How a five-year-old bug drained Bitcoin from the 'safest' wallets

The whole point of a hardware wallet is that it never goes online. You buy a dedicated device, you generate your keys on it, you keep them off every internet-connected computer, and you sleep well because there is no website to phish you and no exchange to collapse. People who hold Bitcoin this way did everything the security guides told them to do.

In late July 2026, thousands of them were robbed anyway. The attack, as CoinDesk put it, "never touched the devices." No malware, no fake app, no leaked seed phrase. The wallets betrayed their owners from the inside, because of a flaw that had been sitting quietly in the firmware since 2021. This is the honest account of what went wrong, whom it hit, and what it actually says about keeping your own keys.

What actually happened?

The wallet in question is the Coldcard, made by Coinkite, a Bitcoin-only security company founded in Toronto in 2013. It is one of the most respected devices in the space, favoured precisely by the "not your keys, not your coins" crowd who trust no third party.

On 30 July 2026, someone worked out that Coldcard's secret keys were, for a large class of devices, guessable. In a single 41-minute window that morning, CoinDesk reported, on-chain analysts at Galaxy Research watched 1,082.65 BTC, about $70 million, swept out of 1,196 wallets across six blocks. Coinkite published an emergency advisory the same day; in a follow-up post on 2 August the company conceded that "the last three days have been some of the hardest in this company's history." The money is still moving out in waves, and none of it has come back.

How do you drain a wallet that was never online?

The answer is a single word that decides everything in cryptography: randomness.

When you set up a hardware wallet, it generates a "seed", the master secret from which all your keys and addresses descend. That seed has to be genuinely, unguessably random. If an attacker can predict how your seed was generated, they do not need your device, your password or your PIN. They can simply regenerate your keys on their own machine and take everything. Good hardware wallets therefore draw randomness from a dedicated true hardware random-number generator built into the chip, physics you cannot forecast.

According to a detailed root-cause analysis by Block's engineering team, who found the flaw alongside anonymous researchers, Coldcard's firmware stopped doing that. A code change made in a commit dated 1 March 2021 (shipped in firmware version 4.0.0 that same month) accidentally routed key generation away from the chip's hardware randomness and into a deterministic software fallback, a simple pseudo-random generator called "Yasmarang". "Deterministic" is the fatal word: given the same inputs, it produces the same output every time.

And its inputs were not secret. Block found the fallback was seeded from little more than the low 32 bits of the chip's ID combined with a timer value. For the worst-affected devices, that collapses the space of "random" seeds to a pool small enough to brute-force offline in bulk, which means anyone who found the flaw could regenerate those wallets' keys retroactively, years after they were created. The bug then sat dormant for roughly five years until someone finally did.

Which Coldcards are affected, and what should owners do?

Not every Coldcard is equally exposed, and the distinction matters. The oldest models are the ones being actively drained. The newer models are badly weakened too: no wallets on them have been emptied, but Block warns that a targeted attacker who pins down a specific device's chip ID and boot timing could shrink the search far enough to break one. The safe assumption for every affected model is the same, move your funds.

Model	Firmware	Randomness	Real-world risk
Coldcard Mk2 / Mk3	~4.0.x–4.1.9	Collapsed to ~40 bits	Actively exploited; this is where the theft happened
Coldcard Mk4 / Mk5 / Q	before the fixed releases	~72 bits (vs an intended 128)	No thefts here yet, but Block warns a targeted attacker could cut it to ~2³²; migrate anyway
Any Coldcard	fixed firmware onward	Full hardware randomness restored	Not affected, but a seed made on old firmware stays weak

The single most important thing to understand: updating the firmware does not fix a seed that was already generated. The patched firmware (released within about two days of the first attack) makes new seeds safe, but any wallet created on the vulnerable versions is permanently compromised. Coinkite's guidance, and ours, is blunt: if you generated your seed on an affected device, treat those funds as exposed, set up a fresh wallet with new randomness, and move your Bitcoin to it now. Do not wait to see whether you are among the addresses already hit.

How much was really stolen?

Be careful with the number, because it is the softest fact in the story. There is no official tally; every figure traces to on-chain estimates from Galaxy Research, it is denominated in Bitcoin so the dollar value drifts with the price, and it has been climbing for days as more sweeps are mapped.

What can be said honestly is the trajectory. An early count on 31 July put the loss near $38 million, a partial tally that Galaxy later revised up to the roughly $70 million first wave described above as more of the stolen addresses were mapped. By 2 August, Galaxy's mapping of three waves reached roughly 1,367 BTC, about $88 million, across 4,585 wallets (it ties the first two waves to a likely shared operator but cautions the third may be a different attacker). It kept climbing: by 8 August Galaxy had confirmed about 1,719 BTC, roughly $111 million, and projected the total would exceed $130 million, while TRM Labs counted around 1,816 BTC (about $116 million) moved from more than 5,200 addresses. Whatever the final total, it is already one of the largest thefts from self-custodied Bitcoin on record.

One detail stands out: as of early August the stolen coins were sitting unspent in a handful of attacker-controlled addresses, not yet laundered. Galaxy offered two guesses, that the thief is waiting out the scrutiny, or cannot quietly move a sum this visible, but no perpetrator has been identified, and claims that the sweep was "orchestrated by an AI" remain speculation, not established fact.

Does this kill self-custody?

This is where the honest answer resists the easy headline. Predictably, some in the industry reached for one. CoinDesk reported that the episode "shakes faith in self-custody" and could push investors toward regulated products, quoting ARK Invest's Lorenzo Valente ("you are better off today holding funds across several publicly-traded exchanges or ETFs") and citing the view, voiced by Amicus co-founder David Lawrence, that some holders may now feel "safer to just buy IBIT". It is a real argument, and worth hearing.

But it proves less than it claims. What this failure actually shows is that self-custody does not remove risk, it swaps one kind of risk for another. Hand your Bitcoin to an exchange or an ETF and you take on counterparty risk: the risk that the custodian is hacked, goes bankrupt, freezes withdrawals or is compelled by a government. Hold it yourself on a hardware wallet and you shed all of that, but you take on firmware and supply-chain-integrity risk: the risk that the device you trusted has a flaw you cannot see. Both are real. Neither is zero. The Coldcard hack is not proof that one model beat the other; it is proof that the self-custody risk most people never think about, the correctness of the code inside a sealed box, is not theoretical.

The grown-up lessons are duller than "buy an ETF" or "hardware wallets are a scam", and more useful. Diversify how you hold. Treat open, auditable firmware as necessary but not sufficient: Coldcard's code was open and heavily reviewed, and this flaw still sat in it for five years, so openness shortens the tail rather than removing the risk. The measure that actually defends against a single-vendor bug is a multisignature setup that spreads trust across more than one device and, crucially, more than one vendor, so no single flaw can drain everything. And the disclose-and-patch part of the process did work once the theft was visible on-chain: researchers found the flaw, disclosed it, and patched it in days. But the part whose job was to stop such a bug shipping, and to catch it before wallets were drained, plainly did not, and it failed for five years.

If you are setting up self-custody now, read our guide to the best crypto wallet of 2026 and how to buy and hold crypto safely. For more, see the Crypto section.