the words themselves. A fixed device generates safe seeds from now on; it cannot retroactively make an old one strong.
- Moving coins to fresh addresses inside the same wallet accomplishes nothing. An attacker holding the seed can derive every address that wallet will ever produce.
- Exporting the seed to a different wallet app accomplishes nothing either. The flaw travels with the seed.
- There is no self-test. An owner cannot check whether their particular seed falls inside the reproducible range. Absent dice rolls or a strong passphrase, the safe assumption is that it does.
Coinkite’s stated remedy is: verify your existing backup, install fixed firmware, generate and record a new seed, verify the new wallet fingerprint and a receive address on the device, send a small test transaction, confirm it, then move the rest. Coinkite treats seeds supplemented with at least 50 fair, independent, private dice rolls as not at risk from this flaw alone. A strong unique BIP-39 passphrase makes exploitation harder but does not repair the underlying seed, and migration is still the advice.
Galaxy reported no confirmed attacker activity after 6 August, and attributes the lull to vulnerable users having migrated or funds having already been taken — not to the flaw being closed. Anyone still holding funds on a single-signature Coldcard seed generated in the affected window should treat the position as live.
Where the money went
Most of it has not moved. Of at least 1,778 BTC stolen, Galaxy puts about 1,531 BTC still sitting in attacker-controlled addresses, untouched. Of the roughly 246 BTC that has moved, about 65% went into CoinJoin mixing and the rest continued on chain, sometimes through carefully constructed peel chains, with only traces reaching exchanges or bridges.
TRM’s tracing found the same shape and drew the obvious inference: an operator sitting on a sum large enough to attract attention wherever it lands, and apparently still working out where to put it. That is very different from the behaviour of established state-linked groups, which typically begin laundering within hours. Neither TRM nor Galaxy attributes the theft to a named actor, and neither should anyone else on current evidence. Coinkite and Galaxy both indicate that multiple attackers piled in once the flaw was public — Galaxy has identified at least 33 additional attacker footprints beyond the three confirmed waves.
What this does and does not say about self-custody
The victims here were not careless. Galaxy’s characterisation is fair: they were long-term savers who avoided exchanges, avoided yield, avoided bridges, and did the thing the ecosystem tells people to do. One reported loss was a device that had never been online, kept in a safe deposit box, with the seed stored in a second safe deposit box.
The correct conclusion is narrower and more uncomfortable than either side of the usual argument. Self-custody does not remove counterparty risk; it relocates it. You no longer trust an exchange to hold your coins, and you instead trust a manufacturer to have generated your keys properly — a dependency that is invisible, unverifiable by the user, and, as this incident demonstrates, survivable for five years inside published open-source code.
That is an argument for multi-signature setups across vendors, for treating single-vendor entropy as a single point of failure, and for verification that follows a code path rather than confirming a component exists. It is not an argument for exchanges, and it is not an argument against hardware wallets. Coldcard is also not the only vendor to have shipped a serious firmware defect this year — BitBox patched severe flaws tied to malicious firmware risk in the same period.
The wider numbers, and why they disagree
| CertiK Hack3D | TRM Labs | |
|---|---|---|
| Total stolen | 1.316bn dollars | 972m dollars |
| Incidents | 344 | 207 |
| Net of frozen and returned | 1.20bn dollars | not stated |
| Costliest vector | Wallet compromise — 444.5m across 33 incidents | Smart contract exploits, 125 of 207 incidents |
| Attribution | not aggregated | ~643m, about 66%, to North Korea-linked activity |
Both are careful firms and both are reporting honestly. They disagree because they count different things: what qualifies as an incident, whether scams and phishing are inside the boundary, and how recovered funds are treated. Anyone citing “total crypto losses” without naming the dataset is quoting a number whose definition they have not checked.
One point both make, and which the headline year-on-year fall obscures: 2025 was inflated by a single 1.45 billion dollar exchange breach. Strip it out and CertiK puts the comparable first half of 2026 about 28% higher. TRM records more separate hacks in the first half of 2026 than in any six-month period it has measured. Fewer dollars, more attacks.
