Coldcard Hardware Wallet Vulnerability Leads to Theft of Up to $70 Million in Bitcoin

Jul 31, 2026

A critical firmware vulnerability in Coinkite's Coldcard hardware wallets has led to the theft of approximately $70 million in Bitcoin, with over 1,082 BTC drained from nearly 1,200 addresses. The bug, tracing back to March 2021, caused devices to generate predictable wallet seeds using software-based randomness. Coinkite has urged users to migrate funds to newly generated seeds. The incident has reignited debates over self-custody, with Binance co-founder Changpeng Zhao warning that no hardware wallet is entirely safe.

Coldcard hardware wallet exploit

▪The Coldcard vulnerability, introduced in firmware version 4.0.0 in March 2021, caused devices to generate wallet seeds using a predictable software-based random number generator instead of secure hardware randomness.
▪A firmware vulnerability in Coinkite's Coldcard hardware wallets led to the theft of approximately $70 million in Bitcoin.
▪An attacker drained 1,082.65 Bitcoin from 1,196 addresses, with the majority of funds moved between 01:10 and 01:50 UTC on July 30, 2026.
▪Coinkite advised affected users to generate a new seed on an updated device and migrate their funds, noting that updating the firmware alone does not repair an already compromised seed.

Changpeng Zhao security warnings

▪Changpeng Zhao recommended that cryptocurrency users spread their assets across multiple wallets as a risk mitigation strategy.
▪Binance co-founder and former CEO Changpeng Zhao cautioned that no security measure is infallible and even hardware wallets can contain bugs or vulnerabilities.

Multi-wallet risk mitigation strategies

▪Managing a multi-wallet strategy requires users to track multiple recovery phrases, update firmware on each device, and remain vigilant against social engineering.
▪Distributing cryptocurrency assets across multiple wallets reduces the impact of a single point of failure but increases the attack surface for phishing and human error.

Hardware wallet vulnerability history

▪Blockchain security firm Blockaid reported that most cryptocurrency losses in the first half of 2026 originated from compromised keys and operational security failures rather than smart contract hacks.
▪The Ledger Connect Kit attack in 2023 demonstrated that trusted hardware wallet brands can be compromised by security exploits.