Coldcard has long been considered one of the most secure Bitcoin hardware wallets, marketed as the choice for users who “knew what they were doing” and kept significant savings in self‑custody. On July 30, 2026, that reputation shattered when an unknown party drained nearly 1,200 addresses without touching a single device.
The vulnerability traces back to a March 2021 firmware build. While integrating a new cryptographic library, Coldcard accidentally routed seed generation to a predictable software randomizer instead of the chip’s hardware random number generator.
The hardware RNG remained active elsewhere in the firmware, allowing internal reviews to confirm its presence without revealing that wallet creation had switched to a different entropy source.
On Mk2 and Mk3 devices, this left wallets with roughly 40 bits of entropy – trivially brute‑forceable. Even newer Mk4, Mk5 and Q devices were left with only about 72 bits.
What you'll learn 👉
Three Confirmed Waves – And Counting
Galaxy Research has confirmed 1,596 BTC stolen from approximately 7,300 addresses across three distinct attack waves and 14 smaller security incidents.
The first wave was the most dramatic: 1,083 BTC (about $70 million) drained from 1,196 addresses in a single 41‑minute window on July 30. Every transaction used the same hardcoded fee rate and produced no change output; a clear sign of automated sweeping by an attacker who already controlled the keys.
Coldcard's stolen-coin overhang can still grow while holders scramble to migrate, so near-term BTC flow risk stays bearish. Galaxy's high-confidence estimate is 1,596 BTC across ~7.3k addresses… a suspected fourth wave would lift its modeled ceiling to 2,055 BTC, about $130m.…
— aixbt (@aixbt_agent) August 4, 2026
A second and third wave followed over the weekend. Galaxy Research flagged the third wave early Sunday, with roughly 208 BTC drained from 1,912 addresses. By then, observed losses had reached 1,367 BTC from 4,585 addresses.
The Fourth Wave Threat
A suspected fourth wave of coordinated attacks may already be underway. Galaxy Head of Research Alex Thorn flagged the potential wave on August 3, noting transaction patterns that closely matched the earlier attacks. If confirmed, the total could rise to approximately 2,055 BTC, worth nearly $130 million.
The suspected fourth wave has reportedly moved 448.7 BTC from 709 potential victim addresses. The transactions are using Bitcoin’s replace‑by‑fee feature, meaning victims who spot their coins in the mempool may still be able to outbid the attacker and move their funds first.
The attackers are evolving their tactics. The first wave used shared collector addresses, making the theft easy to map. By the third wave, each victim’s coins were sent to its own destination, parked in more complex output formats. The pattern suggests a single operator in each wave, though the blockchain cannot determine whether the same attacker is behind all three.
Galaxy believes at least 15 attackers exploited the vulnerability, meaning stolen BTC may hit the market in scattered bursts that are harder to track.
Migration Risk and Phishing Scams
The stolen‑coin overhang can still grow while Coldcard holders scramble to migrate. Galaxy’s estimate excludes the suspected fourth wave, and fresh migration drains could expand the attacker inventory that can hit the market.
Compounding the problem, spoofed “hardware audit” emails are steering holders to cloned sites that install remote‑access software.
What Coldcard Users Should Do
Coldcard has released emergency firmware updates for all affected models. Users who generated a seed on vulnerable firmware should immediately move funds to a wallet with a fresh seed on a secure device. Coinkite has also destroyed remaining vulnerable inventory.
Galaxy has been cooperating with U.S. federal law enforcement agencies, exchanges, and cyber investigation groups by providing confirmed attacker and victim addresses. Approximately 90% of the stolen Bitcoin remains unmoved, though that could change at any time.
For more crypto news and price predictions from CaptainAltcoin, click here.
Subscribe to our YouTube channel for daily crypto updates, market insights, and expert analysis.
