Coldcard Wallets Hit by Massive Security Breach, 594 BTC Drained

A massive security breach has affected around 500 Coldcard-generated wallets, resulting in the loss of approximately 594 BTC (worth about $38 million) over a period of under 30 minutes on July 31, 2026.

The attack was made possible due to a flaw in the Coldcard firmware version 4.0.0, which instructed devices to skip their own hardware randomness generator during seed creation. This resulted in seeds being generated with only 72 bits of strength instead of the intended 128 bits, making them vulnerable to guessing.

The attack exploited this weakness, draining coins from wallets that had been created between 2021 and 2026. Notably, many of the affected wallets were dormant for years, and the attacker appears to have filtered by value before spending effort on smaller balances.

Coldcard has released a security advisory warning users who generated seeds on Mk3 devices running firmware 4.0.1 or later that their funds may be at risk. The company also notes that Mk4, Q, and Mk5 devices appear to be unaffected so far.