Summary
On July 31, 2026, an attacker reportedly stole approximately 594 Bitcoin, worth around $38 million, from about 500 Coldcard hardware wallets in only 25 minutes. The attack was traced to a firmware vulnerability that caused certain devices to generate wallet seeds with significantly less randomness than intended.
This potentially allowed the attacker to reconstruct private keys without stealing the physical devices, obtaining the users’ seed phrases, or tricking users into approving transactions. Once the correct private keys were identified, the attacker could use them to authorize valid Bitcoin transactions and transfer the assets to another wallet.
The Bitcoin network itself was not compromised. The vulnerability affected how certain Coldcard devices generated the private keys used to control Bitcoin. The incident shows that even an offline hardware wallet can be vulnerable if its underlying software fails to create a secure, unpredictable key.
How Did $38 Million in Bitcoin Disappear?
You buy a hardware wallet to keep your Bitcoin offline.
You write down your seed phrase, store it somewhere safe, and never share it. You avoid suspicious links, ignore unsolicited messages, and keep your device disconnected from the internet.
Then, without anyone stealing your hardware wallet or obtaining your seed phrase, your Bitcoin disappears.
That is reportedly what happened to hundreds of Coldcard hardware wallet users in July 2026. Approximately 594 Bitcoin was removed from around 500 wallets between 01:31 and 01:56 UTC on July 31.
This was not a traditional phishing scam. Users were not necessarily tricked into revealing their seed phrases or approving fraudulent transactions. Instead, a software vulnerability reportedly made certain wallet keys much easier to predict than they should have been.
What Happened to Coldcard Hardware Wallet Users?
Coldcard is a hardware wallet manufactured by Coinkite. Like other hardware wallets, it is designed to generate and store the private keys that control a user’s Bitcoin.
A private key acts like the password that gives someone control over the crypto associated with a wallet. It should be generated from so many possible combinations that guessing it is practically impossible.
According to a technical report from Block’s Bitcoin Engineering and Security teams, certain Coldcard firmware did not use the intended hardware-based random number generator when creating wallet seeds.
Instead, the affected software reportedly relied on a more predictable fallback system based partly on the device’s chip identifier and internal timing information.
This significantly reduced the number of possible seed combinations an attacker might need to test.
In simple terms, the attack reportedly worked like this:
- A firmware error weakened the randomness used to create certain wallet seeds.
- An attacker could test possible seeds against public Bitcoin addresses until a match was found.
- After identifying the correct private keys, the attacker could authorize transactions and move the Bitcoin.
The physical hardware wallets did not need to be stolen. The users did not necessarily need to reveal their seed phrases. The weakness may have been built into the keys from the moment they were created.
Why Did Randomness Matter?
When a hardware wallet creates a seed phrase, it needs a strong source of randomness, also known as entropy.
Think of it like selecting one number from an unimaginably large pool. If the pool is large enough, an attacker could never realistically test every possible number.
The Coldcard vulnerability reportedly made that pool much smaller.
According to Coinkite’s updated security advisory, seeds created on certain affected Mk3 firmware may have contained only around 40 bits of entropy. Seeds created on affected Mk4, Mk5, and Q firmware may have contained around 72 bits instead of the expected 128 bits.
This does not mean every affected wallet could be opened instantly. An attacker would still need to narrow down information about the device, its timing, and how the seed was generated.
However, the reduced randomness may have made it possible for a sophisticated attacker to test enough combinations to eventually find a matching private key.
How Quickly Were the Wallets Drained?
According to CoinDesk’s report on the Coldcard attack, approximately 594 Bitcoin was removed from around 500 single-signature wallets in only 25 minutes.
The attack moved more than 1,300 separate portions of Bitcoin through 500 transactions within three Bitcoin blocks. Approximately 562 Bitcoin was later consolidated into a single address.
Many of the affected wallets had reportedly remained untouched for years.
Because Bitcoin transactions are generally irreversible, there was no central authority that could cancel the transfers once they were completed.
Why Is This Bitcoin Wallet Attack So Concerning?
Most crypto security incidents involve a mistake that users are repeatedly warned to avoid.
Someone might:
- Share a seed phrase
- Download malware
- Connect a wallet to a malicious application
- Approve a fraudulent transaction
- Respond to a fake customer support message
This incident appears to be different.
The affected users may have kept their hardware wallets offline, protected their seed phrases, avoided phishing attempts, and never given an attacker physical access to their devices.
The vulnerability reportedly existed inside the process used to create the private keys.
