Coldcard hardware wallet exploit drives July crypto losses to $247 million

A firmware vulnerability in Coinkite's Coldcard hardware wallets allowed hackers to steal over $100 million in Bitcoin, with total losses estimated to reach $130 million. The flaw, dating back to March 2021, produced predictable seed phrases that attackers brute-forced. This exploit drove July 2026 cryptocurrency thefts to $247.4 million, making it the year's second-worst month for security losses. Meanwhile, payment platform Coinsbuy suffered a separate $7.9 million hack on August 9, 2026, but covered all client losses from its reserves.

Coldcard hardware wallet exploit

• ▪Galaxy Research identified 1,596 bitcoin, valued at approximately $102 million, stolen from over 7,300 wallets across three confirmed waves and 14 smaller incidents targeting Coldcard hardware wallets.
• ▪Approximately 600 of the hacked Coldcard wallet addresses belonged to federal investigators, industry compliance firms, and cyber investigators, according to Galaxy Research.
• ▪Galaxy Research estimated that total losses from the Coldcard hardware wallet exploit could reach approximately 2,000 bitcoin, or roughly $130 million, when including suspected losses.
• ▪At least a dozen different hackers are targeting Bitcoin owners who use the Coldcard hardware crypto wallet made by Coinkite, according to Galaxy Research.

Firmware seed generation flaw

• ▪A firmware flaw in Coinkite's Coldcard hardware wallets dating back to March 2021 produced seed phrases with less randomness than advertised, allowing hackers to guess and drain the wallets.
• ▪Security researchers at Block identified the Coldcard vulnerability as a predictable random number generator fallback and 32-bit reseed in the device's firmware.
• ▪Coinkite confirmed the firmware bug, released a fix, and warned that updating the firmware would not repair compromised seeds, advising users to migrate funds to newly generated wallets.

July 2026 crypto theft totals

• ▪Other notable July 2026 exploits included a $9 million hack of Bonzo Lend, $2.6 million stolen from SecondFi, $24 million from AFX, and $7.5 million from the Verus Ethereum Bridge.
• ▪TRM Labs recorded 207 cryptocurrency hacks in the first half of 2026, representing more than double the 83 incidents reported during the same period in 2025.
• ▪Cryptocurrency thefts in July 2026 totaled $247.4 million, making it the second-worst month of 2026 behind April's $644 million in losses, according to DefiLlama data.

Coinsbuy platform hack

• ▪Coinsbuy temporarily paused deposits and withdrawals following the August 9, 2026 attack, later resuming services and fully covering all affected client funds from its own reserves.
• ▪The cryptocurrency payments platform Coinsbuy suffered a reported $7.9 million hack on August 9, 2026, resulting in unauthorized withdrawals across Ethereum and Tron wallets.
• ▪Coinsbuy announced a $100,000 reward for information leading to the identification of those responsible for the August 9, 2026 hack.

Cold storage security risks

• ▪The Coldcard exploit demonstrated that offline cold storage does not eliminate technological risks, as a single vulnerability in offline hardware code can compromise thousands of wallets simultaneously.
• ▪Bitcoin investor Jonathan Goodman reported losing $1.6 million from his Coldcard wallet despite keeping his seed phrase offline in multiple physical safes and safety deposit boxes.