Coldcard Wallet Hackers Steal Over $130M in Bitcoin Through Firmware Vulnerability
A major security breach in Coldcard hardware wallets has led to the theft of over $130 million worth of Bitcoin, making it one of the most significant cryptocurrency heists in 2026.
The vulnerability originated from a firmware defect introduced in March 2021, which compromised the randomness of seed phrase generation on impacted devices. This weakness reduced cryptographic key strength from 128 bits to a vulnerable 40 bits, allowing attackers to crack wallets through brute force methods without physical device access.
Galaxy Digital's investigation has verified at least three distinct attack campaigns, successfully draining cryptocurrency from over 7,300 compromised wallets. There are indications of a potential fourth attack wave, which could drive cumulative losses significantly higher.