How can Coldcard users protect their assets after this vulnerability?

Users should update to the patched firmware, generate new seeds, and transfer their assets to wallets created with the new seeds to ensure security.

Are other hardware wallets affected by similar vulnerabilities?

While this specific flaw pertains to Coldcard, other hardware wallets have faced vulnerabilities. Users should stay informed about their device's security updates and best practices.

Coldcard Hardware Wallet Flaw Results in Massive Bitcoin Theft

A critical vulnerability in Coldcard hardware wallets has led to the theft of over $70 million in Bitcoin, highlighting the importance of secure seed generation practices.

Published: August 1, 2026

Share this on:

Executive Summary

In July 2026, a critical vulnerability in Coldcard hardware wallets led to the theft of approximately $70.2 million in Bitcoin. The flaw, introduced in a March 2021 firmware update, caused the devices to use a deterministic software pseudorandom number generator (PRNG) instead of the intended hardware random number generator (RNG) for seed generation. This oversight allowed attackers to predict wallet seeds by analyzing device-specific information and prior RNG states, enabling unauthorized access to funds. Coinkite, the manufacturer, released emergency firmware updates on July 31, 2026, but emphasized that updating the firmware does not secure existing seeds. Users were advised to generate new seeds using the patched firmware and transfer their assets accordingly. This incident underscores the critical importance of robust entropy sources in cryptographic systems and highlights the potential risks associated with firmware updates that inadvertently introduce vulnerabilities.

Why This Matters Now

The Coldcard hardware wallet vulnerability highlights the ongoing challenges in ensuring the security of cryptocurrency storage solutions. As digital assets become more mainstream, the sophistication of attacks targeting them increases. This incident serves as a stark reminder for both manufacturers and users to prioritize security in firmware development and to remain vigilant about potential vulnerabilities that could compromise asset safety.

Attack Path Analysis

An attacker exploited a firmware flaw in Coldcard hardware wallets, allowing them to predict wallet seed phrases and gain unauthorized access to Bitcoin addresses. This led to the unauthorized transfer of approximately $70.2 million worth of Bitcoin from 1,196 addresses within 41 minutes.

Kill Chain Progression

Initial Compromise

High

Privilege Escalation

High

Lateral Movement

Medium

Command & Control

Medium

Exfiltration

High

Impact

High

Initial Compromise

Description

The attacker exploited a firmware flaw in Coldcard hardware wallets, which used a deterministic software pseudorandom number generator (PRNG) instead of the hardware random number generator (RNG), allowing prediction of wallet seed phrases.

Confidence:

High

MITRE ATT&CK® Techniques

Persistence

T1693.001

Modify System Firmware

Impact

T1486

Data Encrypted for Impact

Defense Evasion

T1078

Valid Accounts

Execution

T1203

Exploitation for Client Execution

Credential Access

T1556.004

Credential Dumping: Credential API Hooking

Credential Access

T1003.001

OS Credential Dumping: LSASS Memory

Execution

T1059.001

Command and Scripting Interpreter: PowerShell

Defense Evasion

T1562.001

Impair Defenses: Disable or Modify Tools

Potential Compliance Exposure

Mapping incident impact across multiple compliance frameworks.

PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities

Control ID: 6.2

The firmware flaw in the Coldcard hardware wallet represents a known vulnerability that was exploited, leading to significant financial loss. This highlights the necessity of timely identification and remediation of vulnerabilities to protect system components.

NYDFS 23 NYCRR 500 – Cybersecurity Policy

Control ID: 500.03

The incident underscores the importance of having a comprehensive cybersecurity policy that addresses the identification and management of vulnerabilities in hardware and software components to prevent unauthorized access and data breaches.

DORA – ICT Risk Management Framework

Control ID: Article 5

The exploitation of the firmware flaw indicates a lapse in the ICT risk management framework, emphasizing the need for robust processes to identify, assess, and mitigate risks associated with information and communication technology systems.

CISA ZTMM 2.0 – Asset Management

Control ID: 3.1

The incident highlights the criticality of maintaining an accurate inventory of assets and their configurations to identify and remediate vulnerabilities promptly, thereby reducing the attack surface.

NIS2 Directive – Cybersecurity Risk Management Measures

Control ID: Article 21

The breach demonstrates the necessity for entities to implement appropriate technical and organizational measures to manage cybersecurity risks, including regular assessments and updates to mitigate known vulnerabilities.

