Hackers have stolen over $130 million in Bitcoin by exploiting a roughly five-year-old vulnerability in Coldcard offline hardware wallets made by a company called Coinkite, according to estimates from blockchain research firm Galaxy Research as of August 4, 2026 (TechCrunch). Tom Robinson, co-founder and chief scientist of crypto monitoring firm Elliptic, confirmed the figure is accurate.

To understand what went wrong, it helps to know what a hardware wallet does. A hardware wallet is a small physical device, somewhat like a USB stick, that stores the keys to your cryptocurrency offline. The idea is that because it is not connected to the internet, hackers cannot reach it remotely. When you set up one of these wallets, it creates a "seed phrase" — a sequence of words that acts as the master password to your funds. Anyone who knows your seed phrase can take your money.

The problem is in how Coldcard wallets generated those seed phrases. Security researchers at Block found that the wallets used a flawed method for generating randomness — the unpredictability that makes a password impossible to guess (Block Engineering Blog). Think of it like a combination lock that was supposed to produce a random code each time, but instead used a predictable pattern. Because the generated seed phrases were predictable, attackers could work backward and figure them out, gaining full control of the associated wallets without ever needing network access to the device itself.

The flaw affects seed generation across five Coldcard models. Coinkite's own security advisory warns that seeds generated on firmware version 4.0.1 (2021 or later) are at risk (Coldcard Security Advisory). The advisory specifies that funds are at risk if the seed was created without 50 independent, private dice rolls and the wallet lacks a strong passphrase (Coinkite Blog).

The attack unfolded in waves. On July 30, 2026, an attacker drained 1,196 Bitcoin addresses in 41 minutes, taking 1,082.65 BTC worth approximately $70.2 million at the time (The Hacker News). The attack subsequently spread to approximately 4,500 addresses as losses neared $89 million (CoinDesk). Galaxy Research flagged a third wave of Bitcoin sweeps tied to weak Coldcard-generated keys, with the attacker shifting to target smaller balances. By August 4, the total had climbed to roughly $130 million.

At least a dozen different hackers are now targeting Bitcoin owners who use Coldcard wallets, and it is unclear who is behind the thefts. The scale and coordination suggest the exploit methodology has circulated sufficiently for multiple independent actors to weaponize it.

Coinkite published its security advisory on July 30, 2026, warning Coldcard users of the seed-generation flaw and urging them to update their devices and migrate to a new seed phrase. The company followed with a technical backgrounder the same day, and an update post on August 2 addressing customer support, affected inventory, migration options, and remediation work ahead (Coinkite Blog). Coinkite maintains a Responsible Disclosure page documenting its broader security advisory history (Coinkite).

One affected user, identified as Jonathan Goodman, claimed $1.6 million was stolen from his wallet despite keeping his seed phrase secret and his devices offline. His case illustrates the core failure: the problem was not in how he managed his security, but in the seed phrase itself. The wallet generated a weak one.

The Coldcard exploit has also produced knock-on effects in market behavior. Blockchain analytics firms reported that smaller Bitcoin holders moved funds onto exchanges for safety following the attack (CoinDesk). OKX reported record exchange inflows driven by users moving Bitcoin out of self-custody (crypto.news).

The Coldcard incident occurs within a broader surge in crypto-targeted attacks. TRM Labs reported that in the first half of 2026, more than 200 hacks targeted cryptocurrency companies, with total losses exceeding $950 million.

The technical failure here is specific: a flawed method for generating randomness produced seed phrases that were too predictable to be safe. Hardware wallets exist to eliminate the class of attacks that depend on network exposure, keylogging, or phishing. When the randomness source itself is compromised, the offline design stops mattering. The attacker never needs to touch the device; they need only replicate the flawed generation process and check candidate seeds against the blockchain.

Coldcard publishes its firmware source code for anyone to review. That openness is a genuine asset, but it is only effective when reviewers actually examine the code paths in question. The vulnerability persisted for approximately five years before discovery, which raises questions about the depth and frequency of third-party review applied to the routines that generate seed phrases in hardware wallets.

The broader context here is that the behavioral response to this incident, users migrating from self-custody back to exchanges, reverses the trend that took hold after the FTX collapse, when people moved away from exchanges precisely because they did not trust them. The irony is structural rather than incidental. The very property that made Coldcard attractive, its fully offline design, became the vector. A bug in an offline wallet is harder to detect than a break-in at an online service, because there is no live transaction stream to monitor, no unusual activity to flag. The first signal is funds moving on the blockchain, by which point the seed phrase is already in the attacker's hands.

For Coldcard users, the remediation path is clear: update firmware, generate a new seed using 50 independent dice rolls, and set a strong passphrase. For the broader hardware-wallet ecosystem, the lesson is that the method used to generate randomness deserves the same scrutiny as any other security feature. Randomness is the foundation of every promise a hardware wallet makes. When that foundation cracks, everything above it goes with it.