$115M drained from wallets that never went online

Cold storage was supposed to be the end of the argument: keep the keys off the internet, and the internet can't take them. Between July 30 and mid-August 2026, that assumption failed for thousands of Bitcoin holders who had done exactly that.

How Did $115M Vanish From Wallets That Were Never Online?

The Coldcard losses were not a remote hack — they were the result of a seed-generation entropy flaw that made recovery phrases predictable at the moment of creation, years before the theft. Galaxy Research tallied more than $115 million in confirmed Coldcard-linked losses using data through August 13, 2026 . Because the flawed random-number path was reproducible, attackers could regenerate candidate seeds on their own hardware and brute-force valid phrases offline, without ever touching a victim's device.

Quick Answer: Coldcard hardware wallets built seeds using a software pseudo-random generator instead of the hardware TRNG, cutting entropy to roughly 40 bits on Mk3 devices. Attackers reproduced that process and swept wallets offline. Galaxy Research counted over $115 million stolen through August 13, 2026.

The defect traces to a single code path introduced in March 2021. A libngu migration routed wallet seed generation to ngu.random.bytes(), which resolved at link time to MicroPython's Yasmarang software PRNG rather than Coldcard's hardware random number generator . Block's independent engineering review reached the same conclusion and dated the vulnerable path's arrival in released firmware to v4.0.0 on March 17, 2021 . Coinkite's own advisory puts affected Mk3 seeds at roughly 40 bits of entropy instead of the intended 128 . That gap is the whole story: 128 bits is computationally unreachable, 40 bits is a weekend project.

For victims, the failure mode was invisible. Jonathan Goodman, who lost $1.6 million, described the position bluntly to TechCrunch:

"I did everything right... My devices never touched the internet... All because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability," — Jonathan Goodman, Coldcard user (source: TechCrunch, 2026-08).

Treat the headline number with care. The totals published during the first two weeks diverged meaningfully depending on who was counting and when:

• $112M–$115M — Galaxy Research confirmed figures reported August 16 using data through August 13 .
• ~$116M — TRM Labs' tally of roughly 1,816 BTC across 5,200+ addresses .
• ~$130M — the figure that includes a suspected, not victim-confirmed, fourth wave of about 459 BTC, lifting the total to 2,055 BTC .

The firmware vulnerability itself is vendor-confirmed and no longer in dispute. The dollar total is an attributed on-chain estimate with provisional components, and Coinkite's security status page explicitly declines to determine the cause of any individual reported loss . For anyone assessing their own exposure, that distinction matters more than the headline: what is settled is the defect and the affected firmware range, not the final invoice.

The Root Cause: How a March 2021 Code Migration Broke Random Number Generation

The defect is a seed-generation entropy failure introduced by a library migration on March 1, 2021, when Coldcard's firmware moved wallet seed generation off its intended hardware true random number generator (TRNG) path and onto ngu.random.bytes() as part of the libngu migration . That function did not resolve to Coldcard's hardware RNG at link time. It resolved instead to MicroPython's Yasmarang software pseudo-random number generator — a deterministic algorithm, not a physical entropy source. Every seed phrase generated through that path was therefore the output of predictable software math rather than unpredictable hardware noise.

Block's independent engineering team reached the same conclusion and documented the precise mechanism behind the misrouting. In the firmware build configuration, MICROPY_HW_ENABLE_RNG was defined with a value of zero. Libngu's code checked only whether that macro was defined, not whether it was enabled — a one-character distinction in C preprocessor terms between #ifdef and a value test. Because a macro set to zero is still a defined macro, the check passed, the hardware path appeared available, and the fallback silently took over . Nothing failed loudly. No error surfaced to the user. The device produced a valid-looking 24-word phrase exactly as expected.

Block dates the vulnerable path's arrival in released firmware to version 4.0.0, shipped on March 17, 2021, sixteen days after the migration commit . That date is the practical boundary line for anyone auditing their own holdings. A seed created on a Coldcard in spring 2021 has been sitting in a metal backup plate or a safe deposit box for more than five years, and its owner had no signal during that entire period that anything was wrong. The devices behaved normally, passed their self-checks, and never connected to a network — the failure was baked into the moment of creation, not introduced afterward.

