Coldcard Wallet Losses Near $114 Million as a Fourth Attack Wave Sweeps 5,294 Addresses

Attackers opened a fourth wave of sweeps against Coldcard-generated Bitcoin addresses early Monday, August 3. Galaxy Research counted 448.7 BTC moving out of 709 suspected victim addresses. That pushes the running total to roughly 1,816 BTC, worth about $114 million at current prices. More than 5,200 addresses have now been hit since Thursday, July 30. Notably, none of this involved stolen devices, phishing, or malware on a victim’s computer. Instead, the attacker simply guessed the keys.

The Bug: One Commit, Five Years, Zero Detection

Block’s Bitcoin Engineering and Security teams traced the failure to a commit dated March 1, 2021. That change moved Coldcard’s seed generation from ckcc.rng_bytes() to ngu.random.bytes(). The first function pulled from the device’s hardware random number generator. On paper, the swap looked harmless. In practice, it routed seed creation into MicroPython’s software randomizer instead.

The mistake lived in a single preprocessor check. Coldcard firmware sets the macro MICROPY_HW_ENABLE_RNG to zero, because the device supplies its own hardware RNG wrapper. However, the libngu library tested whether that macro existed rather than whether it was enabled. A macro set to zero still exists. As a result, the library bound to MicroPython’s fallback path, and the STM32 hardware generator sat unused. Firmware v4.0.0 shipped with that path on March 17, 2021, and nobody caught it for more than five years.

$1.6 million dollars in Bitcoin was drained from my account on July 29th in the Cold Card wallet hack.

My Bitcoin was in cold storage. My keys were on a ColdCard device kept in a safety deposit box that had never been connected to the internet.

This part’s nerdy, but here’s… pic.twitter.com/Lf9kJv9Jo4

— Jonathan Goodman (@itscoachgoodman) August 1, 2026

Four Waves in Five Days

The first wave arrived at roughly 01:10 UTC on Thursday, July 30. Galaxy Research logged 1,082.65 BTC leaving 1,196 addresses inside a 41-minute window. Chainalysis noted that roughly $30 million moved in the first ten minutes alone. Importantly, the attacker did not sweep randomly. Chainalysis found evidence that they studied the victim population first, then targeted the largest balances early. Trezor’s Josef Tětek flagged the worst single hit publicly. He wrote that “the biggest drained address (so far) is 51 BTC.”

Two smaller waves followed as the attacker worked through the remaining vulnerable cohort. July 31 produced 76.16 BTC from 1,478 addresses. August 1 produced another 207.73 BTC from 1,912 addresses. Together, the first three waves accounted for 1,367.05 BTC across 4,585 addresses, worth about $88.6 million.

A $2 AI experiment may have changed #crypto security forever.

Researchers say an AI model reportedly rediscovered the vulnerability behind the recent $100M Bitcoin ColdCard wallet theft in just 20 minutes.

AI didn’t break Bitcoin.

It found a mistake in the software protecting… pic.twitter.com/SkFWuGmK3x

— Coindoo.com (@coindoo) August 4, 2026

Wave Four Changed Tactics

Galaxy’s Alex Thorn flagged the newest sweep early Monday and measured it against a baseline. Activity ran at 13.8 sweeps per block across blocks 960,778 to 960,792. The pre-incident baseline sat at 0.3. That is roughly 45 times the normal rate, spread across 218 transactions. Thorn stayed careful about attribution. He described the addresses as “LIKELY Coldcard victims” that “match the shape of coldcard vulnerable utxos.”

This wave also behaved differently onchain. Earlier waves consolidated stolen funds into shared collection wallets, which made clustering straightforward. In contrast, wave four sent funds to a fresh address for each victim, which complicates tracing. The attacker also used replace-by-fee transactions. That detail cuts both ways, because unconfirmed transactions sit in the mempool before miners include them. Thorn pointed out that victims who spot their address there still hold their keys. Therefore, they have minutes to broadcast a competing transaction with a higher fee and rescue the funds first.

