Coldcard $89M Hack: How a Firmware Bug Cracked Bitcoin Cold Wallets in 2026

A five-year-old firmware flaw in Coldcard hardware wallets has enabled one of Bitcoin's largest self-custody attacks on record. Attackers have stolen 1,367 BTC — nearly $89 million at current prices — from 4,585 addresses across three coordinated sweep operations. The attack, first identified by Galaxy Research and Block researcher Clay Garrett, exploited a 2021 coding error that silently routed seed phrase generation to weak software randomness instead of the device's hardware random number generator. Cold wallets sitting in air-gapped safes were just as vulnerable as wallets connected to the internet every day.

How a Single Build Error Opened 4,500 Wallets

The root cause traces to a March 2021 Coldcard firmware release. When Coinkite integrated the libngu cryptographic library, a production build configuration set MICROPY_HW_ENABLE_RNG to zero — because Coinkite supplies its own hardware RNG wrapper for its STM32 microcontroller. The problem: the libngu library only checked whether that macro existed in the build, not whether it was actually enabled. The result was an automatic fallback to MicroPython's Yasmarang pseudorandom number generator (PRNG), a deterministic algorithm seeded only from the chip's unique ID and timer registers.

Unlike a true hardware RNG, which draws entropy from physical electronic noise, the Yasmarang PRNG produces sequences that are fully reproducible if you know the inputs. The inputs — a device's chip UID and clock timing at boot — are not secret. An attacker who knows those values can reconstruct the exact same key generation sequence and enumerate every wallet seed the vulnerable firmware could have produced. On modern hardware, the Hacker News analysis found that key space covers approximately four billion possibilities — an exhaustive search that a well-resourced attacker can complete offline, without ever touching a victim's device.

The methodology is straightforward once the entropy source is broken: generate every candidate seed offline, derive the corresponding Bitcoin addresses, and cross-reference against the public blockchain to identify funded wallets. No phishing, no malware, no device access required. As The Hacker News reported, the attack worked because "practical cost depends on available UID information, boot timing, prior RNG calls and derivation cost" — costs that vary by device model but are achievable.

Three Waves, $89 Million, 41 Minutes

The first attack wave hit on July 30, 2026, between 01:10 and 01:51 UTC. In just 41 minutes spanning six Bitcoin blocks, the attacker swept 1,082.65 BTC — approximately $70.2 million — from 1,196 addresses. The distribution of address types revealed systematic enumeration: 1,183 native SegWit addresses, 7 legacy, and 6 older-standard formats, exactly the output distribution expected from a structured scan of the vulnerable key space. Each wallet averaged roughly 1 BTC.

A second wave followed with additional losses. Then a third wave, spanning Friday through Saturday, targeted 1,912 addresses for 208 BTC. By August 2, CoinDesk reported cumulative losses had reached 1,367 BTC — $88.6 million across 4,585 compromised wallets.

The third wave showed clear tactical evolution. Where the first sweep targeted wallets individually and averaged 1 BTC per victim, wave three batched six victims per transaction and used more complex transaction formats specifically designed to obscure the trail. Average balance per address dropped to approximately 0.1 BTC, indicating the attacker is systematically working down through the vulnerable address pool — large balances first, then smaller ones. Galaxy Research confirmed each wave has the fingerprint of a single operator, though whether one person orchestrated all three sweeps remains unknown.

Which Coldcard Models and Firmware Versions Are Affected

Coinkite has confirmed the vulnerability spans multiple product generations, with The Hacker News and CoinDesk identifying the specific vulnerable ranges:

• Mk2 and Mk3: Firmware versions 4.0.0 through 4.1.9
• Mk4 and Mk5: All firmware before version 5.6.0
• Q model: All firmware before version 1.5.0Q
• Edge builds: Before 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q)

Coinkite has issued specific warnings to Mk3 owners, and Galaxy Research has stated publicly that additional attack waves are expected to continue until affected users move their funds. One critical detail compounds the urgency: there is currently no test that allows a Coldcard owner to determine whether their specific seed phrase falls within the reproducible range. The attack is invisible — affected wallets are indistinguishable from secure ones on-chain.

