A serious vulnerability in the Coldcard hardware wallet has been connected to the theft of approximately 1,082.65 BTC, valued at around $70.2 million, in a rapid 41-minute operation on July 30, 2026. This incident was analyzed by Galaxy Research, which traced the flaw back to a firmware error in devices made by Coinkite, a Canadian company.
Details of the Vulnerability
The issue originates from a March 2021 firmware integration mistake that directed seed generation to a deterministic software pseudorandom number generator (PRNG) instead of utilizing the hardware random number generator (RNG) present in the STM32 chip. This misconfiguration allows an attacker who can ascertain or limit the device’s unique identifier (UID), timer state, and previous RNG-call history to recreate potential output streams offline without needing direct access to the device.
Impact on Users
Coinkite has released emergency firmware updates for all affected models as of July 31, 2026. However, it is important to note that installing this firmware does not rectify any existing compromised seeds. Users whose seeds may have been exposed are advised to generate a new seed using the patched firmware and transfer their funds accordingly. Restoring the old seed on updated firmware or another wallet could perpetuate the vulnerability.
Scope of the Affected Devices
The vulnerability affects various models of Coldcard wallets. Specifically, the Mk2 and Mk3 devices running versions 4.0.0 through 4.1.9 are at risk, as well as Mk4 and Mk5 models with firmware prior to version 5.6.0, and the Q model before version 1.5.0Q. Coinkite has indicated that a seed generated with at least 50 independent and fair dice rolls is not vulnerable to this specific issue, but if there is any uncertainty regarding the randomness of the rolls, migration to a new seed is recommended.
Ongoing Investigations and Findings
Following the initial theft, Galaxy Research has identified two additional suspected waves of related Bitcoin sweeps, raising the total estimated losses to 1,367.05 BTC, approximately $88.6 million, across 4,585 addresses. While the patterns suggest a common operator for the first two waves, the third wave’s connection to the previous incidents remains unconfirmed. Galaxy has reported around 600 addresses believed to be controlled by the attacker to federal investigators and cybersecurity firms.
As of now, no specific individual has been identified as the attacker, and the ongoing investigation continues to analyze the on-chain data to understand the full scope of the incident.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
Original source: thehackernews.com
