The largest theft from hardware wallets: the Coldcard attack cost users $153 million
A large-scale hacking campaign targeting Coldcard hardware wallets has resulted in losses of at least 1,778.84 BTC, equivalent to $112.7 million. However, this is only the confirmed portion of the damage. Taking into account episodes that have not yet been verified, the total volume of stolen funds could reach 2,417.35 BTC — about $153 million. It is important to note that no new confirmed attacks have been recorded after August 6.
The root of the problem — an error in entropy generation
My analysis shows that the attack became possible due to a fundamental flaw in the firmware, introduced back in 2021 by Coinkite. The update changed the cryptographic entropy generation mechanism, but due to a software error, the random number generator worked incorrectly. The devices imperceptibly switched to an alternative entropy source, which proved to be catastrophically insufficient for protecting private keys.
The attackers began systematically recovering seed phrases on July 30, 2026. With sufficient computing power, they were able to replicate private keys created on vulnerable devices. Researchers contacted 190 victims and confirmed theft from more than 8,600 addresses. Notably, this was not the work of a single hacker — traces of at least 33 separate attackers who simultaneously exploited the vulnerability have been found.
Where the stolen funds went
Of the confirmed 1,778 BTC, about 1,531 BTC remain on the attackers' addresses, while 246 BTC have already been moved. A significant portion — 65% — passed through CoinJoin transactions, which seriously complicates tracking. The remaining 35% were moved using the Peel Chain scheme — a classic laundering technique where small transactions are repeatedly split off from a large amount. A small share of the funds was spotted on centralized exchanges and cross-chain bridges, and lists of addresses have already been handed over to law enforcement agencies.
A blow to the ideology of self-custody
This incident is especially painful for the crypto community because the victims were exemplary users. They did not use dubious DeFi protocols, did not chase high yields, and trusted hardware wallets as the gold standard of security. The attack dealt a serious blow to the narrative of self-custody: after the hacks began, a sharp influx of funds to exchanges was observed — more than 22,000 BTC arrived in the first four days, and the aggregate balance reached an all-time high of 3.683 million BTC.
Multisignature as salvation
It is telling that no confirmed theft was carried out from addresses protected by multisignature. This sparked a surge of interest in multisig solutions — Casa and Anchorwatch services are recording a sharp increase in clients. However, I believe the main lesson here is deeper: the problem is not hardware wallets per se, but the single point of failure. Whether it is an exchange, a manufacturer, or the user themselves — concentration of risk is always dangerous. Distributing keys among independent components is becoming not just a recommendation, but a necessity.
The role of artificial intelligence deserves special attention. Some of the attackers likely used AI models without cybersecurity restrictions, including Chinese open-source LLMs. This is an alarming signal: vulnerability discovery capabilities are becoming available not only to defenders, but also to attackers. Against the backdrop of a record $1.1 billion in losses from hacks in the first half of 2026, this incident should serve as a catalyst for rethinking approaches to security in the industry.