Coldcard Firmware Flaw Leads to Significant Bitcoin Theft Amid Security Concerns

A serious security issue affecting Coldcard hardware wallets has come to light, with reports indicating that a firmware flaw has led to the theft of over $111 million in Bitcoin. This incident has reignited discussions about the safety of hardware wallets and the importance of secure seed generation.

The vulnerability primarily impacts Coldcard Mk3 devices running firmware versions 4.0.1 through 5.0.3, as well as Mk4 and Mk5 devices before firmware 5.6.0. The flaw allowed the hardware random number generator to be replaced by a predictable software substitute, significantly reducing the entropy of seed phrases from the intended 128 bits to just 72 bits. This reduction in randomness made it feasible for attackers to guess seed phrases, leading to substantial losses.

According to analysis from Galaxy Research, victims reported a median loss of 1.022 Bitcoin, with some individuals losing as much as 58.97 coins. The attack, which began on July 30, 2026, targeted long-dormant wallets, with 88% of the stolen funds being held for over a year.

Coinkite, the manufacturer of Coldcard, acknowledged the issue, stating that the bug had gone unnoticed for an extended period and urged users to update their firmware or transfer their funds to safer storage solutions. Despite the negative news surrounding the Coldcard hack, Bitcoin's price showed resilience, trading above $65,170 as investors continued to buy into exchange-traded funds (ETFs).

This incident serves as a reminder of the critical importance of operational security and the need for users to understand how their wallets generate and store seed phrases. While hardware wallets are often viewed as a secure option for holding cryptocurrency, this event highlights that they are not immune to vulnerabilities and that users must remain vigilant.