Coldcard Wallets Hacked for $100M in Bitcoin

Coldcard wallets, designed to store cryptocurrencies securely offline, have been compromised in a massive cyberattack. More than $100 million worth of Bitcoin has been stolen from over 7,300 addresses using a software flaw that allowed hackers to reconstruct users' access keys.

The vulnerability existed since March 2021 and was revealed by Coinkite, the manufacturer of Coldcard wallets, on July 30, 2026. The company also warned about a critical bug in its firmware that generated keys in a pseudo-random manner, making them susceptible to brute force attacks or reverse engineering.

Galaxy Research analysis pointed to three confirmed waves of attacks, with a possible fourth wave pending verification. If the total losses reach $130 million, it would be one of the largest cryptocurrency heists on record.