Hackers have found a software flaw in Coldcard, a popular hardware Bitcoin wallet that is designed to keep cryptocurrency offline in "cold storage," and are stealing millions of dollars in an ongoing attack.
Coinkite Inc., the Canada-based company behind Coldcard wallets, warned users late last week that a security flaw had compromised some wallets. By Monday, hackers had stolen about 1,367 Bitcoin worth nearly $86 million from more than 4,500 wallets, according to Galaxy Research.
How the coldcard wallet hack happened
Coldcard devices are hardware wallets that store Bitcoin in cold wallets, which are considered one of the safest ways to protect cryptocurrency because they remain disconnected from the internet, according to Bloomberg.
Despite being offline, the wallets became vulnerable because of a flaw in the software used to generate the wallet's "seed phrase"—the secret list of words needed to access Bitcoin holdings, according to Block Inc.'s engineering team. Block's engineers found that the generated seed phrases were predictable, making it possible for attackers to recreate users' private keys and gain access to their Bitcoin.
The issue was linked to how Coinkite implemented its random-number generator while creating seed phrases, according to Block. Normally, cryptographic security depends on true randomness, but the affected Coldcard firmware included a backup system that created keys using deterministic values, such as the device's serial number. Because those values could be predicted, attackers were able to systematically recalculate users' wallet keys and empty their Bitcoin wallets.
{{/usCountry}}The issue was linked to how Coinkite implemented its random-number generator while creating seed phrases, according to Block. Normally, cryptographic security depends on true randomness, but the affected Coldcard firmware included a backup system that created keys using deterministic values, such as the device's serial number. Because those values could be predicted, attackers were able to systematically recalculate users' wallet keys and empty their Bitcoin wallets.
{{/usCountry}}Also read: Warren Buffett says most investors should buy an S&P 500 ETF. Here’s why he recommends it
Experts explain the security flaw
Cybersecurity experts said the incident proves that simply keeping cryptocurrency offline does not guarantee safety if the software generating the keys is flawed. "It exposes the fallacy of your crypto being offline," said Aneirin Flynn, chief executive officer of cybersecurity technology firm Failsafe, according to Bloomberg.
"The device is just responsible for generating your passwords, and if the underlying math is broken then your passwords can be reverse-engineered." Flynn added, via Bloomberg.
Many users initially believed the warning would not affect them because their wallets had never been connected to the internet. One victim, Jonathan Goodman, said he checked his wallet after hearing about the hack and quickly realized his Bitcoin had disappeared, according to Bloomberg.
"The moment it loaded I knew I was screwed because I saw red lines for withdrawals," said Goodman. "Between 9:36 and 9:43 p.m. on July 29th, all three of my wallets were completely drained." Goodman added, according to Bloomberg.
Goodman also said, "$1.6 million dollars in Bitcoin was drained from my account on July 29th in the Cold Card wallet hack." He further said: "My Bitcoin was in cold storage. My keys were on a ColdCard device kept in a safety deposit box that had never been connected to the internet." According to Bloomberg.
Coinkite releases a fix
The attack grew rapidly over just a few days. Initial reports on Friday estimated losses at around $38 million, but the amount increased to about $86 million by Monday. In a statement posted on its website, Coinkite confirmed that funds controlled by seeds generated on the affected firmware are at risk.
The company also said it has released fixed firmware for every affected Coldcard model and software release to address the vulnerability, according to Bloomberg. The hack has triggered widespread discussion across the cryptocurrency community, with influencers, security experts and company executives debating what it means for hardware wallet security.
Even though crypto theft overall has slowed this year, hackers are still carrying out a record number of attacks. In the first half of 2026, total cryptocurrency losses reached $972 million, which is less than half of the $2.3 billion stolen during the first half of 2025, according to a TRM Labs report.
However, the number of crypto hacks rose to 207 incidents during the first six months of 2026—the highest number ever recorded for any six-month period, according to the TRM Labs report.