Sector Implications

Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.

Financial Services

Cryptographic vulnerability in hardware wallets threatens institutional Bitcoin custody operations, requiring enhanced entropy validation and immediate firmware updates for secure asset management.

Investment Banking/Venture

Predictable random number generation in Coldcard wallets exposes cryptocurrency investment portfolios to seed prediction attacks, demanding stronger custody security protocols and compliance measures.

Investment Management/Hedge Fund/Private Equity

Hardware wallet firmware flaws create deterministic seed vulnerabilities affecting cryptocurrency asset protection, necessitating multi-signature implementations and enhanced due diligence on custody solutions.

Capital Markets/Hedge Fund/Private Equity

Weak pseudorandom number generation in Bitcoin hardware wallets enables mass address sweeping attacks, requiring immediate assessment of cryptocurrency custody infrastructure and security controls.

Sources

Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minuteshttps://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html
Verified

Coldcard Security Advisoryhttps://blog.coinkite.com/coldcard-mk3-seed-generation-warning/

Verified

Predictable RNG Fallback and 32-bit Reseed in Coldcard Firmwarehttps://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware

Verified

Frequently Asked Questions

A firmware integration error in March 2021 led to the use of a deterministic software PRNG instead of the hardware RNG for seed generation, making wallet seeds predictable.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Aviatrix Zero Trust CNSF is pertinent to this incident as it could have constrained the attacker's ability to predict wallet seed phrases and access Bitcoin addresses, thereby reducing the scope of unauthorized transfers.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: The attacker's ability to exploit the firmware flaw may have been limited, reducing the likelihood of predicting wallet seed phrases.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: The attacker's unauthorized access to private keys could have been constrained, limiting their ability to escalate privileges.

Lateral Movement

Control: East-West Traffic Security

Mitigation: The attacker's ability to access multiple Bitcoin addresses could have been limited, reducing the scope of lateral movement.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: The attacker's control over compromised wallets could have been constrained, limiting their ability to prepare unauthorized transactions.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: The attacker's ability to transfer large amounts of Bitcoin could have been limited, reducing the extent of unauthorized transfers.

Impact (Mitigations)

The financial loss experienced by Bitcoin holders could have been reduced, limiting the overall impact of the attack.

Impact at a Glance

Affected Business Functions

Cryptocurrency Storage
Transaction Security

Operational Disruption

Estimated downtime: N/A

Financial Impact

Estimated loss: $70,200,000

Data Exposure

Private keys and seed phrases of affected Coldcard hardware wallet users

Recommended Actions

• Implement robust random number generation mechanisms to ensure the unpredictability of cryptographic keys.
• Regularly audit and update firmware to identify and remediate vulnerabilities promptly.
• Educate users on the importance of generating new seed phrases when vulnerabilities are discovered.
• Enhance monitoring systems to detect and respond to unauthorized access attempts swiftly.
• Develop and enforce policies for secure key management and storage practices.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced Threats Get a Free Workload Attack Path Assessment Under Active Attack?

Coldcard Hardware Wallet Flaw Results in Massive Bitcoin Theft

Executive Summary

Why This Matters Now

Attack Path Analysis

Kill Chain Progression

Initial Compromise

Description

MITRE ATT&CK® Techniques

Modify System Firmware

Data Encrypted for Impact

Valid Accounts

Exploitation for Client Execution

Credential Dumping: Credential API Hooking

OS Credential Dumping: LSASS Memory

Command and Scripting Interpreter: PowerShell

Impair Defenses: Disable or Modify Tools

Potential Compliance Exposure

PCI DSS 4.0 – Ensure all system components and software are protected from known vulnerabilities

NYDFS 23 NYCRR 500 – Cybersecurity Policy

DORA – ICT Risk Management Framework

CISA ZTMM 2.0 – Asset Management

NIS2 Directive – Cybersecurity Risk Management Measures

Sector Implications

Financial Services

Investment Banking/Venture

Investment Management/Hedge Fund/Private Equity

Capital Markets/Hedge Fund/Private Equity

Sources

Frequently Asked Questions

Cloud Native Security Fabric Mitigations and ControlsCNSF

Impact at a Glance

Affected Business Functions

Recommended Actions

Key Takeaways & Next Steps

Secure the Paths Between Cloud Workloads