This is also why the attacks did not require physical access to a single device. Determinism cuts both ways: a process reproducible by the manufacturer is equally reproducible by anyone who reads the open-source firmware. Attackers rebuilt the flawed generation path on their own hardware, enumerated the reachable output space, and derived Bitcoin addresses from each candidate phrase until they matched addresses holding funds on the public blockchain . No malware, no phishing, no supply-chain interception, no compromised update server. The theft ran entirely on arithmetic and public data.

Three properties of the bug compounded each other into the outcome:

• Silence. The fallback produced output of the correct length and format, so neither the firmware nor the user could detect that entropy quality had collapsed.
• Persistence. A seed is generated once and reused indefinitely; unlike a session key, a bad seed does not rotate out of exposure with time.
• Public verifiability. Bitcoin's transparent ledger let attackers test candidate keys against real balances offline, at no cost and with no rate limit, before broadcasting anything.

Coinkite has said it does not know who first identified the flaw and suspects an automated tool was used to comb through old code — notably, the company had itself attempted an audit of that area weeks before the sweeps began without catching it . A build-flag semantics error in a dependency boundary is exactly the class of defect that human code review tends to skim past and that mechanical analysis tends to catch.

Which Coldcard Models and Firmware Versions Are Affected?

Every Coldcard model that generated a seed on the affected firmware is exposed, but the severity splits sharply by hardware generation. Mk2 and Mk3 devices running versions 4.0.1 through 4.1.9 inclusive produced seeds with roughly 40 bits of entropy, which Coinkite's own advisory calls "critically low" . Mk4, Mk5 and Coldcard Q seeds fared better — approximately 72 bits instead of the intended 128 — because a secure-element reseed added entropy the older boards lacked . Neither figure is safe by modern standards; both are brute-forceable given enough compute.

Block's independent engineering analysis quantifies the gap more precisely and, in places, less charitably than the vendor advisory. For Mk2/Mk3 on v4 firmware, with a known device UID, timer state and call history, wallet generation is effectively deterministic, with a loose hidden-timer ceiling below 2^40.7 candidates. For Mk4/Q/Mk5, the secure-element reseed retained only four digest bytes — contributing at most 2^32 securely distinguished output streams for a fixed fallback state and call history — with a loose known-UID ceiling near 2^73.3 . Block stresses that 2^73.3 is not equivalent to 73-bit cryptographic security; it is an upper bound on a search space, not a floor on attacker cost.

Coinkite shipped fixed builds for every affected model and track on July 31, 2026 , and its three sibling products — TAPSIGNER, OPENDIME and SATSCARD — are unaffected because they run entirely separate codebases that never touched the libngu path . The company also destroyed remaining inventory carrying vulnerable builds rather than reflashing and reselling it .

The decisive variable is where a seed was generated, not where it lives today. A seed created on a safe device and later imported into an affected Coldcard is not weakened by that import. The reverse also holds and is the more dangerous case: a weak Coldcard-generated seed stays weak after being restored into a Ledger, Trezor, or any software wallet, because the entropy deficit is baked into the phrase itself . Users tracing exposure should audit the provenance of every seed — including BIP85 children and any multisig policy that depends on an affected key — rather than the current storage device.

Attack Timeline: Four Coordinated Waves in Two Weeks

The theft ran as a sequence of compressed, high-velocity sweeps rather than a slow drip. The first wave moved 1,083 BTC — roughly $70.2 million at the time — out of 1,196 addresses in 41 minutes on July 30, 2026 . Three further waves followed over the next several days, and by mid-August trackers placed confirmed losses above $115 million, with a suspected fourth wave pushing the upper estimate toward $130 million . Speed was the defining feature: because valid recovery phrases had already been brute-forced offline, the on-chain phase was simply broadcast and confirmation.

