Coldcard Wallet Hack Hits $114M Losses, Flip Bitcoin Golden Rule

A five-year-old firmware bug in Coldcard hardware wallets has led to four waves of automated sweeps draining an estimated 1,816 BTC — roughly $114 million — from over 5,200 addresses since July 30. Here’s what went wrong, why Bitcoin holders are now rushing coins back to exchanges, and what the on-chain panic reveals.

How a 2021 Bug Became a 2026 Crisis

The root cause traces back to a March 2021 firmware update for Coldcard Mk3 devices, built by Canadian manufacturer Coinkite. That update introduced a coding error in how the wallet generated seed phrases — the master password that controls access to your Bitcoin.

Instead of pulling randomness from the device’s hardware random number generator (RNG), the firmware fell back to a software-based alternative that produced far more predictable results. In security terms, the entropy dropped from a near-uncrackable 128 bits to roughly 40 bits on Mk3 devices. That’s the difference between a lock with trillions of combinations and one with about a million — still sounds like a lot, until a computer starts guessing.

The attacker didn’t need your device or your Wi-Fi password — just enough computing power to reconstruct possible seed phrases and check them against public blockchain data. Coinkite has since released emergency firmware patches, but for many, the warning came too late.