Credits: bitcointere / PxHere.
A vulnerability that appeared in 2021 in Coldcard firmware made certain recovery phrases predictable. Since July 30, 2026, thousands of addresses have been drained remotely. Franceinfo estimated on August 3 that the thefts totaled 1,755 bitcoins, more than $110 million, but that figure remains provisional. Affected holders must change their phrase, not just update their crypto wallet.
A Multi-Wave Toll, Still Changing
The first precisely documented wave took place on July 30 between 1:10 a.m. and 1:51 a.m. UTC. Galaxy Research traced the complete draining of 1,196 addresses. In total, 1,082.65 BTC were transferred, then valued at about $70.2 million. All the transactions used the same fee of 30 satoshis per virtual byte and returned no change. For the analysis team, that consistency points to an automated sweep, not ordinary withdrawals made simultaneously by the owners.
Two other waves then pushed Galaxy Research’s August 1 estimate to 1,367.05 BTC across 4,585 addresses. Franceinfo published a broader tally on August 3 of 1,755 BTC. It covered more than 5,000 addresses and about $110 million. However, this figure is not a consolidated primary count in Galaxy’s first publication referenced by the article.
Caution is all the more necessary. On August 3, Alex Thorn, Galaxy’s head of research, identified a fourth wave. He judged it very likely tied to Coldcard, though he did not present it as definitively attributed. It then represented 388.927 BTC, 462 addresses, and 218 transactions. These categories cannot be added together as if they all had the same level of certainty. A Bitcoin address also does not necessarily correspond to one person. On Tuesday, August 4, the number of holders affected, the final total of losses, and the identity of the attacker or attackers remained unknown.
How Could An Offline Wallet Be Drained Remotely?
A hardware wallet does not contain the bitcoins themselves: they remain recorded on the blockchain. The device stores the secrets that allow those funds to be authorized for transfer. During setup, it creates a recovery phrase, usually made up of 12 to 24 words. The wallet’s private keys are then derived from it.
That phrase must be unpredictable. Block’s Bitcoin Engineering and Security teams published a technical analysis. In it, they describe an integration error between Coldcard firmware and a software library. A build-time check verified that a parameter was set, but not that it was enabled. The program could therefore call a deterministic software generator instead of the intended hardware generator.
The result could look like a random sequence while actually coming from a much smaller space of possibilities. Applying a cryptographic function to it afterward does not recreate the missing randomness: it only transforms an already predictable value. With enough information about the device and its startup, an attacker could compute candidate phrases offline. They could then check whether they matched a public address.
So simply knowing a crypto wallet address is not enough to steal funds. Here, it serves as a means of verification. When a candidate phrase produces the same address, the attacker knows they have recovered the private key. That key lets them sign a transaction. The device can stay powered off, locked in a safe, and never have been connected to the Internet. A weakness present when its secrets were created is enough to expose it.
A Regression Introduced In March 2021
Block places the code change behind the regression on March 1, 2021. It appeared in firmware 4.0.0, released on March 17, for the Mk2 and Mk3 models. The company specifies, however, that it did not conduct a full exploitation test on every device. It presents its report as an early analysis, pending the manufacturer’s final review.
The exact scope still differs between the two notices. Block classifies versions 4.0.0 through 4.1.9 of the Mk2 and Mk3 as vulnerable. In its August 1 notice, Coinkite uses versions 4.0.1 through 4.1.9 for those models. For the Mk4, Mk5, and Q, the manufacturer says phrases generated before the fixed versions had about 72 bits of entropy. It had expected 128. It considers their exposure less severe than that of the Mk2 and Mk3, but still serious.
That difference in boundaries does not change Coinkite’s precautionary rule. Only the firmware used at the time the phrase was generated matters. The device’s manufacturing date and the version installed today are not decisive. The analyses place the Mk1, as well as Mk2 and Mk3 running version 3.2.2 or earlier, outside this regression. Coinkite also says Satscard, Opendime, and Tapsigner are not affected, since they rely on different code bases.
Why The Update Is Not Enough
The fixed versions prevent the creation of a new weak phrase. They do not change a phrase already generated. Coinkite lists version 4.2.0 or later for the Mk2 and Mk3. For the Mk4 and Mk5, it recommends standard version 5.6.0 or Edge branch 6.6.0X. For the Q, standard version 1.5.0Q or Edge branch 6.6.0QX is required. An older Edge version numbered 6.x is not necessarily fixed.
After installing the official firmware appropriate for the model, the holder must create a new phrase. They must verify their backup and a receiving address. A small test transfer should come before moving the balance. Importing the old phrase into another wallet solves nothing: the secret remains the same and remains vulnerable. Coinkite recommends keeping the old backup until the migration is fully confirmed.
The same notice mentions the case of a phrase supplemented by at least 50 independent rolls of a fair die. Those rolls must have been done privately, with no recording or disclosure of the results. In that case, Coinkite does not consider it exposed to this flaw alone. A strong, unique BIP-39 passphrase also adds a barrier, but it does not fix the original phrase. The manufacturer therefore also advises those users to migrate. The device PIN is not a BIP-39 passphrase.
Coinkite says it suspended shipments after confirming the vulnerability. The company says it destroyed the units still in stock with affected firmware. It also says it contacted customers whose orders had already shipped. The company asks affected people to keep their device. It could be useful if funds are recovered. It also says it will coordinate legally with law enforcement if necessary. At this stage, however, it has not published the number of affected customers. It has also not announced any compensation mechanism or the opening of a formal investigation.
Offline Storage Does Not Eliminate Software Risk
The Coldcard case does not show that all cold wallets are vulnerable. It is a reminder that an offline device depends on an entire chain. That includes the quality of the randomness, library integration, build parameters, and end-to-end testing. It also includes the alert process and the ability to replace compromised secrets. If any one of those links fails during key generation, the absence of a network connection is no longer enough.
The public presence of the source code does not, by itself, guarantee exhaustive auditing. The flaw was visible in components published for several years, but its effect came from their interaction at build time. Coinkite has promised a full technical follow-up. It will need to explain, among other things, how the regression escaped checks since 2021. It will need to specify the scope by model and document the support given to holders. Until that work and the tracing of the funds are complete, the amount remains provisional. The more than $110 million is a dated order of magnitude, not a final tally.