The most damaging crypto theft of 2026 did not involve a phishing link, a compromised admin key, a malicious contract approval, or a single user error.

It involved a build configuration flag.

Starting 30 July 2026, attackers began systematically emptying Bitcoin wallets created on Coinkite’s Coldcard hardware devices. The first wave took roughly 1,083 BTC — about $70.2 million — from 1,196 addresses in a 41-minute window, approximately 30 hours before Coinkite publicly disclosed the underlying flaw. Across three confirmed waves, the total reached roughly 1,816 BTC, over $116 million, from more than 5,200 addresses.

The victims had followed the advice the industry has repeated for a decade. They bought a reputable hardware wallet. They generated their seed on the device, offline. They wrote it on paper, never typed it into a computer, never photographed it. They held their own keys.

It didn’t matter. The keys were guessable from the moment they were created.

The Bug: 128 Bits of Security That Weren’t

A Bitcoin private key’s security rests on a single assumption: that the number was chosen unpredictably from a space so large that guessing is infeasible. A standard 12-word BIP-39 seed carries 128 bits of entropy — around 3.4 × 10³⁸ possibilities. Brute-forcing that is not slow; it is physically impossible with any conceivable hardware.

Coldcard was designed to meet that bar properly. The STM32 microcontroller at its core includes a hardware true random number generator (TRNG) — a circuit that derives randomness from physical processes rather than from an algorithm. That’s the right architecture, and it’s part of why the device earned its security-first reputation.

In March 2021, a firmware migration changed which code path seed generation actually used. Due to a build configuration error, the seed generation routine fell back to MicroPython’s software pseudorandom number generator instead of the hardware TRNG.

This is the entire failure. Everything downstream follows mechanically.

A pseudorandom number generator is deterministic by definition. Given the same internal state, it produces the same output sequence, every time. Its unpredictability is entirely a function of how the state was seeded — and on an embedded device booting into a known configuration, that state space is dramatically smaller than the output it produces.

The practical result across affected firmware versions (4.0.1 through 4.1.9): effective seed entropy collapsed from the designed 128 bits to approximately 40 bits on older models.

Forty bits is roughly one trillion possibilities. That sounds like a lot. It is not. A trillion-key search space is comfortably within reach of commodity GPU hardware — the kind of computation that runs in hours to days on rented cloud capacity, for a few thousand dollars. Against a target set worth $116 million.

And critically: the attack requires no physical access to the device. The attacker never touches your Coldcard. They generate candidate seeds, derive the addresses those seeds would produce, and scan the public Bitcoin blockchain for any of those addresses holding a balance. The blockchain’s transparency — normally a feature — becomes the attacker’s free targeting database.

Why the Timing Matters

The disclosure sequence is the part the industry should study hardest.

The first drain wave — 1,196 addresses, $70.2 million, 41 minutes — executed roughly 30 hours before Coinkite’s public advisory. The attackers were not reacting to a disclosure. They found the flaw independently, prepared their target list against the full historical blockchain state, and executed against thousands of addresses simultaneously.

That ordering has an uncomfortable implication for every future hardware vulnerability. When a flaw allows offline precomputation against public blockchain data, there is no meaningful window in which defenders can act first. Responsible disclosure assumes a race between vendor patch and attacker weaponisation. Here the weaponisation was already complete, and no patch can retroactively add entropy to a seed generated in 2022.

The vulnerability was un-patchable for anyone already affected. Firmware updates protect seeds generated after the update. They cannot fix a key that was already weak when it was written on a steel plate three years ago. The only remediation is to move every satoshi to a new wallet generated on non-affected hardware — which requires knowing you were affected, and acting before the attacker’s brute-force loop reaches your address.

The Assumption That Broke

Self-custody guidance has been built around a threat model with a clear shape: the danger is exposure. Keys leak because they touch an internet-connected machine, get photographed, get typed into a phishing site, or get extracted by malware. Cold storage answers that threat model by eliminating exposure — air-gapped generation, air-gapped signing, nothing sensitive ever meets a network.

The Coldcard flaw sits entirely outside that model. Nothing leaked. Nothing was exposed. The air gap held perfectly, and it was irrelevant, because the key was weak at birth.

This reframes what “trusting a hardware wallet” actually means. Users evaluate hardware wallets on the properties they can observe — secure element, open-source firmware, air-gapped operation, tamper-evident packaging, reputation. None of those observable properties tell you whether the entropy source works. You cannot audit the randomness of a number you have been given. A weak seed and a strong seed look identical: twelve English words.

It is, in the strictest sense, an unverifiable trust assumption. The industry has been resting a hundred billion dollars of self-custodied value on it while telling users that self-custody removes trust.

The Broader Signal

Follow-on analysis has been sobering. Security researchers running automated audits across the Bitcoin tooling ecosystem in the wake of the disclosure reported dozens of additional critical-severity findings across wallet and infrastructure codebases — a reminder that the Coldcard bug is a class of failure, not a unique event.

Entropy failures have a long and consistent history: the 2008 Debian OpenSSL disaster, Android’s SecureRandom flaw in 2013 that cost Bitcoin users their coins, embedded devices shipping duplicate RSA keys. Every one of them followed the same pattern — a change that looked innocuous, in a component nobody re-audits, producing output that appears random and isn’t, discovered years later.

Randomness is the hardest property in applied cryptography to test for, because the failure mode is invisible. Broken encryption throws errors. Broken randomness produces perfectly valid, perfectly functional, perfectly guessable keys.

What To Do Now

If you have ever generated a seed on a Coldcard:

Treat it as compromised if it was created between the March 2021 firmware release and the patched version — practically, any seed generated on firmware 4.0.1 through 4.1.9. Verify your firmware history against Coinkite’s advisory rather than relying on memory.

If in any doubt: generate a fresh seed on unaffected hardware and move the funds. Do it now, not after further research. The cost of an unnecessary migration is a transaction fee. The cost of a delayed one is everything.

Note that a passphrase (BIP-39 25th word) on top of an affected seed materially raises the attacker’s cost — it adds entropy outside the compromised generator. If you used a strong passphrase, you are in a substantially better position, but the underlying seed is still weak and should still be retired.

If you self-custody on any hardware wallet:

  • Verify entropy independently where the option exists. Some devices support dice-roll or coin-flip seed entry, letting you supply randomness the firmware cannot silently replace. It is tedious. It is also the only method that removes the unverifiable trust assumption entirely.
  • Diversify vendors across large holdings. A single-vendor failure taking 100% of your Bitcoin is a concentration risk you can eliminate for the price of a second device.
  • Consider multisig for significant amounts. A 2-of-3 across devices from different manufacturers means an entropy failure at one vendor costs you one key, not your coins. This is the strongest available structural answer to exactly this class of failure.
  • Subscribe to your vendor’s security advisories directly. The Coldcard victims who were watching the disclosure channel still lost the race — but 30 hours of warning beats reading about it in the press.

The lesson isn’t that hardware wallets are bad, or that self-custody is a mistake. It’s narrower and more useful: self-custody moves trust; it does not eliminate it. You stop trusting an exchange and start trusting a firmware build pipeline. The second trust relationship is smaller and better aligned with your interests — but it is still a trust relationship, and in March 2021 it quietly failed.

Multisig across vendors, and user-supplied entropy where available, are the two mitigations that actually address the failure that happened. Both were available before 30 July. Very few people were using them.

Sources: Fortune · TRM Labs · The Hacker News · BleepingComputer · TechCrunch · Forbes