Coldcard hack drains 1,367 BTC: predictable seed phrases expose $86M

This incident shatters the perceived inviolability of cold storage and highlights the dire consequences of poor entropy in cryptographic systems. For cybersecurity professionals, it’s a real-world case study in RNG failure that demands urgent review of hardware wallet security architectures. Every security feature beyond strong key generation is moot if the foundational randomness is broken.

Hackers have exploited a critical software vulnerability in Coinkite’s Coldcard hardware wallets, long regarded as one of the most secure methods for storing Bitcoin offline. The flaw, rooted in a predictable seed-phrase generation process, has already led to the theft of approximately 1,367 BTC—worth roughly $86 million—from over 4,500 wallets as of August 3, 2026, according to data from Galaxy Research. The attack is ongoing, and the fallout is sending shockwaves through the cryptocurrency and cybersecurity communities, challenging the fundamental assumption that cold storage is impervious to remote theft.

“

The price of Bitcoin itself, around $62,900 per token at the time of reporting, could face downward pressure if large-scale liquidations occur from stolen funds being sold on exchanges.

The vulnerability stems from Coinkite’s implementation of the random-number generator (RNG) used to create the 12- or 24-word seed phrases that control access to Bitcoin funds. Instead of relying solely on cryptographically secure entropy, Coldcard firmware contained a fallback mechanism that, under certain conditions, generated keys using deterministic values such as the device’s serial number. Block Inc.’s engineering team identified the flaw, revealing that attackers could reverse-engineer these deterministic inputs to compute the corresponding seed phrases without ever needing physical access to the device. This effectively converts a hardware wallet into a predictable password generator, undermining its entire security model.

The attack first came to light late last week when Coinkite issued a notice to users about the compromised keys. By then, funds were already moving. Victim Jonathan Goodman described his disbelief after checking his wallet on July 29: “Between 9:36 and 9:43 pm, all three of my wallets were completely drained.” The speed and precision of the thefts indicate that attackers automated the process, likely by scanning the blockchain for wallets associated with known Coldcard firmware versions and then mass-computing the weak seeds.

The incident raises profound concerns about the supply chain and software integrity of hardware wallets. Coldcard devices are popular among security-conscious Bitcoin holders precisely because they are designed to operate air-gapped, never connecting to the internet. Yet, as Aneirin Flynn, CEO of cybersecurity firm Failsafe, noted, “It exposes the fallacy of your crypto being offline. The device is just responsible for generating your passwords, and if the underlying math is broken then your passwords can be reverse-engineered.” This statement underscores a bitter truth: cold storage is only as strong as the cryptographic randomness at its core. When entropy fails, no amount of physical isolation can protect funds.

The financial impact is significant but perhaps more damaging is the erosion of trust. The $86 million stolen so far may represent only the earliest victims; if the flawed seed generation dates back to older firmware versions, the total vulnerable address space could be far larger. Galaxy’s initial count of 4,500 affected wallets is likely to grow as more users check their balances. The price of Bitcoin itself, around $62,900 per token at the time of reporting, could face downward pressure if large-scale liquidations occur from stolen funds being sold on exchanges. However, blockchain analysis firms are likely monitoring the hacker-controlled addresses, which may limit the ability to cash out.

From a regulatory perspective, this breach could accelerate calls for mandatory security standards and third-party audits for cryptocurrency wallet vendors. The market for hardware wallets has long relied on community trust and open-source scrutiny, but the Coldcard flaw—apparently present in proprietary firmware—escaped detection until now. Coinkite is expected to release a firmware update to fix the RNG fallback, and users are being urged to move funds to new wallets generated with a patched device. Many will question whether the brand can survive such a catastrophic trust breach.