Coldcard Hardware Wallet Breach Results in $100M Bitcoin Theft A recent data breach has targeted Coldcard, a bitcoin-only hardware wallet, resulting in the theft of over $100 million USD in bitcoin. The attack, which has drawn significant attention in the cybersecurity community, highlights vulnerabilities in cryptocurrency storage solutions. Details surrounding the breach remain limited, but the incident underscores the growing sophistication of cybercriminals targeting digital assets. Coldcard, known for its security-focused design, is widely used by cryptocurrency holders seeking offline storage to protect against online threats. The breach serves as a reminder of the persistent risks in the cryptocurrency space, even for hardware-based wallets. Further investigations are expected to determine the exact method of exploitation and the full extent of the impact on affected users.

Massive Bitcoin Heist Linked to Coldcard Firmware Vulnerability On July 30, 2026, a coordinated attack drained 1,196 Bitcoin wallets, siphoning 1,082.65 BTC worth approximately $70.2 million in just 41 minutes. The theft, occurring between 01:10:20 and 01:51:26 UTC (blocks 960,183 to 960,191), has been attributed to a suspected vulnerability in Coldcard hardware wallet firmware. Researchers at Galaxy Research, building on findings from Block engineers and security researcher Clay Garrett, identified the attack as automated, with transactions exhibiting unusual patterns. Nearly all drained wallets (1,183) used SegWit BIP-84 derivation paths, while smaller numbers relied on BIP-49 (7) and legacy BIP-44 (6). This distribution suggests the attacker systematically scanned multiple address formats after gaining access to private keys. Every compromised wallet was fully emptied, with no change outputs a hallmark of automated theft. Transactions also featured an identical, hardcoded fee rate of 30.0 sat/vB, far exceeding the median network rate of 0.4–1.0 sat/vB at the time. Such overpayment is typical of malware or bulk-draining tools prioritizing speed over cost. The stolen funds were consolidated into four addresses holding 562.02 BTC, 398.48 BTC, 89.62 BTC, and 32.45 BTC, though no further movement had been detected at the time of reporting. The attack began roughly 30 hours before Coldcard issued a public advisory, raising concerns about delayed vendor response. While the attacker’s identity remains unconfirmed, the incident underscores risks associated with hardware wallet vulnerabilities and the importance of timely firmware updates.

Coldcard Hardware Wallet Breach Results in $88 Million Bitcoin Theft Canadian cryptocurrency hardware wallet manufacturer Coinkite has destroyed its remaining inventory of Coldcard devices after a firmware vulnerability led to the theft of over $88 million in bitcoin from customers. The breach, linked to a flaw first identified in March 2021, was exploited by attackers to siphon funds from 4,585 wallet addresses, with cybersecurity firm Galaxy Research confirming the loss of at least 1,367.05 BTC (approximately $88.6 million). Coinkite halted shipments of affected devices and released a patched firmware update to prevent further exploitation. The company urged users with compromised devices to retain them for potential fund recovery efforts, stating that its legal team is coordinating with law enforcement across multiple jurisdictions to identify the perpetrators. However, Coinkite has not indicated whether it will compensate victims. Blockchain analysis by Chainalysis revealed that the attackers targeted high-value wallets early in the campaign, with two victims alone losing a combined $4 million. The firm noted that the cumulative stolen value reached roughly $30 million within the first 10 minutes, suggesting the attackers had studied victim wallets in advance. Dozens of bitcoin holders have since reported losses on social media. A Coinkite senior official partially attributed the incident to AI-assisted code reviews, claiming that cybercriminals leveraged the technology to uncover latent vulnerabilities faster than traditional security experts could detect them. The FBI has not commented on whether it is investigating the breach.