How Investigators Traced the Attacker

Block researcher Clay Garrett identified a distinctive pattern in the attacker's data access behavior. The operator used a paid commercial blockchain data provider account with what Garrett described as "extraordinary specificity" — query patterns that precisely matched the workflow for enumerating Coldcard-derived addresses at scale. The provider's access logs have been shared with law enforcement.

The attack left no traditional forensic trace on victim devices. No malware was deployed. No social engineering occurred. No transaction was sent to the victim before the theft. The attacker's only interaction with the Bitcoin network was the outbound sweep transaction itself — a single signed transaction draining funds from addresses the attacker had pre-identified through offline key enumeration. By the time a victim might notice, the transaction was already confirmed in a block.

What Affected Coldcard Users Must Do Right Now

Galaxy Research and Coinkite's guidance is unambiguous: move your funds immediately if you generated a wallet on affected firmware. The steps are straightforward, but time-sensitive given the ongoing waves:

1. Check your firmware version under Settings > About on your Coldcard device.
2. If you are on any affected version, treat your existing seed as potentially compromised — even if your wallet has not been swept yet.
3. Update to a patched firmware version: Mk4/Mk5 to 5.6.0 or later, Q to 1.5.0Q or later.
4. Generate a new seed phrase on the updated, patched firmware — this produces a seed using the correct hardware RNG.
5. Transfer all funds from your old wallet addresses to new addresses derived from the new seed.

Since no test exists to confirm whether a specific seed is in the vulnerable range, the risk calculus is simple: the cost of moving funds is one transaction fee. The cost of inaction is potentially your entire balance. Wave three's shift to targeting smaller balances suggests the attacker is broadening the sweep — wallets with modest holdings are not safe.

What This Means for Bitcoin Self-Custody

The Coldcard attack is not a failure of the hardware wallet concept — it is a failure of one specific firmware build step that silently disabled a security guarantee for five years. Coinkite's hardware RNG was present and functional. The bug existed in the configuration layer between Coinkite's custom RNG wrapper and the underlying library, invisible to anyone reviewing the firmware code without specifically testing the build output against the expected entropy source.

This class of vulnerability — where a correct specification is defeated by an invisible implementation detail — is among the hardest for security reviewers to catch. Affected devices passed standard functionality tests. Users experienced no observable errors. The flaw produced no warning in the device UI, no anomaly in transactions, and no detectable difference in wallet behavior. For nearly four years after the vulnerable firmware shipped, the wallets appeared to work exactly as intended.

The incident is likely to accelerate two trends already gaining momentum in 2026. First, multisignature custody setups — which require compromise of multiple independent signing devices — become more attractive when single-device security has a demonstrated failure mode. If an attacker needs to defeat three independent hardware wallets from potentially three different manufacturers running three different firmware codebases, the PRNG flaw in one device is not sufficient. Second, the event adds urgency to calls for reproducible build verification in hardware wallet firmware. Open-source firmware is not enough if users cannot independently verify that the binary running on their device matches the source code — and that the build configuration has not introduced subtle differences.

For Bitcoin holders weighing self-custody against institutional alternatives, this attack is a calibration event rather than a verdict. Hardware wallets remain dramatically more secure than exchange custody on average. The risk profile of leaving Bitcoin on an exchange — counterparty failure, insider fraud, regulatory seizure, exchange hacks — dwarfs the risk profile of a hardware wallet even accounting for this incident. But the Coldcard case establishes that hardware security guarantees have a firmware layer, and that layer can fail silently in ways that take years to surface. Due diligence on firmware versions, update cadence, and seed generation assumptions is not optional. It is the baseline for responsible self-custody.