$89M Bitcoin heist from Coldcard wallets: 1,200 addresses drained in record time

For Bitcoin holders, the Coldcard disaster is a gut punch. Many chose hardware wallets precisely to avoid the kind of hot-wallet hacks that plague exchanges, only to learn that their ‘unhackable’ device had a fatal flaw in its seed generation. With $89 million gone in 41 minutes, trust in cold storage—once the bedrock of self-sovereign Bitcoin—has been deeply shaken, and the price impact could be immediate.

A catastrophic security breach has rocked the cryptocurrency world, with attackers exploiting a flaw in the popular Coldcard hardware wallet to siphon an estimated $89 million in Bitcoin from over 1,200 addresses. The heist, first reported by Forbes and analyzed by Galaxy Research, unfolded with alarming speed on July 30, 2026—draining more than 1,000 BTC from 1,196 wallets in a mere 41 minutes. Subsequent waves of suspicious activity identified by Galaxy pushed total losses to nearly $89 million, making this one of the largest single-day thefts traceable to a hardware wallet vulnerability.

“

The $89 million loss, while relatively small in the context of Bitcoin’s $1.2 trillion market cap, represents a profound failure of trust.

Coldcard, manufactured by Canadian firm Coinkite, is widely regarded as a bastion of offline security, designed to isolate private keys from internet-connected threats. The breach shatters that perception. According to a security advisory from Block’s Bitcoin Engineering and Security team, a coding error in certain Coldcard firmware versions fundamentally weakened the randomness—or entropy—of the recovery phrases generated during wallet setup. These 12- or 24-word seed phrases are the keys to the kingdom; if an attacker can predict or brute-force them, they can reconstruct a wallet’s entire keychain and steal funds without ever touching the physical device. The bug effectively made some recovery phrases predictable enough for sophisticated adversaries to systematically drain accounts.

The speed and precision of the July 30 attack—1,196 wallets in 41 minutes—point to a highly automated operation. Attackers likely scanned the blockchain for addresses linked to vulnerable wallets, computed the weak seed phrases, and swept the BTC in rapid succession. This was not a smash-and-grab but a surgical execution, indicating deep knowledge of the flaw and possibly preparatory infrastructure. Galaxy’s blockchain analysis confirmed that while the initial wave grabbed headlines, two additional waves compounded the damage, underscoring that the threat is ongoing. Block explicitly warned that attacks are still happening, even as forensic details remain under investigation.

Coinkite has released a firmware update to fix the entropy bug for newly created wallets, but it issued a crucial caveat: installing the update does not retroactively secure wallets generated with the vulnerable firmware. Users who created wallets on affected versions must generate entirely new recovery phrases and transfer their funds to new addresses—a painful and potentially costly process that many might overlook. This gap leaves thousands of existing wallets exposed indefinitely, especially as word of the vulnerability spreads among malicious actors.

The implications stretch far beyond Coldcard’s user base. Hardware wallets have long been marketed as the gold standard of crypto self-custody, immune to online hacks. This incident eviscerates that assumption, revealing that even air-gapped devices depend on secure software implementation. A single coding mistake in entropy generation can cascade into mass theft. The advisory from Block—a company founded by Jack Dorsey with deep ties to Bitcoin—lends extraordinary credibility to the warning, signaling that the industry must urgently reexamine how hardware wallets are engineered and audited.