Coldcard Exploit Leaves $70M in Stolen Bitcoin

A recent exploit targeting Coldcard Mk3 devices has left over $70 million in Bitcoin stolen. The attack, which occurred on July 30, 2026, compromised around 1,196 wallets and highlights a flaw in the random number generation process used by the hardware wallets.

The vulnerability allowed attackers to drain approximately 1,082.65 BTC, worth roughly $70 million at the time of the attack, within just 41 minutes. However, Galaxy Research later revised this figure to around 594 BTC, or approximately $38M, across roughly 500 addresses.

Coldcard manufacturer Coinkite acknowledged the issue and released a patched firmware version, but noted that updating firmware alone does not fix the problem. Affected users must generate new seeds on patched hardware and move their assets to those new addresses before considering themselves safe.