The second wave took 594 BTC (about $38 million) from roughly 500 single-signature wallets in 25 minutes . This is the wave with the tightest independent documentation. The tracker coldcardentropy.org publishes a confirmed-core dataset for a July 30 coordinated sweep covering 500 transactions, 1,324 source UTXOs, 500 unique source addresses and 594.51379184 BTC in source input . Notably, that same tracker labels the larger address sets circulating in press coverage as attributed or provisional rather than definitive victim counts — a distinction worth carrying into any figure you cite.

A third wave added 208 BTC drawn from 1,912 addresses, and a fourth was detected the following Monday . Galaxy Research counted 1,596 BTC confirmed stolen from about 7,300 addresses across three waves plus 14 smaller incidents, with a suspected — not fully victim-confirmed — fourth wave of roughly 459 BTC that would lift the running total to 2,055 BTC, or about $130 million . TRM Labs arrived at a separate tally of about 1,816 BTC (~$116 million) across more than 5,200 addresses, ranking the episode the third-largest crypto attack of 2026 year-to-date inside a total of $1.2 billion stolen across 276 incidents .

The clearest quantitative signal that these were coordinated operations rather than background theft is the sweep rate. During the suspected fourth wave, sweeps reached about 13.8 wallet sweeps per Bitcoin block, against a baseline near 0.3 before the incident — roughly a 46-fold increase in per-block sweep activity . Alex Thorn, head of firmwide research at Galaxy, identified "at least 15 different attackers" exploiting the flaw independently and described the sweeps as deliberate and likely LLM-orchestrated . TRM reached a compatible conclusion by a different route, declining to attribute the theft to any named actor and noting that transaction construction differed across waves — a pattern consistent with several parties working the same defect in parallel .

One operational detail shaped outcomes for a small number of holders: the attackers opted into replace-by-fee, so victims who spotted their own address sitting in the mempool could outbid the sweep transaction and rescue their coins . Galaxy reported no high-confidence attacker activity after August 6, while cautioning that further losses remain possible . Treat the wave count as provisional: the discrepancies between the Galaxy, TRM and coldcardentropy.org datasets reflect differing confirmation standards, not a settled ledger.

Who's Behind the Theft — And Why Most of the Money Hasn't Moved

No single actor is responsible: Galaxy Research's head of firmwide research, Alex Thorn, identified at least 15 different attackers exploiting the Coldcard entropy flaw independently of one another . That plurality is the defining feature of this incident. Once the seed-generation defect became reproducible on commodity hardware, exploitation stopped being a privileged capability and became a race between whoever ran the search first. Thorn described the sweeps as deliberate and likely orchestrated with large language models, based on the speed and consistency of the address targeting .

Blockchain intelligence firm TRM Labs reached a compatible but more conservative conclusion, declining to attribute the theft to any named actor or group. TRM's reasoning is forensic rather than speculative: transaction construction differed measurably across the waves — fee logic, input selection and output structure were not consistent — which points to multiple independent parties working from the same public weakness rather than one operator running a single toolchain . Sweep intensity gives a sense of the automation involved: roughly 13.8 wallet sweeps per Bitcoin block during the suspected fourth wave, against a baseline near 0.3 before the incident .

One attacker choice worked in victims' favor. The sweep transactions opted into replace-by-fee, the Bitcoin policy that lets an unconfirmed transaction be replaced by a higher-fee version spending the same inputs. That meant a holder watching the mempool who spotted their own address being drained could broadcast a competing transaction with a larger fee and rescue the coins before confirmation . The window was measured in minutes and required active monitoring, so it favored technically engaged holders — a narrow group given that stolen coins had sat untouched for an average of 3.18 years .

The stolen funds have largely stayed put. Roughly 86–90% of the coins remain unmoved in attacker-controlled addresses, with laundering so far limited to two observed events: a single 64.9 BTC deposit to the Wasabi coinjoin service and 200 ETH sent to Tornado Cash on August 4, 2026 . Two explanations are consistent with the data and neither can be ruled out yet:

• Attribution pressure. Galaxy has shared attacker address lists with exchanges, compliance and investigative firms, and law enforcement, which raises the odds that a large deposit at a regulated venue gets frozen .
• Liquidity constraints. Moving four-figure BTC balances through mixers or OTC channels without severe slippage or exposure takes time; the small Wasabi and Tornado Cash transfers look like tests rather than a laundering program at scale .

