Hackers have stolen over $130 million in Bitcoin by exploiting a roughly five-year-old vulnerability in Coldcard offline hardware wallets made by Coinkite, according to estimates from blockchain research firm Galaxy Research as of August 4, 2026 (TechCrunch). Tom Robinson, co-founder and chief scientist of crypto monitoring firm Elliptic, confirmed the figure is accurate.

The vulnerability lies in how Coldcard wallets generated users' seed phrases. A seed phrase is a list of words that serves as the master key to a cryptocurrency wallet — anyone who has it can spend the funds. Security researchers at Block documented the issue as a predictable RNG (random number generator) fallback combined with a 32-bit reseed problem in Coldcard firmware (Block Engineering Blog). Because the generated seeds were predictable, attackers could brute-force and reconstruct victims' seed phrases, gaining full control of the associated wallets without ever needing network access to the device itself.

The flaw affects seed generation across five Coldcard models. Coinkite's own security advisory, hosted at coldcard.com, warns that seeds generated on firmware version 4.0.1 (2021 or later) are at risk (Coldcard Security Advisory). The advisory specifies that funds are at risk if the seed lacks 50 independent, private dice rolls and the wallet lacks a strong passphrase (Coinkite Blog). In other words, users who let the wallet generate its own random seed — rather than introducing outside randomness through dice rolls — were exposed.

The attack unfolded in waves. On July 30, 2026, an attacker drained 1,196 Bitcoin addresses in 41 minutes, taking 1,082.65 BTC worth approximately $70.2 million at the time (The Hacker News). The attack subsequently spread to approximately 4,500 addresses as losses neared $89 million (CoinDesk). Galaxy Research flagged a third wave of Bitcoin sweeps tied to weak Coldcard-generated keys, with the attacker shifting to target smaller balances. By August 4, the total had climbed to roughly $130 million.

At least a dozen different hackers are now targeting Bitcoin owners who use Coldcard wallets, and it is unclear who is behind the thefts. The scale and coordination suggest the exploit methodology has circulated sufficiently for multiple independent actors to weaponize it.

Coinkite published its first-party security advisory on July 30, 2026, warning Coldcard users of the seed-generation flaw and urging them to update their devices and migrate to a new seed phrase. The company followed with a "Technical Deep Dive into the Entropy Issue" backgrounder the same day, and a "Update, Sunday" post on August 2 addressing customer support, affected inventory, migration options, and remediation work ahead (Coinkite Blog). Coinkite maintains a Responsible Disclosure page documenting its broader security advisory history (Coinkite).

One affected user, identified as Jonathan Goodman, claimed $1.6 million was stolen from his wallet despite keeping his seed phrase secret and his devices offline. His case illustrates the core failure mode: the compromise is not in operational hygiene but in the entropy — the measure of unpredictability — of the seed itself.

The Coldcard exploit has also produced knock-on effects in market behavior. Blockchain analytics firms reported that smaller Bitcoin holders moved funds onto exchanges for safety following the attack (CoinDesk). OKX reported record exchange inflows driven by users moving Bitcoin out of self-custody (crypto.news).

The Coldcard incident occurs within a broader surge in crypto-targeted attacks. TRM Labs reported that in the first half of 2026, more than 200 hacks targeted cryptocurrency companies, with total losses exceeding $950 million.

The technical failure here is specific and well-characterized: a predictable RNG fallback and a 32-bit reseed producing seed phrases with insufficient entropy for cryptographic safety. Hardware wallets exist precisely to eliminate the class of attacks that depend on network exposure, keylogging, or phishing. When the entropy source itself is compromised, the air gap — the physical isolation that is supposed to protect the device — becomes irrelevant. The attacker never needs to touch the device or its network environment; they need only replicate the flawed generation process and check candidate seeds against the blockchain.

Coldcard publishes its firmware source code and reproducible-build information for verification. Open-source auditability is a genuine asset, but it is only effective when reviewers actually examine the code paths in question. The vulnerability persisted for approximately five years before discovery, which raises questions about the depth and frequency of third-party review applied to entropy-generation routines in hardware wallets.

The broader context here is that the behavioral response to this incident — users migrating from self-custody back to exchanges — inverts the post-FTX trend toward self-custody. The irony is structural rather than incidental. The very property that made Coldcard attractive, its fully offline design, became the vector. An entropy bug in a cold-storage device is harder to detect than a hot-wallet compromise because there is no live transaction stream to monitor, no anomalous API calls to flag. The first signal is funds moving on-chain, by which point the seed is already in the attacker's hands.

For Coldcard users, the remediation path is clear: update firmware, generate a new seed using 50 independent dice rolls, and set a strong passphrase. For the broader hardware-wallet ecosystem, the lesson is that RNG implementation deserves the same scrutiny as secure-element selection and side-channel resistance. Entropy is the foundation of every cryptographic guarantee a hardware wallet makes. When that foundation cracks, everything above it goes with it.