Hackers target Bitcoin’s safest hiding place in ongoing Coldcard attack
Coldcard is a brand of hardware device that allows users to secure their Bitcoin in so-called cold wallets.
Hackers have discovered a software flaw in Coldcard wallets, a type of Bitcoin cold wallet considered highly secure, and are stealing tens of millions of dollars in an ongoing assault. Coinkite, the Canadian company that manufactured Coldcard devices, alerted users on July 28 that the security flaw in the keys protecting their cryptocurrency had compromised certain wallets.
By August 3, roughly 1,367 bitcoins, worth about US$86 million, had been stolen from more than 4,500 wallets, according to Galaxy Research. Coldcard devices are supposed to be the safest place to store cryptocurrency as they are offline. However, a flaw in the software meant that the "seed phrase" - a long string of words needed to access a wallet - was predictable.
This exposed the flaw in the underlying math, allowing the passwords to be reverse-engineered. One victim, Jonathan Goodman, had all three of his wallets drained in a single attack. The core issue was with Coinkite's implementation of the random-number generator when generating the phrases. True randomness is crucial for cryptographic security, but Coldcard wallets used a deterministic fallback mechanism, making it possible for attackers to systematically recalculate and drain user wallets.
Coinkite confirmed that funds controlled by seeds generated on affected firmware are at risk, and a fixed firmware is now available for every affected model. While the total number of crypto hacks decreased in 2026 so far compared to 2025, the first half of the year saw total losses at US$972 million, less than half of the US$2.3 billion stolen in the first half of 2025.
However, the number of hacks climbed to 207, the highest recorded in any six-month period. TRM Labs' Ari Redbord said infrastructure and key compromises make up about 15% of incidents but account for 76% of losses. He emphasized that self-custody moves the risk but does not remove it. Goodman, who previously trusted the technology, now questions whether it's worth investing in Bitcoin or using cold wallets.
Written by urgent.news from Straits Times Business's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
