Coldcard bug ripples out: over 1,000 BTC stolen
Brothers, let me tell you something.
If you’ve used Coldcard, now—right now—don’t scroll any further: go check your firmware version first.
Between 1:10 a.m. and 1:51 a.m. on July 30. 41 minutes.
1,196 addresses were emptied.
1,082.65 BTC, about $70 million, vanished out of Coldcard wallets that had been locked in safes, disconnected from the network, and left untouched for months or even years—out of thin air.
The device was never touched the entire time.
The attacker didn’t even touch your wallet. Your wallet might be welded into a safe, or buried in a basement—doesn’t matter.
This could be the most ironic incident of 2026.
What’s the biggest selling point of a hardware wallet?—“Private keys never touch the internet, physical isolation, absolute security.”
So what happened? The vulnerability is in a single line of code from March 2021.
Coldcard’s firmware is supposed to call the hardware RNG to generate the seed phrase. But a build check only verified that the “setting exists,” not that the “setting is enabled”—so the system silently fell back to a software RNG.
And what’s the seed for this “software random number”? The chip serial number + the clock register.
The serial number is fixed factory data. The clock value is a time-state that can be inferred.
It’s like using your safe password as: factory number + the current time.
The attacker only needs to brute-force on their own device—Mk3’s search space is only about 40 bits, while the secure seed should be 128 bits. 40 bits—modern computers can compute it in minutes.
You thought it was fortress-grade security. Turns out it’s paper-thin. A hacker sits at home with coffee, calculating your private keys.
What’s even more painful is that this isn’t a problem from some “niche no-name” vendor.
Coldcard is one of the most revered hardware wallets in the Bitcoin community—“geek’s first choice,” “a symbol of self-custody faith.” Result? Mk3 from 4.0.1 to 4.1.9—hit across the board. Then the advisory expanded: Mk4 and Mk5 below version 5.6.0, and Q below version 1.5.0Q—also affected.
Nearly the whole line is compromised.
CEO Rodolfo Novak (NVK) apologized on Friday, saying the company takes full responsibility and admitting internal review processes failed to catch the issue.
Then he said a chilling line that sent shivers through the whole industry—this vulnerability was very likely discovered by AI.
Coinkite had just scanned its own code with the most advanced AI models a few weeks ago—nothing was found. The hacker used the same kind of tools, and found it.
Defenders and attackers are holding the same weapons—yet the attacker wins.
Now, here comes the most critical question—
“Hardware wallets are safer than exchanges”—does this belief still hold up?
Over the past five years, every time an exchange blew up, ran away, or got hacked, we told ourselves: it’s fine, as long as we control our private keys, we’re safe. Buy Coldcard, generate offline, physical isolation, foolproof.
So what happened? A one-line code defect erupted five years later all at once. Your coins stored in a cold wallet, versus coins on an exchange being swept by hackers—same ending: gone.
Bitcoin developer Peter Todd said this is something he’s been worried about for years. Commercial hardware wallets run code, and the independent review those codes receive is extremely limited. The “hardware” you trust is, in essence, trusting a closed-source black box that almost nobody has audited.
Even worse—if you export the seed phrase to another wallet, the vulnerability still follows you. Because the problem happens at the moment the seed phrase is generated, not in the device itself.
Your “self-custody” hasn’t been self-custody since the moment the seed was generated five years ago.
Let me put it bluntly:
You think you’re “keeping Bitcoin yourself.” In reality, you’re “keeping Bitcoin for the hacker”—they’re just picking the time to come and take it.
Five years. Those 1,000+ BTC have been sitting in those addresses, the owners assuming it’s foolproof. After March 2021, the hacker could calculate them any time—only they chose July 30, clearing everything in 41 minutes.
You stayed up late researching how to store securely—one line of code sent you back to square one.
So what do you do now?
Step 1: Check your Coldcard firmware version. Mk3 4.0.1 to 4.1.9, Mk4/Mk5 below 5.6.0, Q below 1.5.0Q—if you generated the seed phrase with any of these versions, assume by default you’re exposed.
Step 2: Update the firmware to the latest version—Mk3 4.2.0 or above, Mk4/Mk5 5.6.0 or above, Q 1.5.0Q or above.
Step 3: Updating firmware doesn’t fix already-generated seeds. You need to regenerate entirely new seed phrases using the updated device, create new addresses, and then migrate all assets over.
Step 4: Before migrating, do a small test transfer first. Confirm everything is correct, then transfer the balance.
If you used extra dice entropy or a BIP39 passphrase when generating the seed—congratulations—you’re most likely safe. But Coinkite still recommends migrating.
One last question for everyone:
If even Coldcard can have something like this—are you really that confident about the other hardware wallets you hold? #Gate独家美股0费率 #USD1持币生息最高8% #长鑫科技市值突破4万亿元 $BTC $ETH $SOL
Brothers, let me tell you something.
