- Scale. A firmware error introduced in March 2021 allowed hackers to drain more than $140 million worth of bitcoin from Coldcard hardware wallets — devices sold specifically because they keep assets offline.
- Mechanism. The bug routed seed phrase generation to a software pseudorandom number generator instead of the hardware RNG, making private keys reproducible by anyone with knowledge of the algorithm and the computing resources to brute-force them.
- Accountability. Coinkite CEO Rodolfo Novak called the company “heartbroken” and accepted full responsibility, urging all users to migrate to new seed phrases immediately.
The central promise of a hardware bitcoin wallet is that private keys never leave the device and are never exposed to the internet. That promise collapsed on 4 August 2026, when Coinkite Inc. — the Toronto-based maker of the Coldcard wallet — disclosed that a software error in a 2021 firmware update had made the private keys generated by an unknown number of devices predictable, and therefore recoverable without physically accessing the hardware.
How the Bug Worked
The vulnerability traces to a firmware integration error from March 2021. The update was intended to route seed phrase generation — the process that creates a wallet’s private key at setup — through the device’s STM32 hardware random number generator. Instead, due to the bug, the process was directed to a deterministic software pseudorandom number generator (PRNG). A software PRNG is not truly random: its outputs can be reproduced if an attacker knows the underlying algorithm and can approximate the initial state, reducing the difficulty of recovering the private key from theoretically intractable to computationally demanding but achievable.
Hackers exploited that window. TechCrunch reported that at least a dozen separate hacker groups, possibly coordinating, participated in the attack. Galaxy Research identified on 30 July that within 41 minutes, hackers had drained more than 1,000 bitcoins from more than 1,000 addresses.
The Human Impact
Among the victims was Jonathan Goodman, who disclosed publicly that he lost $1.6 million despite following every documented best practice: he never shared his seed phrase, kept the device offline, and stored everything in a physical safe. His account captures the distinctive cruelty of this class of vulnerability — the exposure was present before any funds were loaded, and invisible to any audit of user behaviour after the fact.
Total losses have been reported variously: TechCrunch cited over $130 million, Forbes reported $116 million, and CP24 and Yahoo Finance Canada put the figure above $140 million. The divergence reflects differences in timing, bitcoin’s price movement, and the ongoing discovery of additional affected addresses as investigators work through the blockchain record.
Industry Context
Coinkite issued an updated security advisory urging all users of affected firmware versions to migrate to new seed phrases immediately. CEO Rodolfo Novak posted a public apology, saying the company was “heartbroken” and was taking “full accountability for the firmware bug.” The company did not confirm a total count of compromised wallets.
The Coldcard incident arrives against a backdrop of an unusually damaging year for cryptocurrency security. Blockchain monitoring firm TRM Labs recorded more than 200 cryptocurrency hacks in 2026 through early August, with total losses exceeding $950 million. Self-custody — keeping bitcoin on a hardware device rather than leaving it with an exchange — has been the standard recommendation following the collapse of FTX in 2022. The Coldcard breach tests that recommendation without obviously improving the alternatives, since the vulnerability resided not in the exchange model but in the device’s fundamental key-generation process.