{
  "id": 1855296,
  "title": "How a hidden flaw in Coldcard wallets led to an $88.6m Bitcoin theft",
  "url": "https://urgent.news/2026/08/19/how-a-hidden-flaw-in-coldcard-wallets-led-to-an-88-6m-bitcoin-theft",
  "topic": "finance",
  "section": "Finance & Markets",
  "published": "2026-08-19T03:00:00.000Z",
  "source": {
    "name": "The National UAE",
    "slug": "the-national-uae",
    "url": "https://www.thenationalnews.com/business/money/2026/08/19/how-a-hidden-flaw-in-coldcard-wallets-led-to-an-886m-bitcoin-theft/"
  },
  "original_language": "en",
  "account": "In March 2021, a flaw in Coldcard hardware wallets caused Bitcoin thefts totaling $88.6 million. The vulnerability caused the wallets to generate private keys using the device's serial number and internal clock, rather than through a secure random number generator. This made the keys easy to predict. In July 2021, an attacker stole 594 Bitcoin from around 500 inactive wallets in just 25 minutes. The theft was later linked to 1,082 Bitcoin across 1,196 addresses. Coinkite, the Canadian company behind Coldcard, has acknowledged the flaw and the resulting theft.",
  "summary": "Coldcard is a hardware wallet aimed at serious Bitcoin users. It only supports Bitcoin, can be kept offline and uses open-source software. It is assembled in Canada and is designed to keep users' Bitcoin secure. But from March 2021, some Coldcard devices generated customers' private keys using the device's serial number and its internal clock, rather than the dedicated chip designed to produce…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The National Business",
        "title": "How a hidden flaw in Coldcard wallets led to an $88.6m Bitcoin theft",
        "url": "https://urgent.news/2026/08/19/how-a-hidden-flaw-in-coldcard-wallets-led-to-an-88-6m-bitcoin-theft-1858483",
        "published": "2026-08-19T03:00:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}