If you’ve used Coldcard, now—right now—don’t scroll any further: go check your firmware version first.
Between 1:10 a.m. and 1:51 a.m. on July 30. 41 minutes.
1,196 addresses were emptied.
1,082.65 BTC, about $70 million, vanished out of Coldcard wallets that had been locked in safes, disconnected from the network, and left untouched for months or even years—out of thin air.
The device was never touched the entire time.
The attacker didn’t even touch your wallet. Your wallet might be welded into a safe, or buried in a basement—doesn’t matter.
This could be the most ironic incident of 2026.
What’s the biggest selling point of a hardware wallet?—“Private keys never touch the internet, physical isolation, absolute security.”
So what happened? The vulnerability is in a single line of code from March 2021.
Coldcard’s firmware is supposed to call the hardware RNG to generate the seed phrase. But a build check only verified that the “setting exists,” not that the “setting is enabled”—so the system silently fell back to a software RNG.
And what’s the seed for this “software random number”? The chip serial number + the clock register.
The serial number is fixed factory data. The clock value is a time-state that can be inferred.
It’s like using your safe password as: factory number + the current time.
The attacker only needs to brute-force on their own device—Mk3’s search space is only about 40 bits, while the secure seed should be 128 bits. 40 bits—modern computers can compute it in minutes.
You thought it was fortress-grade security. Turns out it’s paper-thin. A hacker sits at home with coffee, calculating your private keys.
What’s even more painful is that this isn’t a problem from some “niche no-name” vendor.
Coldcard is one of the most revered hardware wallets in the Bitcoin community—“geek’s first choice,” “a symbol of self-custody faith.” Result? Mk3 from 4.0.1 to 4.1.9—hit across the board. Then the advisory expanded: Mk4 and Mk5 below version 5.6.0, and Q below version 1.5.0Q—also affected.
Nearly the whole line is compromised.
CEO Rodolfo Novak (NVK) apologized on Friday, saying the company takes full responsibility and admitting internal review processes failed to catch the issue.
Then he said a chilling line that sent shivers through the whole industry—this vulnerability was very likely discovered by AI.
Coinkite had just scanned its own code with the most advanced AI models a few weeks ago—nothing was found. The hacker used the same kind of tools, and found it.
Defenders and attackers are holding the same weapons—yet the attacker wins.
Now, here comes the most critical question—
“Hardware wallets are safer than exchanges”—does this belief still hold up?
Over the past five years, every time an exchange blew up, ran away, or got hacked, we told ourselves: it’s fine, as long as we control our private keys, we’re safe. Buy Coldcard, generate offline, physical isolation, foolproof.
So what happened? A one-line code defect erupted five years later all at once. Your coins stored in a cold wallet, versus coins on an exchange being swept by hackers—same ending: gone.
Bitcoin developer Peter Todd said this is something he’s been worried about for years. Commercial hardware wallets run code, and the independent review those codes receive is extremely limited. The “hardware” you trust is, in essence, trusting a closed-source black box that almost nobody has audited.
Even worse—if you export the seed phrase to another wallet, the vulnerability still follows you. Because the problem happens at the moment the seed phrase is generated, not in the device itself.
Your “self-custody” hasn’t been self-custody since the moment the seed was generated five years ago.
Let me put it bluntly:
You think you’re “keeping Bitcoin yourself.” In reality, you’re “keeping Bitcoin for the hacker”—they’re just picking the time to come and take it.
Five years. Those 1,000+ BTC have been sitting in those addresses, the owners assuming it’s foolproof. After March 2021, the hacker could calculate them any time—only they chose July 30, clearing everything in 41 minutes.
You stayed up late researching how to store securely—one line of code sent you back to square one.
So what do you do now?
Step 1: Check your Coldcard firmware version. Mk3 4.0.1 to 4.1.9, Mk4/Mk5 below 5.6.0, Q below 1.5.0Q—if you generated the seed phrase with any of these versions, assume by default you’re exposed.
Step 2: Update the firmware to the latest version—Mk3 4.2.0 or above, Mk4/Mk5 5.6.0 or above, Q 1.5.0Q or above.
Step 3: Updating firmware doesn’t fix already-generated seeds. You need to regenerate entirely new seed phrases using the updated device, create new addresses, and then migrate all assets over.
Step 4: Before migrating, do a small test transfer first. Confirm everything is correct, then transfer the balance.
If you used extra dice entropy or a BIP39 passphrase when generating the seed—congratulations—you’re most likely safe. But Coinkite still recommends migrating.
One last question for everyone:
If even Coldcard can have something like this—are you really that confident about the other hardware wallets you hold? #Gate独家美股0费率 #USD1持币生息最高8% #长鑫科技市值突破4万亿元 $BTC $ETH $SOL
0