Over $100M in Bitcoin Stolen in Coldcard Hardware Wallet Exploit

ArticleCBC NewsNews

A critical vulnerability in Coldcard hardware wallet firmware allowed attackers to reconstruct seed phrases and steal over $100 million worth of bitcoin.

Key points

  1. Toronto-based Coinkite warned customers of a software flaw that allowed attackers to reconstruct master seed phrases without physical access to devices.
  2. On-chain analysis by Galaxy Research identified at least 1,596 stolen bitcoins across roughly 7,300 addresses, with a suspected fourth wave potentially raising losses to 2,055 BTC.
  3. The bug originated in March 2021, when affected firmware switched from a hardware true random number generator to a deterministic pseudo-random generator.
  4. Firmware updates protect only newly generated wallets; existing seed phrases created on vulnerable firmware remain compromised and require immediate fund migration.
  5. Coinkite CEO Rodolfo Novak warned that AI-assisted code review is speeding up the discovery of latent bugs across public and open-source codebases.

Why it matters

Coldcard is regarded as one of the most secure cold storage solutions in the cryptocurrency industry. This breach proves that physical isolation provides no defense if the underlying cryptographic randomness is flawed.

Analysis

The breach exposes a fundamental flaw in assuming hardware isolation guarantees safety. While the physical device never connects to the internet, deterministic key generation allows adversaries to reconstruct private keys off-chain. Novak's assessment regarding AI-driven vulnerability discovery also indicates an evolving threat model for open-source firmware projects.

Mentioned links

Found in

Summary generated by AI (Gemini 3.8 Flash, 27 September 2026). It may contain errors – the original source is authoritative.

Related entries

Similar in content, found by the AI search.

  • Link:CBC News

    Over $100M US in Bitcoin Stolen in Coldcard Hack

    According to a CBC News report citing blockchain intelligence firm Galaxy Research, hackers have drained over $100 million US worth of bitcoin from Coldcard hardware wallets.

    Security· News

  • Article:Coinkite

    Coldcard Security Advisory: Firmware Bug Causes Weakened Seed Generation

    A firmware bug affecting Coinkite Coldcard devices (Mk2, Mk3, Mk4, Mk5, and Q) caused weakened seed generation, enabling attackers to reconstruct private keys offline and steal funds. Coinkite has released fixed firmware builds and advised users of affected seeds to migrate funds immediately.

    Security· Announcement

  • Repository:Coldcard/firmware

    Coldcard Firmware: Source Code and Simulator for Bitcoin Hardware Wallets

    The Coldcard/firmware repository provides the firmware and simulator code for Coldcard Bitcoin hardware wallets (Mk3, Mk4, MK5, and Q1). It currently highlights a critical security advisory regarding degraded entropy during seed generation prior to July 2026.

    773starsPython

    Security· Tool

  • Repository:nealbridges/VulnHunter

    VulnHunter: Agentic AI Security Scanner for Exploitable Vulnerabilities

    VulnHunter is an open-source, agentic AI security scanner that inspects source code from an attacker's perspective, confirms exploitability, and generates fixes. This maintained fork of Capital One's original project decouples the tool from Claude Code to support arbitrary agent harnesses and open-weight models.

    223starsPython

    AI & LLMs· Tool

  • Article:The Cognition Team

    Cognition Introduces Devin Security Swarm

    Cognition has launched Devin Security Swarm, a multi-agent system designed to identify, validate, and remediate codebase vulnerabilities. Instead of merely surfacing static alerts, the system verifies exploitability in runtime sandboxes and automatically generates remediation pull requests.

    AI & LLMs· Announcement

Back to the knowledge base

Let's talk about your project

Get in touch

Locations

  • Mattersburg
    Johann Nepomuk Bergerstraße 7/2/14
    7210 Mattersburg, Austria
  • Vienna
    Ungargasse 64-66/3/404
    1030 Wien, Austria

Parts of this content were created with the assistance of AI.