Coldcard Firmware Vulnerability Leads to $116M Bitcoin Self-Custody Theft

Attackers have stolen roughly 1,816 $BTC, valued at nearly $116 million, by exploiting a five-year-old firmware vulnerability in Coinkite's Coldcard hardware devices, according to blockchain intelligence firm TRM Labs ¹. The systemic drain commenced on July 30, 2026, hitting over 5,200 addresses across four distinct transaction waves, marking the third-largest cryptocurrency hack of 2026 ¹.

The vulnerability stems from firmware version 4.0.1, released in March 2021 ¹. A build configuration flaw caused certain devices to bypass hardware-based entropy and rely instead on a weak software random number generator during seed generation ¹. This bug reduced effective cryptographic key strength from 128 bits down to as few as 40 bits on certain devices, enabling remote threat actors to brute-force private keys without obtaining physical access to the wallets ¹. Within the first 25 minutes of the campaign on July 30, an initial sweep pulled approximately 594 BTC into a consolidation address ¹. TRM Labs reported that updating device firmware protects only newly created wallets and does not secure seeds generated under affected versions, requiring users to migrate funds to completely new seeds ¹.

Laundering Footprint and Ecosystem Impact

Unlike aggressive laundering operations typical of state-backed entities such as North Korea's TraderTraitor, the majority of stolen assets remain pooled at a small cluster of attacker-controlled addresses ¹. Traced laundering activity has so far been restricted to a single 64.9 BTC deposit into Wasabi and a 200 $ETH deposit into Tornado Cash executed on Aug. 4, 2026 ¹. TRM Labs noted that differing transaction structures across the four waves suggest multiple independent actors may be exploiting the flaw, precluding immediate attribution to a specific threat actor ¹.

The incident brings total crypto exploit losses in 2026 to more than $1.2 billion across 276 recorded breaches ¹. The failure highlights that self-custody shifts operational risk rather than eradicating it, emphasizing the reliance of secure storage on flawless initial entropy generation ¹. As explained in our guide to crypto wallets, hardware devices rely fundamentally on secure key architecture to resist exploitation. Users who initialized Coldcard seeds between March 2021 and the recent patch must treat those keys as compromised and transfer balances to fresh addresses ¹.