Coldcard Bitcoin Heist Could Swell to $130M as Attackers Keep Draining Wallets - CaptainAltcoin
Coldcard has long been considered one of the most secure Bitcoin hardware wallets, marketed as the choice for users who “knew what they were doing” and kept significant savings in self‑custody. On July 30, 2026, that reputation shattered when an unknown party drained nearly 1,200 addresses without touching a single device. The vulnerability traces back […]
Home»Journal»Coldcard Bitcoin Heist Could Swell to $130M as Attackers Keep Draining Wallets –Coldcard has long been considered one of the most secureBitcoin hardware wallets, marketed as the choice for users who “knew what they were doing” and kept significant savings in self‑custody. On July 30, 2026, that reputation shattered when an unknown party drained nearly 1,200 addresses without touching a single device. The vulnerability traces back to a March 2021 firmware build. While integrating a new cryptographic library, Coldcard accidentally routed seed generation to a predictable software randomizer instead of the chip’s hardware random number generator. The hardware RNG remained active elsewhere in the firmware, allowing internal reviews to confirm its presence without revealing that wallet creation had switched to a different entropy source. On Mk2 and Mk3 devices, this left wallets with roughly40 bits of entropy– trivially brute‑forceable. Even newer Mk4, Mk5 and Q devices were left with only about 72 bits. Three Confirmed Waves – And CountingGalaxy Research has confirmed1,596 BTCstolen from approximately7,300 addressesacross three distinct attack waves and 14 smaller security incidents. The first wave was the most dramatic:1,083 BTC (about $70 million)drained from 1,196 addresses in a single41‑minute windowon July 30. Every transaction used the same hardcoded fee rate and produced no change output; a clear sign of automated sweeping by an attacker who already controlled the keys. Coldcard's stolen-coin overhang can still grow while holders scramble to migrate, so near-term BTC flow risk stays bearish. Galaxy's high-confidence estimate is 1,596 BTC across ~7. 3k addresses… a suspected fourth wave would lift its modeled ceiling to 2,055 BTC, about $130m. …— aixbt (@aixbt_agent)August 4, 2026A second and third wave followed over the weekend. Galaxy Research flagged the third wave early Sunday, with roughly208 BTCdrained from 1,912 addresses. By then, observed losses had reached1,367 BTCfrom 4,585 addresses. The Fourth Wave ThreatA suspected fourth wave of coordinated attacks may already be underway. Galaxy Head of Research Alex Thorn flagged the potential wave on August 3, noting transaction patterns that closely matched the earlier attacks. If confirmed, the total could rise to approximately2,055 BTC, worth nearly$130 million. The suspected fourth wave has reportedly moved448. 7 BTCfrom 709 potential victim addresses. The transactions are using Bitcoin’s replace‑by‑fee feature, meaning victims who spot their coins in the mempool may still be able to outbid the attacker and move their funds first. The attackers are evolving their tactics. The first wave used shared collector addresses, making the theft easy to map. By the third wave, each victim’s coins were sent to its own destination, parked in more complex output formats. The pattern suggests a single operator in each wave, though the blockchain cannot determine whether the same attacker is behind all three. Galaxy believes at least15 attackersexploited the vulnerability, meaning stolen BTC may hit the market in scattered bursts that are harder to track. Migration Risk and Phishing ScamsThe stolen‑coin overhang can still grow while Coldcard holders scramble to migrate. Galaxy’s estimate excludes the suspected fourth wave, and fresh migration drains could expand the attacker inventory that can hit the market. Compounding the problem, spoofed “hardware audit” emails are steering holders to cloned sites that install remote‑access software. What Coldcard Users Should DoColdcard has released emergency firmware updates for all affected models. Users who generated a seed on vulnerable firmware should immediately move funds to a wallet with a fresh seed on a secure device. Coinkite has also destroyed remaining vulnerable inventory. Galaxy has been cooperating with U. S. federal law enforcement agencies, exchanges, and cyber investigation groups by providing confirmed attacker and victim addresses. Approximately90% of the stolen Bitcoin remains unmoved, though that could change at any time. For more crypto news and price predictions from CaptainAltcoin,click here. Subscribe toour YouTube channelfor daily crypto updates, market insights, and expert analysis.