Coldcard hardware-wallet flaw lets attackers guess seed phrases, with losses above $115 million
July 31, 2026 (July 31 to mid-August 2026)
Starting July 31, attackers began draining bitcoin from wallets created on Coldcard Mk3 devices. Galaxy Research estimates losses above $115 million, possibly over $130 million, says it has spoken with more than 200 victims, and believes at least 15 separate attackers were exploiting the flaw. Coinkite, the maker, said a firmware bug present since version 4.0.1 in March 2021 made the device fall back to weaker software-generated randomness when creating seeds, which let attackers guess recovery phrases. Coinkite said the bug went unnoticed for years and urged users to update or move their funds off the device.
Why it matters
A flaw in seed generation puts every affected wallet at risk no matter how carefully its owner stored the recovery phrase. The loss estimate comes from Galaxy Research and was still rising.
What defenders can take from it
- If you use a Coldcard Mk3, follow the maker's instructions and move funds to a wallet created with updated firmware.
- Hardware vendors should test that random-number generation really uses the hardware source on every release.