Questions we get asked
Was Coldcard hacked?
Not in the sense of somebody breaking into a device or a server. A firmware defect caused the wallets to create weak seed phrases, and attackers computed the resulting private keys offline from public blockchain data. The devices themselves were never accessed.
How much was stolen in the Coldcard hack?
Galaxy Research confirms 1,778.84 BTC, about 112.7 million dollars, from more than 8,600 addresses. Including an unconfirmed fourth wave and medium-confidence footprints the figure would reach 2,417.35 BTC, about 153 million dollars. Earlier and lower numbers you may see — 88.6 million, 116 million — were accurate on the day they were published.
Is my hardware wallet safe if it was never online?
Being offline did not help in this case, because the attack never needed the device. Air-gapping defends against malware and remote access. It does not defend against keys that were guessable the day they were created.
Does updating the firmware fix it?
No. Fixed firmware generates safe seeds going forward. A seed created under the vulnerable firmware stays compromised, and the only remedy is a new seed on fixed firmware with all funds moved to it.
Do dice rolls help?
Coinkite treats a seed supplemented with at least 50 fair, independent, private dice rolls as not at risk from this flaw alone. Bitcoin Core developer Luke Dashjr has cautioned publicly that ordinary injection-moulded dice are measurably biased and suggested precision dice plus a second entropy source. The bias argument is real and, on these numbers, second-order: a biased die still yields roughly 2.5 bits per roll, so 50 rolls is a large margin. The stronger reading of his point is the general one — do not rely on a single source of entropy, which is precisely what failed here.
Which Coldcard models are affected?
Seeds generated on Mk2 and Mk3 firmware 4.0.1 to 4.1.9, on Mk4 and Mk5 before 5.6.0, and on Q before 1.5.0Q. Coinkite says TAPSIGNER, OPENDIME and SATSCARD are unaffected because they run different codebases. Check the vendor advisory directly rather than trusting any summary, including this one.
Has anyone been identified?
No. TRM declines to attribute, Galaxy says multiple attackers were active, and Coinkite has referred to at least 15. Block reported that the operator queried a commercial blockchain data provider during the sweeps and that the provider’s logs matched the suspected workflow closely; Block says it passed the information to authorities.
What we have reported
- $115 Million Lost in Coldcard Wallet Hack, According to Galaxy Research
- Coldcard Wallet Hack Reportedly Drains Over $111 Million, Victims Cite Median Loss of 1 BTC
- Coinkite Reportedly Preparing Post-Mortem After Coldcard Wallet Hack Claims
- Coldcard Hardware Wallet Exploit Reignites Debate Over Bitcoin Private Key Risk
- Coldcard Hardware Wallet Exploit Contributes to $247M in July Crypto Losses
- Explainer: What a Secure Element Chip Does Inside a Crypto Hardware Wallet
- BitBox Fixes Severe Hardware Wallet Flaws Tied to Malicious Firmware Risk
- Bitcoin ETF Inflows Continue as Cold Wallet Hack Renews Custody Concerns
Continuing coverage sits in Wallets and Custody.
Sources
- Coinkite advisory and technical backgrounder — affected versions, fixed versions, entropy estimates, migration steps. The primary source; check it before acting on anything here.
- Galaxy Research — loss tallies with confidence bands, wave analysis, fund movement.
- TRM Labs — independent tracing and laundering analysis.
- Block Bitcoin Engineering and Security team — the root-cause analysis and per-model entropy assessment.
- BleepingComputer, 2 August 2026 — disclosure timeline and version detail.
- CoinDesk, 17 August 2026 — the 2021 code change, the 2025 warning, victim accounts.
- Bitquery — independent ledger reconstruction of wave 1.
- CertiK Hack3D H1 2026 and TRM Labs H1 2026 — the sector-level loss datasets.
How this page is maintained
Loss estimates on an active incident are provisional by nature, and this one is still gathering victims. We re-check this page against Coinkite’s advisory and the Galaxy and TRM trackers weekly while the incident is live, and after that whenever a material figure changes. If your seed is in scope, act on the vendor advisory, not on a summary — including this one.