The Coldcard Hack: When “Offline” Wasn’t Enough

Greetings CryptoCubers,

This week, we are covering one of the most shocking cryptocurrency security stories we have seen in years.

A major vulnerability in Coldcard, one of the most respected Bitcoin hardware wallets in the industry, has resulted in attackers stealing enormous amounts of Bitcoin from users who believed their funds were safely secured offline.

Galaxy Research tracked losses near $130 million as of August 4, with multiple attackers believed to be exploiting the vulnerability and investigations still ongoing.

This is not simply another story about somebody clicking a phishing link.

For many victims, there was no suspicious website.

There was no compromised exchange.

There was no malware stealing their seed phrase.

There was no hacker physically accessing their Coldcard.

Some users followed the security practices the Bitcoin community has recommended for years — and still lost their Bitcoin.

That is what makes this incident so important to understand.

Before we dive in, let’s take a look at the market.

This Week's Crypto Prices

7 day % change

Bitcoin: approximately $64,769 ⬆️ 2,2%

Ethereum: approximately $1,915 ⬆️2.14%

Solana: approximately $77.97 ⬆️3.52%

Prices are approximate at the time of writing and may change rapidly.

First: What Is Cold Storage?

To understand why this hack caused such a reaction, we first need to understand what cold storage is supposed to protect us from.

When cryptocurrency is stored on an exchange or an internet-connected wallet, there are numerous potential attack points.

Your password could be stolen.

Your computer could become infected.

An exchange could be compromised.

A malicious application could access your wallet.

Cold storage attempts to remove many of these risks by keeping the private keys required to spend your Bitcoin offline.

Hardware wallets such as Coldcard are specifically designed for this purpose.

Your private key remains inside the device, while transactions can be prepared elsewhere and signed securely.

Coldcard has built much of its reputation around Bitcoin-focused security, including air-gapped transaction signing and dedicated security hardware.

So naturally, many people assumed:

“My Coldcard has never been connected to the internet. My seed phrase has never been exposed. My Bitcoin should be safe.”

Normally, that logic makes sense.

But this attack found a completely different way in.

The Problem Started Before the Bitcoin Was Even Stored

Here is the most important part of the entire story.

The attackers did not necessarily need to steal the private key.

Instead, they exploited a weakness in the way certain Coldcard devices had originally created the private key.

Every Bitcoin wallet begins with randomness.

When a hardware wallet creates your recovery seed — usually represented by 12 or 24 words — it must generate an extremely unpredictable number behind the scenes.

In cryptography, we often describe this randomness as entropy.

Think about it like this.

Imagine there are more possible combinations than all the grains of sand on Earth.

A thief could try combinations for an unimaginable amount of time and still have virtually no chance of discovering yours.

That enormous search space is one of the foundations protecting cryptocurrency wallets.

But what happens if a programming error dramatically reduces the number of possible combinations?

Suddenly the impossible search becomes much smaller.

And that is essentially what happened.

The Five-Year-Old Coldcard Bug

Coldcard was designed to use a dedicated hardware True Random Number Generator, or TRNG, when generating wallet seeds.

However, during a software migration in March 2021, a build and integration error caused the seed-generation process to resolve to a general-purpose software pseudorandom number generator instead of the intended hardware random-number source.

Coldcard's manufacturer, Coinkite, says this was not an intentional security shortcut.

The hardware random-number generator did not suddenly fail.

Instead, the software was effectively connected to the wrong source of randomness during the seed-generation process.

That difference sounds technical, but its consequences were enormous.

Galaxy Research estimates that affected older Mk2 and Mk3 wallets may have had roughly 40 bits of effective entropy, while affected Mk4, Mk5 and Q wallets had around 72 bits, rather than the intended security level of approximately 128 bits.

Seventy-two bits still sounds enormous.

Forty bits still sounds enormous.

But for specialised attackers using modern computing resources, there is an enormous difference between searching through 40 bits and searching through 128 bits.

Cryptographic security can collapse surprisingly quickly when enough randomness disappears.

How Could Hackers Find Wallets They Had Never Seen?

This is perhaps the strangest part.

Bitcoin's blockchain is public.

Everyone can see Bitcoin addresses and balances.

Normally that does not matter because knowing somebody's Bitcoin address does not reveal their private key.

But if an attacker knows that certain wallets were generated using a restricted range of possible seeds, the blockchain becomes useful.

The attacker can generate huge numbers of possible Coldcard seeds offline.

Each seed produces Bitcoin addresses.

Those addresses can then be compared against addresses visible on the Bitcoin blockchain.

If one matches a funded wallet, the attacker has potentially discovered the key required to spend that Bitcoin.

No phishing email.

No compromised computer.

No stolen Coldcard.

The weakness was already inside the key from the moment the wallet was created.

Galaxy says physical access to the victim's Coldcard was not required.

And Then the Bitcoin Started Moving

The first major attacks began on July 30, 2026.

TRM Labs reported an initial sweep in which approximately 594 BTC was removed from around 500 wallets in roughly 25 minutes.

Several additional waves followed.

By TRM's assessment a few days later, approximately 1,816 BTC had been drained from more than 5,200 addresses, while Galaxy's broader investigation subsequently tracked losses near $130 million.

The exact final amount may take time to establish because some victims may not yet know that they were affected and investigators continue identifying transactions linked to the vulnerability.

And unfortunately, behind those statistics are real people.

“But I Did Everything Right”

This is the part of the story that deserves some humanity.

It is easy in cryptocurrency to blame victims.

“You clicked the wrong link.”

“You exposed your seed phrase.”

“You kept your money on an exchange.”

“You should have used a hardware wallet.”

But many Coldcard victims did use a hardware wallet.