A hardware wallet can keep a private key offline, but that protection depends on the key being securely and unpredictably generated in the first place. If the original seed is weak, moving it to another device does not make it stronger.
Was Bitcoin Itself Hacked?
No. There is currently no evidence that the Bitcoin network or its underlying cryptography was compromised.
The reported vulnerability affected wallet-level key generation on specific Coldcard devices and firmware versions. Bitcoin continued operating as designed.
The attacker was reportedly able to create valid transactions because the affected private keys could potentially be reconstructed. From the Bitcoin network’s perspective, a transaction authorized with the correct private key is valid.
The incident was therefore not an attack against the Bitcoin blockchain. It was an attack made possible by a vulnerability in a device used to generate and manage Bitcoin keys.
Both Block and Coinkite have described portions of their findings as preliminary, and the investigation remains ongoing.
Hardware Wallets Are Not Automatically Risk-Free
Hardware wallets remain an important crypto storage option when properly designed, maintained, and used. However, this incident highlights some of the potential risks of using a crypto hardware wallet.
When you manage your own crypto wallet, protecting your seed phrase is only part of the responsibility. Your security can also depend on:
- How the seed was generated
- The quality of the device’s firmware
- The manufacturer’s security testing
- The randomness used to create private keys
- How quickly vulnerabilities are identified and corrected
- Your ability to safely update the device and move funds
Self-custody gives you direct control over your crypto, but it can also place significant responsibility on one person, one device, and one seed phrase.
Crypto owners should understand the differences between self-custody, hardware wallets, and institutional crypto storage before choosing how to secure their assets.
Don’t Want to Manage Your Own Crypto Keys?
Self-custody requires you to manage your hardware wallet, private keys, seed phrase, firmware updates, backups, and security procedures.
If you want to buy and sell crypto without personally managing those responsibilities, an iTrustCapital Premium Custody Account offers another approach.
Client assets are held through third-party institutional storage providers, including Coinbase Custody, Fidelity Digital Assets, and Fireblocks. This institutional custody infrastructure uses security technology such as offline cold storage, Multi-Party Computation, and Hardware Security Modules.
With a Premium Custody Account, you do not need to generate, store, or personally secure a private seed phrase. You can buy and sell supported cryptocurrencies through your iTrustCapital account while your assets are secured through third-party institutional storage providers.
Premium Custody Accounts also use iTrustCapital’s closed-loop system. If someone gains access to your account, they cannot automatically send your crypto to an external wallet. Each crypto withdrawal must go through iTrustCapital’s identity and security verification process before it can be completed, adding multiple built-in security layers.
If you do not want the responsibility of personally managing hardware wallets, private keys, and seed phrases, consider opening a Premium Custody Account at iTrustCapital.
Categories:
Disclaimer
This article is for informational purposes only and is not intended to constitute investment or tax advice in any way or constitute an offer to buy or sell any digital asset, cryptocurrency, or security or to participate in any investment strategy.
iTrustCapital is a fintech software platform for alternative assets. TrustCapital is not an exchange, funding portal, custodian, trust company, licensed broker, dealer, broker-dealer, investment advisor, investment manager, or adviser in the United States or elsewhere. iTrustCapital is not affiliated with and does not endorse any particular digital asset, precious metal or investment strategy.
Investing in any digital asset or cryptocurrency (including meme coins) carries significant risks due to their speculative and highly volatile nature. Past performance is not an indication of future results. No investment is completely risk-free, and every investment carries the potential for losing some or all of the principal amount invested. Digital assets and cryptocurrencies are not legal tender backed by the United States government, nor is it subject to Federal Deposit Insurance Corporation (“FDIC”) insurance or protections. Clients do not receive a choice of custody partner.
Investors assume the risk of all purchase and sale decisions. iTrustCapital makes no guarantee or representation regarding investors’ ability to profit from any transaction or the tax implications of any transaction. iTrustCapital does not provide legal, investment or tax advice. Conduct your own research and consult with a qualified legal, investment, or tax professional to assess your own risk tolerance prior to investing.
iTrustCapital makes no representation or warranty as to the accuracy or completeness of this information and does not have any liability for any representations (expressed or implied) or omissions from the information contained herein. iTrustCapital disclaims any and all liability to any party for any direct, indirect, implied, punitive, special, incidental or other consequential damages arising directly or indirectly from any use of this information, which is provided as is, without warranties.
© 2026 ITC2.0, Inc.
All rights reserved.