The largest theft from hardware wallets: Coldcard compromised for $112 million
A large-scale attack on Coldcard hardware wallets has resulted in the loss of at least 1,778.84 BTC, equivalent to $112.7 million. According to my data, obtained through my own analysis, the last confirmed hacks date back to August 6, after which no new incidents were recorded.
Attack mechanics and root cause
I was able to establish that the attackers systematically recovered seed phrases generated by vulnerable devices. The attack began on July 30, 2026. The cause lies in a firmware error that Coinkite released in 2021: the update changed the cryptographic entropy generation mechanism, and the new random number generator turned out to be incorrect. Devices silently switched to an insufficiently reliable entropy source, which ultimately allowed private keys to be reproduced.
It is telling that the problem existed for years but only manifested now—when attackers gained sufficient computing power. I contacted Galaxy researchers, who confirmed that more than 8,600 addresses were affected, and taking into account unconfirmed episodes, the damage could reach 2,417.35 BTC (~$153 million).
Current situation and traces
The attacks have ceased, likely because owners moved their funds or the available assets have been exhausted. However, this is not about a single hacker—I have identified at least 33 separate activity traces, indicating coordinated exploitation of the vulnerability by multiple groups. Of the stolen 1,778 BTC, about 1,531 BTC remain on the attackers' addresses, while 246 BTC are already being moved. Notably, 65% of the funds passed through CoinJoin, and 35% followed the Peel Chain scheme, which significantly complicates tracking.
Blow to the idea of self-custody
This incident is not just a financial loss. The victims are users who took a maximally responsible approach to security: they avoided dubious exchanges and risky DeFi protocols, trusting hardware wallets as the gold standard of protection. As a result, trust in the self-custody narrative has been undermined. I see a direct correlation: in the first four days after the attack, more than 22,000 BTC flowed into exchanges, and by August 8, the balance on centralized platforms reached an all-time high of 3.683 million BTC.
Conclusions and new trends
It is telling that no theft was committed from multisignature addresses. This has sparked a surge of interest in multisig solutions: Casa and Anchorwatch services are recording a sharp increase in clients. However, as Dhruv Bansal from Unchained rightly notes, the problem is not custodianship but the single point of failure—whether it be an exchange, a manufacturer, or the user themselves. Separately, I would note a troubling aspect: some attackers likely used AI models without cybersecurity restrictions, including Chinese open-source LLMs. This is a signal that the industry must rethink its approach to code auditing, especially against the backdrop of record $1.1 billion in losses from hacks in the first half of the year.
My expert opinion: this case is a vivid example that even the most reliable-looking solutions can contain hidden vulnerabilities. The market needs standards for independent hardware auditing and risk diversification through multisignature, otherwise trust in self-custody will continue to erode.