One victim described by Galaxy reportedly kept his Coldcard inside a bank safe-deposit box, never connected it to the internet and nevertheless lost 18.25 BTC in approximately seven minutes.

That is life-changing money.

People spent years saving and accumulating Bitcoin because they believed they were taking responsibility for their financial security.

Some may have been saving for retirement.

Some may have been saving for their children.

Some may have been holding Bitcoin they never intended to sell.

To those affected, our sympathy genuinely goes out to you.

Security education is important, but this was not simply another case where users ignored basic advice.

The product they trusted failed at one of the most fundamental stages of cryptocurrency security: creating the key itself.

So What Did Coldcard Actually Do Wrong?

There are several lessons here.

The first and most obvious failure was the seed-generation bug itself.

A hardware wallet designed around secure key generation unintentionally allowed its seed-generation path to use a weaker software random-number generator instead of relying exclusively on the intended hardware source.

The second failure is that the problem remained in affected software for years.

The vulnerable seed-generation path dated back to the 2021 software migration and was not discovered before users began losing funds in 2026.

For security software protecting potentially billions of dollars, key generation is one of the areas where extremely aggressive testing, independent verification and redundancy are critical.

A beautiful interface does not matter if the numbers behind the private keys are predictable.

An air gap does not matter if the seed was weak before the device ever went offline.

And a secure element cannot magically make a poorly generated private key stronger.

That is perhaps the biggest lesson of the Coldcard incident.

Coldcard Has Now Patched the Problem — But There Is a Catch

Coinkite has released fixed firmware versions for the affected Coldcard models.

However, this is extremely important:

Updating your firmware does NOT repair an old vulnerable seed.

The seed already exists.

You cannot add randomness to it afterwards simply by updating the device.

Coldcard's own security advisory tells users with affected seeds to update to fixed firmware, generate an entirely new seed and migrate their Bitcoin to the new wallet.

Affected versions include Mk2 and Mk3 firmware from version 4.0.1 through 4.1.9, while seeds generated on Mk4, Mk5 and Q devices before their respective fixed firmware releases are also affected.

Coldcard says seeds that incorporated sufficient independent dice-generated entropy have different risk considerations, while strong and unique BIP-39 passphrases can also create an additional barrier — but the company's general guidance remains that affected users should migrate.

If you own a Coldcard and believe your wallet could fall into these categories, use Coldcard's official website and official security advisory only.

Do not trust random links sent through social media.

Security incidents almost always attract a second wave of scammers pretending to offer fixes.

Did Bitcoin Get Hacked?

No.

This distinction is absolutely essential.

The Bitcoin blockchain was not broken.

Bitcoin's encryption was not cracked.

Bitcoin's mining network was not compromised.

There was no fundamental failure of the Bitcoin protocol.

The vulnerability existed inside one hardware-wallet implementation used to generate private keys.

The attackers did not break Bitcoin's security.

They found keys that were much easier to predict because of the Coldcard software defect.

That is a hardware-wallet failure — not a Bitcoin network failure.

Is This the End of Cold Storage?

Absolutely not.

In fact, it may eventually make cold storage stronger.

Every major security failure teaches an industry something.

Aircraft become safer because crashes are investigated.

Banks improve cybersecurity because attacks reveal weaknesses.

Software improves because vulnerabilities expose assumptions developers previously believed were safe.

Hardware wallets should be no different.

The lesson from Coldcard is not:

“Hardware wallets don't work.”

The lesson is:

Never allow the security of enormous amounts of cryptocurrency to depend on one assumption, one device or one implementation.

TRM Labs highlighted multisignature setups using independently designed devices and independently generated entropy as one potential form of defence in depth.

This means the future of serious Bitcoin storage may increasingly involve multiple layers.

Different hardware.

Independent key generation.

Multisignature wallets.

Stronger verification of entropy generation.

More independent firmware audits.

Greater scrutiny of wallet software.

And perhaps simpler ways for normal users to verify that the keys being generated for them are genuinely secure.

Cold storage is not disappearing.

It is evolving.

The Bigger Lesson: “Not Your Keys” Is Only Half the Sentence

Bitcoin users have repeated a famous phrase for years:

“Not your keys, not your coins.”

The Coldcard incident adds another question.

How were those keys created?

Owning your private key gives you control.

But if somebody else can recreate that private key because of weak randomness, control becomes meaningless.

Self-custody removes many risks associated with exchanges and financial intermediaries.

But it does not remove risk completely.

Instead, some of that risk moves into your hardware, your software, your backups and the processes used to create and protect your keys.

That does not mean self-custody is bad.

It means we need to understand it properly.

The CryptoCube Takeaway

The Coldcard hack is frightening precisely because many affected users appear to have taken security seriously.

And that is why this event should not be brushed aside.

But it should also not lead us to panic.

Bitcoin continues operating.

Cryptography continues operating.

Cold storage remains one of the strongest tools available for long-term cryptocurrency security when implemented correctly.

What has changed is our understanding of where the risk can exist.

Previously, many beginners thought:

“If my wallet is offline, I'm safe.”

Today we know the better question is:

“Is every part of the process that created and protects my wallet secure?”

That includes the device.

The firmware.

The randomness used to create the seed.

The seed backup.

The passphrase.

The transaction process.

And potentially even the use of multiple independent keys.

Crypto continues to mature because difficult events force the industry to become better.

This was a painful lesson.

For some victims, an unimaginably painful one.

But if hardware-wallet manufacturers, security researchers and users learn from it properly, the result should not be the death of cold storage.

It should be the beginning of better cold storage.

Stay educated.

Stay cautious.

And most importantly, never stop learning.

Until next time,

The CryptoCube Team