For traders, the practical read is that dormant balances remain a live tracking signal. Any material movement out of the flagged clusters would be visible on-chain and would likely register first as exchange-deposit flow, not as spot selling pressure. Until that happens, the $115M-plus figure is better understood as frozen inventory under surveillance than as capital already recycled into the market .

Is Your Coldcard Wallet Still at Risk? What Actually Fixes It

Your Coldcard is still at risk if the seed phrase was generated on an affected device and affected firmware, even after you install the patch. Coinkite is explicit on this point: updating firmware does not repair an existing seed, and only wallets created after the fixed build is installed are protected . The patch closes the entropy defect for future key generation; it cannot retroactively add the missing bits to a key that already exists on the blockchain. Every affected user therefore faces a migration, not an update.

There are only two narrow conditions under which an affected seed is not considered at risk. The first is dice-generated entropy: seeds created with at least 50 fair, independent, private rolls entered through the Add Dice Rolls feature. Coinkite states that 50 to 98 rolls contribute at least 128 bits of entropy, and 99 or more contribute roughly 256 bits, which swamps the defective software output . The second is a strong, unique BIP-39 passphrase. That is a weaker form of protection — it raises the attacker's cost without repairing the underlying seed — and Coinkite still instructs passphrase users to migrate . Anything short of those two cases should be treated as exposed.

The second point that trips people up is location. Exposure is determined by where the seed was generated, not where the coins sit today. A seed created on an affected Coldcard and later imported into a phone wallet, a different hardware device, or a multisig coordinator carries the same weakness with it. The reverse also holds: a seed generated safely on other hardware and imported into a Coldcard is not degraded by that import . Moving funds to a new address derived from the same compromised seed accomplishes nothing, because the attacker reconstructs the master key, not an individual address.

Coinkite's published migration path is sequential, and the order matters:

• Install the fixed firmware for your model and track — 4.2.0 for Mk2/Mk3, 5.6.0 for Mk4/Mk5 standard, 1.5.0Q for Q standard, 6.6.0X and 6.6.0QX for the Edge builds, all released July 31, 2026 .
• Generate a completely new seed on the patched device. Do not clone, restore, or duplicate the old one — cloning carries the weak entropy forward.
• Verify the new backup and wallet fingerprint before anything else touches the device, so you know the wallet you are about to fund is the one you wrote down.
• Send a small test transaction to the new wallet and confirm you can spend from it.
• Move the remaining funds only after that confirmation succeeds .

The step most often missed is repetition. The migration has to be run for every wallet that derives from the affected seed, not just the main balance: passphrase wallets, BIP85 child keys, separate accounts, and any multisig policy that includes an affected key . Multisig is the most awkward case, since replacing one cosigner key means rebuilding and re-registering the policy across every device in the quorum, and the funds must be swept to the newly created policy rather than left under the old descriptor.

Two practical caveats close out the risk picture. Coinkite has shipped emergency firmware for every affected model and destroyed remaining inventory carrying vulnerable builds, but it has not offered compensation, so the cost and effort of migration sit with the holder . And while Galaxy Research reported no high-confidence attacker activity after August 6, 2026, it explicitly cautioned that further losses remain possible . A quiet mempool is not a fix; the only fix is a new seed.

The $15 Billion Ripple Effect: Why Long-Term Holders Are Moving Coins

The largest financial consequence of the Coldcard flaw was not the theft but the evacuation it triggered. Roughly 233,000 BTC — about $15 billion — moved out of long-term holder wallets in the days around the breach, according to Checkonchain data compiled by analyst James Check and cited by Casa CEO Nick Neuman . That is roughly 100 times the value taken by attackers, moved voluntarily by holders re-seeding wallets, consolidating to new addresses, or stepping away from self-custody entirely.

