Coldcard Firmware Flaw Drains $70 Million From 1,196 Bitcoin Wallets

A firmware flaw in Coldcard hardware wallets allowed an attacker to drain 1,082.65 BTC — worth approximately $70 million — from 1,196 wallets in a 41-minute window on July 30, 2026, according to CoinDesk, citing a full breakdown published by Galaxy Research. The theft, now nearly double the amount initially reported, ran from 01:10 to 01:51 UTC across six blocks, with the proceeds sitting unmoved in four addresses.

How an Offline Attack Emptied Cold Storage

The defining characteristic of this exploit is what it did not require. No exchange was breached, no smart contract was manipulated, and no phishing kit was deployed. The victim devices were never touched. Galaxy Research's analysis found that Coldcard's firmware contained an internal build setting that instructed the device to skip its dedicated hardware randomness generator. A check in a supporting library tested only whether that setting existed — not whether it was switched on. As a result, key generation fell through to a basic software substitute that drew entropy from the chip's serial number and clock registers.

Those are not secret values. A chip's serial number is fixed factory metadata, and clock timing can be narrowed or directly measured using an identical device. The consequence was that the pool of possible private keys each affected wallet could ever produce collapsed from cryptographically vast to, on On the Mk4, Q, and Mk5 models, security teams put the range at roughly four billion possibilities.. Four billion is an insurmountable number for a human — and a trivial workload for commodity computing hardware. On the older Mk2 and Mk3, security teams found that the generation of keys could be fully determined.

An attacker following this method generates candidate seeds locally, derives the addresses each would produce, and cross-references those against the publicly downloadable blockchain ledger. Every step executes on the attacker's own hardware. The victim's wallet could be powered off in a vault on the other side of the world.

Market and Self-Custody Implications

The attack lands in a market already navigating cautious sentiment, with the Fear and Greed Index registering 27 (Fear) as of August 1. Bitcoin entered August having held a monthly gain through July, but analysts quoted by CoinDesk are flagging the potential for a choppy August now that forced-selling pressure has been exhausted. A high-profile self-custody breach of this magnitude does not help risk sentiment in that environment.

The structural implication is more significant than the dollar figure alone. As CoinDesk reported separately, the Coldcard exploit is already shaking confidence in self-custody and may redirect investors toward regulated Bitcoin ETF products — a shift that carries its own macro implications, including centralising custody back inside the traditional financial infrastructure that Bitcoin was designed to bypass. For traders weighing direct holdings against ETF exposure, the tradeoff between sovereign custody and institutional counterparty risk just became materially more complicated. For a detailed comparison of those tradeoffs, see our guide on Bitcoin ETF vs Buying Bitcoin Directly.

Coinkite, Coldcard's manufacturer, has issued warnings to Mk3 owners and maintains that its newer devices are unaffected. However, Block's security team — represented by Clay Garrett, who posted on X on July 31, 2026 — placed the Mk2, Mk4, Q, and Mk5 within scope. That discrepancy between the manufacturer's characterisation and independent security researchers' findings is unresolved as of this writing, which means any holder who generated a seed on potentially affected firmware cannot verify their exposure and must assume it.

Background and Macro Context

This attack does not exist in isolation from the broader macro moment. Bitcoin's correlation with risk assets has fluctuated through 2026 as traders assess Federal Reserve policy signals, dollar strength, and whether digital assets continue to trade as a risk-on proxy or as a genuine macro hedge alongside gold. Events that erode confidence in the security architecture of self-custody — Bitcoin's primary value proposition over custodied paper exposure — have historically driven short-term price weakness and long-term structural shifts in how institutional capital positions itself.

The parallel with gold is instructive. Gold's value as a store of wealth has never depended on end-users managing their own secure vaults; it delegates custody to trusted intermediaries without undermining the asset's thesis. Bitcoin's thesis includes self-custody as a core feature, not a peripheral option — which is precisely why a breach at the hardware wallet layer carries outsized narrative weight. For broader context on how Bitcoin and gold compare as macro hedges, see our analysis on Gold as an Inflation Hedge — How Physical Gold Compares to Bitcoin. For macro market context across traditional and digital assets, WealthWatchPro macro market analysis provides ongoing coverage of rates, dollar dynamics, and cross-asset positioning.

Tether's separate disclosure of $1.5 billion in Q2 operating profit — reported by CoinDesk — adds another layer to the macro picture. Tether's profits are predominantly driven by US Treasury yield income on its reserve holdings, meaning the stablecoin giant is itself a leveraged expression of the current high-rate environment. Its reserve buffer falling by half in the same quarter is a detail worth monitoring if rates begin to shift.

What to Watch

Galaxy Research explicitly warned that further waves of wallet sweeps are likely if affected users do not move their funds. The attacker's enumeration process can be widened, refined, or resumed at any time — it requires no access to the original devices. Holders on Mk2, Mk3, Mk4, Q, or Mk5 hardware who generated seeds before Coinkite addressed the firmware flaw should treat this as an active, ongoing threat rather than a closed incident. The critical unknown is whether the attacker has fully mapped the exploitable key range or is still working through it.

On the investigative front, the blockchain data provider whose paid-account logs implicated the attacker appears close to cooperating with investigators — an unusual development in crypto theft cases, where attribution typically stops at on-chain heuristics. If law enforcement is able to tie a real-world identity to those query logs, this case could become a precedent-setting moment for how blockchain intelligence firms engage with criminal investigations. Traders should also watch whether the self-custody confidence shock accelerates net inflows into spot Bitcoin ETF products in the days ahead — that flow data will be the clearest signal of whether institutional positioning is shifting in response.