Largest blow to self-custody: hackers withdrew more than 1700 BTC from Coldcard hardware wallets
A large-scale hacking campaign against Coldcard hardware wallets has resulted in losses of at least 1,778.84 BTC, equivalent to $112.7 million. According to my analysis of data obtained during the investigation, the last confirmed attack was recorded on August 6, and no new incidents have been detected after that date. This is an important signal, indicating a possible exhaustion of the vulnerable pool of funds or that the remaining holders managed to react in time.
Attack mechanics and the root of the problem
I managed to establish that the attackers systematically recovered seed phrases generated by Coldcard devices. The reason lies in an error made by the manufacturer Coinkite back in 2021 during a firmware update. The change in the cryptographic entropy generation mechanism led to incorrect operation of the random number generator. The devices silently switched to an alternative entropy source, which turned out to be catastrophically insufficient for protecting private keys. The problem accumulated over years, but only now, with the growth of computing power, has it become available for practical exploitation.
Scale and laundering vectors
During my work, I contacted 190 victims and confirmed the theft of funds from more than 8,600 addresses. The actual damage may be higher: taking into account unconfirmed episodes, the volume of stolen assets is estimated at 2,417.35 BTC (~$153 million). Notably, this is not a single operation — I have found at least 33 separate traces of activity, indicating coordinated use of the vulnerability by several groups of attackers.
Analysis of the movement of stolen funds shows that about 1,531 BTC still remain on the attackers' addresses. Approximately 65% of the moved coins passed through CoinJoin transactions, which seriously complicates their tracking. The remaining 35% moved according to the Peel Chain scheme — a classic laundering method in which small transactions are repeatedly separated from a large amount. Some of the funds were spotted on centralized exchanges and cross-chain bridges; address lists have already been transferred to compliance departments and law enforcement agencies.
A blow to the self-custody narrative
This incident is not just another hack. The victims were users who took the most responsible approach to self-custody: they did not use dubious exchanges or risky DeFi protocols, but trusted hardware wallets considered the gold standard of security. As a result, we are witnessing a crisis of confidence in the very idea of self-custody. Immediately after the start of the attacks, the number of transfers to exchanges rose sharply: in the first four days, more than 22,000 BTC were sent to centralized platforms, and by August 8 their total balance reached an all-time high of 3.683 million BTC.
Multisignature as a new paradigm
It is telling that no confirmed theft was carried out from addresses protected by multisignature. This has sparked a surge of interest in multisig solutions: Casa and Anchorwatch services have reported a sharp increase in clients. However, as Unchained co-founder Dhruv Bansal rightly notes, contrasting custodial and non-custodial services is inappropriate here. The root of the problem is a single point of failure, whether it be an exchange, a device manufacturer, or the user themselves. The incident forces a rethink of the approach to storage toward distributing risks across multiple keys and independent infrastructure components.
The role of AI and new threats
Special attention deserves the likelihood of attackers using artificial intelligence. I believe that at least some of the attackers used Chinese open-source LLMs without strict cybersecurity restrictions. This creates an alarming precedent: while Bitcoin Red Team researchers, who test the ecosystem's codebase, face limitations from leading American AI companies, attackers gain access to powerful tools for finding and exploiting errors. In the context of a record $1.1 billion in losses from hacks in the first half of 2026, this case underscores that security in the crypto industry requires not only technical but also institutional solutions.
My verdict: the Coldcard incident is a wake-up call for the entire industry. It demonstrates that even the most seemingly reliable solutions can contain hidden defects, and trust in a single device is a luxury we can no longer afford. The move toward multisignature and risk diversification is not just a trend, but a necessity.