The composition of that flow matters more than the headline figure. About 22,000 BTC went to exchanges as holders de-risked, while the remainder appears to have moved to freshly generated wallets and multisig arrangements rather than to sell-side venues . Glassnode recorded long-term holder supply falling from approximately 15 million BTC to 14.7 million in the same window — the largest weekly drop in that cohort since December 2024 . On-chain metrics that reset a coin's age on any spend will register a seed migration identically to a panic sale, so the drop should be read as a custody event first and a sentiment signal second.

"Somewhere between ~10x-100x the amount of bitcoin stolen was moved to safety as people sounded the alarm," — Nick Neuman, CEO at Casa (source: Decrypt, 2026-08).

The victim profile explains why the cohort data moved so sharply. Coins swept by attackers had sat untouched for an average of 3.18 years, meaning the people hit were overwhelmingly long-term holders rather than active traders . Coldcard's user base skews toward holders who set up a device once, verified a backup, and deliberately stopped touching it — precisely the behavior that left seeds generated on vulnerable firmware sitting untested for years. The same discipline that protected these wallets from phishing and exchange failures also meant nobody had a reason to revisit the device between March 2021 and July 2026.

For traders reading the tape, the practical implication is that supply-age indicators were distorted for at least a week. A spike in coin-days destroyed or a fall in long-term holder supply normally signals distribution; in this case a large share reflected identical balances rewritten to new keys. Exchange inflows of 22,000 BTC are the subset that carried genuine sell-side risk, and that figure is under 10% of the total moved . Treat any single-vendor security event as a potential source of noise in cohort metrics, and separate address churn from actual exchange deposits before drawing a directional conclusion.

What Happens Next: Investigation Status and Unanswered Questions

The active phase of the Coldcard exploit appears to have stopped, but the case is not closed. Galaxy Research reported no high-confidence attacker activity after August 6, 2026, while cautioning that further losses remain possible because unmigrated vulnerable seeds are still sitting on-chain . A pause in sweeps is not the same as remediation: every wallet whose seed was generated on affected firmware and never rotated remains a standing target for any of the parties who already reproduced the generation process.

Investigative work has shifted from detection to victim outreach and fund tracing. Alex Thorn, Galaxy's head of firmwide research, has spoken with between 190 and 200-plus victims, and Galaxy has distributed attacker address lists to exchanges, compliance vendors, investigative firms and law enforcement . That distribution matters more than usual here, because roughly 86–90% of the stolen bitcoin has not moved from attacker-controlled addresses . Coins that sit still are coins that can be flagged at the point of conversion — but flagging is not freezing, and no recovery has been reported.

Coinkite's own position is unresolved in a way holders should note. The Canadian manufacturer shipped emergency firmware for every affected model and track on July 31, 2026, and destroyed remaining inventory carrying vulnerable builds . It has not offered compensation to affected users. Its security status page also states that it does not attempt to determine the cause of any individual reported loss, which leaves victims without a vendor-side adjudication of their claims . The formal technical postmortem was still in progress as of August 13, 2026 .

Four questions stay open, and each one should be tracked rather than assumed:

• The final loss figure. Published tallies ranged from $112M to $130M within two weeks, with Galaxy's suspected fourth wave of roughly 459 BTC still not fully victim-confirmed . Cite the source and date, not a settled number.
• Operator structure. TRM Labs declined to attribute the theft to any named actor, noting that transaction construction differed across waves — evidence of multiple independent parties rather than one crew .
• Notification coverage. There is no mechanism to reach owners of air-gapped devices who never registered, follow vendor channels, or read crypto press.
• The postmortem's findings. Coinkite has said it does not know who found the bug and suspects an automated code-combing tool — an audit it had itself attempted weeks earlier without catching the defect .

The concrete takeaway: treat August 6 as a lull, not an all-clear. If any seed you control was generated on a Coldcard running Mk2/Mk3 firmware 4.0.1–4.1.9, Mk4/Mk5 below 5.6.0, Q below 1.5.0Q, or the Edge tracks below 6.6.0X/6.6.0QX, migrate to a freshly generated seed this week rather than waiting for the postmortem . No pending report will restore entropy that was never there, and no vendor statement so far commits to making victims whole.

