Security Vulnerability and Incident Overview
A critical security vulnerability in Coldcard hardware wallets has resulted in the theft of approximately 594 Bitcoin, valued at roughly $38 to $40 million. The exploit, which occurred on July 31, 2026, targeted nearly 500 single-signature wallets in a rapid, coordinated attack lasting approximately 25 minutes. Security researchers at Block, the fintech firm founded by Jack Dorsey, identified that the attackers successfully drained these wallets by exploiting a predictable software-based key generation flaw.
Coldcard, a Bitcoin-only hardware wallet manufactured by the Canada-based company Coinkite, is marketed for its offline private key storage and dual secure element architecture. However, investigators discovered that affected firmware versions—dating back to March 2021—utilized insufficient entropy for seed generation, relying on predictable chip data rather than a robust randomness generator. This fundamental weakness allowed unauthorized actors to reconstruct private keys.
Impacted Devices and Mitigation
Coinkite has issued an urgent warning to users, confirming that updating the device firmware is insufficient to secure existing wallets. The flaw resides in the initial seed generation process; therefore, a firmware patch cannot retroactively protect a compromised key. The vulnerability affects multiple models: the Mk3 (version 4.0.1 and subsequent versions), as well as Mk4, Mk5, and Q devices running firmware prior to specific security updates (version 5.6.0 for Mk4/Mk5; 1.5.0Q for Q models).
“Updating the firmware does not repair a seed that was generated by affected firmware,” Coinkite developers stated in a blog post. “A new seed must be generated and the funds migrated to the new wallet.” The company advises users to proceed with extreme caution, verifying every step during the migration process to ensure funds are transferred to a secure, newly generated address.
Broader Market and Security Implications
The incident has triggered significant concern regarding the security of hardware wallets, which are widely considered the gold standard for self-custody. On-chain analysts have observed that approximately 562 BTC from the stolen funds have been consolidated into a single address, though these funds have not yet moved further. The breach has also sparked fears of increased Bitcoin price volatility, as market participants worry that the exposure of such a fundamental security flaw could undermine investor confidence.
Furthermore, industry experts are raising alarms about the role of artificial intelligence in accelerating such exploits. Pseudonymous analysts and figures within the Bitcoin community have suggested that the public availability of frontier large language models (LLMs) may enable malicious actors to identify and weaponize software vulnerabilities with unprecedented speed. As the investigation continues, the focus remains on the race between security researchers and sophisticated hacking teams seeking to exploit the remaining vulnerable seeds.