Coldcard Exploit Drains $116M Bitcoin From 5,200 Wallets in Days

An attacker has systematically drained 1,816 Bitcoin worth approximately USD 116 million from over 5,200 Coldcard hardware wallet addresses since July 30, exploiting a five-year-old firmware vulnerability that crippled the device’s random number generation. The breach, which accelerated through multiple coordinated waves of theft, exposes a critical vulnerability in the self-custody narrative that has anchored Bitcoin’s appeal to institutional and retail investors alike.

The Exploit: How a Firmware Flaw Became a Massive Theft Vector

The vulnerability traces to a March 2021 firmware release from Coinkite, the developer behind Coldcard hardware wallets. A build configuration error caused the wallet’s seed generation to fall back on weak software-based random number generation instead of leveraging the device’s dedicated hardware entropy source. The result was catastrophic: effective key strength collapsed from the designed 128 bits down to as little as 40 bits on older devices, a reduction that modern computing power can brute force without requiring physical access to the wallet itself.

Coldcard Mk3 versions 4.0.1 through 4.1.9 proved most vulnerable, though newer models including Mk4, Mk5, and Q devices generated seeds with approximately 72 bits of entropy rather than the intended 128 bits during the affected period. This degradation meant that attackers could theoretically derive private keys through computational means, siphoning funds directly from affected addresses.

Timeline: Four Waves of Coordinated Theft

The attack began on July 30, 2026, with the first wave moving roughly 594 Bitcoin worth close to USD 38 million out of approximately 500 wallets into a single consolidation address in just 25 minutes. The speed and precision of the initial sweep signaled an automated, well-coordinated operation rather than isolated incidents.

Subsequent waves continued throughout early August. Galaxy Research’s tracking identified a fourth major wave on August 4, which lifted cumulative losses from approximately USD 89 million to as much as USD 114 million. By August 6, the tally had reached 1,816 BTC pulled from more than 5,200 addresses, establishing this as one of the largest single-incident losses in crypto history.

Company Response and User Guidance

Coinkite issued a security advisory and released patched firmware by August 1, roughly two days after the first wave began. The company advised users whose seeds were generated on affected firmware versions to migrate funds to new seeds immediately, provided they had not supplemented the wallet’s entropy with an independent source or utilized a strong BIP-39 passphrase. This guidance acknowledged a critical dependency: users who had added their own entropy layer or implemented passphrase protection retained security despite the firmware flaw.

However, the advisory also revealed an uncomfortable truth: the vulnerability remains live on specific models and firmware versions still in circulation, meaning users who have not yet updated face ongoing risk.

Market Reaction: Minor Losses Amid Broader Uncertainty

The broader cryptocurrency market registered the shock but did not collapse. Bitcoin traded at USD 64,373.79 as of August 7, down 0.25 percent over the preceding 24 hours, while the overall crypto market slipped 0.5 percent. Trading volume reached USD 18.2 billion with a market cap holding at USD 1.29 trillion. Block Digest’s proprietary BD Pulse indicator registered a neutral reading of 48 out of 100, with the BD Extreme Index remaining in normal range at positive 0.95 standard deviations, suggesting that despite the magnitude of the loss, systemic panic has not taken hold.

On-chain metrics reflected a modest long bias: the long-to-short account ratio stood at 1.25 with 55.5 percent long positioning versus 44.5 percent short, indicating traders had not fled risk assets entirely. Bitcoin dominance held steady at 55.37 percent, a signal that institutional interest in Bitcoin remained intact despite the self-custody security incident.

Broader Implications for Self-Custody

Security experts emphasize that the Coldcard exploit challenges a foundational tenet of the Bitcoin value proposition: that self-custody is safer than entrusting funds to third parties. The incident highlights how operational risks around self-custody have evolved as cyber threats become more sophisticated. A five-year-old firmware flaw, invisible to most users and only discoverable through sustained cryptographic analysis, demonstrates that even hardware-based security can harbor critical weaknesses.

The hack may accelerate adoption of regulated custodians and spot Bitcoin ETFs, according to industry observers who note that institutional investors often prioritize custody insurance and regulatory oversight over full self-custody control. For retail users, the incident underscores the necessity of understanding firmware update cycles and entropy supplementation methods.

What This Means for the Market

Immediate price action has remained muted, but the psychological impact carries weight. The breach arrives amid regulatory uncertainty, with the CLARITY Act facing delays in the U.S. Senate ahead of the August recess, and ahead of today’s Non-Farm Payroll report, which traders expect will move markets significantly. Taken together, these factors create an environment in which confidence in self-custody infrastructure may erode gradually rather than trigger an immediate capitulation.

The Coldcard exploit will likely accelerate conversations around custody solutions, hardware wallet redundancy protocols, and regulatory frameworks for device security—conversations that will shape how institutions approach Bitcoin accumulation over the next investment cycle.

Disclaimer: This content is for informational purposes only and does not constitute financial advice. Cryptocurrency markets are highly volatile and unpredictable. All trading decisions should be made based on your own research and risk tolerance. Block Digest is not responsible for any financial losses incurred as a result of acting on this content.