Last updated: 2026-08-18. Figures reflect Galaxy Research, TRM Labs and Coinkite disclosures published through August 16, 2026; totals remain provisional pending Coinkite's technical postmortem.

Frequently asked questions

What caused the Coldcard hardware wallet hack?

A code migration, not a network breach. In March 2021, Coinkite moved Coldcard's seed generation to the libngu library, and the new call — ngu.random.bytes() — resolved at link time to MicroPython's Yasmarang software pseudo-random number generator instead of the device's hardware true random number generator . Block's engineering review traced the mechanism further: MICROPY_HW_ENABLE_RNG was defined as zero, but libngu only checked whether the macro was defined, not whether it was enabled, and the vulnerable path shipped in firmware v4.0.0 on March 17, 2021 . Because software PRNG output is reproducible, attackers could replicate the generation process on their own hardware and brute-force valid recovery phrases offline — entropy fell to roughly 40 bits on Mk3 against an intended 128 .

Which Coldcard models are affected by the entropy flaw?

Coinkite's advisory names four affected tracks: Mk2 and Mk3 running versions 4.0.1 through 4.1.9 inclusive; Mk4 and Mk5 standard firmware before 5.6.0; Coldcard Q standard before 1.5.0Q; and the Edge tracks before 6.6.0X (Mk4/Mk5) and 6.6.0QX (Q) . TAPSIGNER, OPENDIME and SATSCARD are not affected because they run separate codebases . Exposure follows where a seed was generated, not where it sits today: a seed created safely on another device is not weakened by being imported into a Coldcard, and a weak Coldcard-generated seed stays weak after being restored into any other wallet .

Does updating my Coldcard's firmware fix an existing wallet?

No. Patched firmware protects only seeds generated after the update; it cannot add entropy retroactively to a key that was already created with a weak one . Coinkite released fixed builds for every affected track on July 31, 2026 — 4.2.0 for Mk2/Mk3, 5.6.0 for Mk4/Mk5 standard, 1.5.0Q for Q standard, and 6.6.0X and 6.6.0QX for the Edge tracks . The vendor's migration guide directs affected owners to install the fixed firmware, generate a completely new seed rather than clone the old one, verify the backup and wallet fingerprint, send a small test transaction, then move remaining funds — repeating the process for base wallets, passphrase wallets, BIP85 children, additional accounts and any multisig policy that depends on the affected seed .

How do I know if my Coldcard-generated seed is at risk?

Assume it is at risk unless one of two narrow conditions applies. Coinkite states that funds are protected only if the seed was created with at least 50 fair, independent, private dice rolls entered through the Add Dice Rolls feature — 50 to 98 rolls add at least 128 bits of entropy and 99 or more add roughly 256 bits — or if the wallet is guarded by a strong, unique BIP-39 passphrase . A passphrase lowers immediate exposure but does not repair the underlying seed, and Coinkite tells passphrase users to migrate anyway . If your seed was generated on an affected model within the vulnerable firmware window and neither condition holds, treat the key as compromised and move funds to a freshly generated seed. Coinkite's status page publishes current firmware availability and explicitly declines to adjudicate the cause of any individual reported loss .

How much has been stolen in the Coldcard hack so far?

Estimates range from about $112 million to $130 million depending on the tracker, methodology and cut-off date, so no single number is settled. Galaxy Research counted 1,596 BTC confirmed stolen from roughly 7,300 addresses across three waves plus 14 smaller incidents, with a suspected fourth wave of about 459 BTC that would lift the total to 2,055 BTC or roughly $130 million . Galaxy figures reported on August 16 based on data through August 13, 2026 put losses above $115 million , while TRM Labs tallied about 1,816 BTC (~$116 million) from more than 5,200 addresses, ranking the incident third-largest of 2026 year-to-date within $1.2 billion stolen across 276 incidents . The independent tracker coldcardentropy.org documents a confirmed-core dataset — 500 transactions, 1,324 source UTXOs, 500 unique source addresses and 594.51379184 BTC in source input for the July 30 coordinated sweep — while labelling wider address sets as attributed or provisional .

Enjoyed this article? Subscribe to get new stories by email whenever they're published.

Subscribe