Coldcard Breach: Over $88M in BTC Stolen from Wallets via Offline Exploit

Coldcard, a leading hardware wallet provider, has suffered a major security breach. An exploit targeting the randomness used to generate recovery seeds in firmware versions 4.0.0 through 5.0.3 allowed attackers to drain approximately 1,367 BTC (worth around $88.6 million to $89 million) from more than 4,500 wallets.

The vulnerability existed since March 2021 and was only recently discovered by Block's security experts. It didn't require internet access to the device, allowing attackers to brute-force seed phrases offline. This compromised the wallet's security premise of keeping keys offline and safe from hackers.

The initial wave of attacks occurred on July 30, 2026, with approximately 594 BTC (around $38 million) being drained in just 25 minutes. By August 2, total losses had climbed to around 1,367 BTC across at least 4,585 addresses. Wallets using multisignature setups remained unaffected.

CoinKite has urged affected users to generate new recovery seeds on updated firmware. However, updating firmware does not retroactively fix seeds that were already generated with weak randomness. Users need a completely new seed on a patched device and must move their funds to wallets derived from the new seed.