Who Is Exposed and Who Is Not

Any seed generated on affected firmware between March 2021 and the emergency patches should be treated as compromised. That covers Mk2 and Mk3 devices on 4.0.0 through 4.1.9. It also covers Mk4, Mk5, and Q devices on earlier releases. Three defenses held up, though. Users who added at least 50 independent dice rolls supplied real entropy that overwhelmed the weak generator. A strong, unique BIP-39 passphrase also creates a wallet that seed words alone cannot reconstruct. Finally, multisig setups survived when the vulnerable Coldcard key represented only one signer among several.

Several product lines escaped entirely. Coinkite confirmed that SATSCARD, OPENDIME, and TAPSIGNER run different codebases and remain unaffected. Meanwhile, Ledger, Trezor, Bitkey, Jade, and Tangem all issued statements confirming their devices do not share the flawed code.

Coinkite’s Response

Coinkite published its advisory on July 30 and moved quickly afterward. The company shipped fixed firmware for every model:

• Mk2 and Mk3: version 4.2.0
• Mk4 and Mk5: version 5.6.0
• Q: version 1.5.0Q
• Edge track: 6.6.0X/QX

It also halted shipments and destroyed all remaining inventory carrying vulnerable firmware. For orders already in transit, Coinkite emailed customers directly with migration steps.

The critical caveat sits in the company’s own guidance. Patching stops new seeds from inheriting the flaw, but it cannot repair a seed that already exists. Every affected user must generate a fresh seed on fixed firmware and move funds to it. CEO Rodolfo Novak, known as NVK, opened his statement bluntly. He told users to move funds immediately, adding, “I’m sorry and I’m devastated.” A follow-up post on Sunday called the prior three days “some of the hardest in this company’s history.”

Several questions remain open. Coinkite has not announced any compensation program for victims. Its legal team said it will “coordinate as warranted with law enforcement across multiple jurisdictions.” Block reported its findings to federal authorities and traced attacker activity through an unnamed blockchain services provider. The FBI has declined to comment on whether an investigation exists.

JUST IN: @COLDCARDwallet once defined a “retirement attack” as wallet makers planting a seed generation bug to recover users’ Bitcoin later.

The 2021 post is now going viral after nearly $100M was stolen from Coldcard wallets through a similar flaw. pic.twitter.com/m2ut8ZRmuy

— SolanaFloor (@SolanaFloor) August 4, 2026

The Wider Fallout

The incident triggered visible movement across the Bitcoin network. On July 31, transfers under 1 BTC hit 39,600 BTC, or roughly $2.5 billion. That marked the highest such volume since the FTX collapse in November 2022. Daily active addresses jumped from 645,000 to nearly one million. Sub-10 BTC deposits to exchanges reached 7,300 BTC, or about $459 million. Yet Bitcoin held near $62,700 through the period. That combination suggests holders repositioned for safety rather than sold. Meanwhile, Santiment recorded its most negative Bitcoin sentiment reading on record.

The industry response has focused on process rather than hardware. Binance founder CZ told users to split funds across wallets, noting that “even hardware wallets can have bugs.” Kraken’s Nick Percoco framed the lesson more directly, calling it “a wake-up call for the entire hardware wallet industry.” His point cut to the core issue. Certified secure elements did nothing here because, in his words, “nobody verified which code path actually ran.” Coinkite itself argued that AI-assisted code review now helps attackers surface latent bugs faster than defenders can find them. Regardless of that framing, the practical takeaway is narrower. Hardware wallets remove a large class of risk. However, they do not remove the need to verify the randomness underneath.

*Disclaimer: News content provided by Genfinity is intended solely for informational purposes. While we strive to deliver accurate and up-to-date information, we do not offer financial or legal advice of any kind. Readers are encouraged to conduct their own research and consult with qualified professionals before making any financial or legal decisions. Genfinity disclaims any responsibility for actions taken based on the information presented in our articles. Our commitment is to share knowledge, foster discussion, and contribute to a better understanding of the topics covered in our articles. We advise our readers to exercise caution and diligence when seeking information or making decisions based on the content we provide.

The post Coldcard Wallet Losses Near $114 Million as a Fourth Attack Wave Sweeps 5,294 Addresses appeared first on Genfinity.