Coldcard Hardware Wallet Vulnerability Leads to Theft of Up to $70 Million in Bitcoin

A critical firmware vulnerability in Coinkite's Coldcard hardware wallets has led to the theft of approximately $70 million in Bitcoin from 1,196 addresses. The flaw, introduced in March 2021, bypassed hardware-based randomness in favor of a predictable software generator, allowing attackers to reconstruct private keys offline. Coinkite released emergency firmware updates, but users must generate entirely new seeds to secure their funds. The incident has reignited debates over self-custody, with Binance co-founder Changpeng Zhao warning that no hardware wallet is completely safe.

Coldcard hardware wallet exploit

• ▪The Coldcard firmware vulnerability, introduced in March 2021, caused affected devices to generate wallet seeds using a predictable software-based pseudorandom number generator instead of secure hardware randomness.
• ▪An attacker exploited a firmware vulnerability in Coldcard hardware wallets to drain approximately $70 million in Bitcoin from 1,196 addresses on July 30, 2026.
• ▪Coinkite released emergency firmware updates for affected Coldcard models, but installing the updates does not repair or protect existing seeds generated on the vulnerable firmware.

Changpeng Zhao security warnings

• ▪Changpeng Zhao recommended that cryptocurrency users spread their assets across multiple wallets as a risk mitigation strategy to avoid a single point of failure.
• ▪Binance co-founder Changpeng Zhao cautioned that no security measure is infallible and even hardware wallets can contain bugs or vulnerabilities.

Multi-wallet risk mitigation strategies

• ▪Managing a multi-wallet strategy requires users to securely track multiple recovery phrases, update firmware on each device, and remain vigilant against social engineering.
• ▪Distributing cryptocurrency assets across multiple wallets reduces the impact of a single compromise but increases the overall attack surface for phishing and human error.

Hardware wallet vulnerability history

• ▪The Ledger Connect Kit attack in 2023 demonstrated that trusted hardware wallet brands can be compromised through external software integrations.
• ▪In June 2023, Atomic Wallet users lost more than $35 million in cryptocurrency following a major software wallet compromise.