Coldcard Wallets Hit by $100M Theft as Flaw Exposed

The theft targeting vulnerable Coldcard-generated Bitcoin wallets has surpassed $100 million in losses, according to blockchain researchers. The attack, which was first detected on July 30, 2026, has seen three coordinated attack waves and 14 smaller incidents drain about 1,596 bitcoin from roughly 7,300 addresses.

Galaxy Research said the thefts stem from a flaw in Coldcard's seed-generation process that weakened the randomness used to create wallet recovery phrases. This allowed attackers to reconstruct private keys without compromising the hardware devices themselves.

The firm has 'high confidence' in the confirmed losses, and estimates suggest a suspected 4th wave could lift total stolen funds to about 2,055 bitcoin, or roughly $130 million.