Coinkite Coldcard Firmware Flaw Enables $100M+ Bitcoin Heist
Coldcard Wallet Flaw Leads to Theft of Over $100M in Bitcoin
Impact Scope
People Affected
Thousands of wallet users
Industries Affected
Related Entities(initial)
MITRE ATT&CK Techniques
Full Report(when first published)
Executive Summary
A critical firmware vulnerability, dormant for five years, in Coinkite's Coldcard hardware wallets has resulted in one of the largest cryptocurrency thefts of 2026, with losses estimated between $102 million and $130 million. The flaw, introduced in a March 2021 firmware release, caused a significant weakening of the random seed generation process. This allowed multiple, distinct hacking groups to brute-force the private keys of affected wallets and steal the Bitcoin stored within. The attack did not require any physical access to the devices, undermining the core security promise of a hardware wallet.
Vulnerability Details
The vulnerability was a result of a build configuration error in the Coldcard firmware. Under certain conditions, the firmware would fail to use the device's secure, hardware-based entropy source for generating the 128-bit seed phrase. Instead, it fell back to a much weaker software-based pseudorandom number generator (PRNG). This error catastrophically reduced the effective key strength from 128 bits to as low as 40 bits.
A reduction to 40 bits of entropy means there are only 2^40 (about one trillion) possible keys. While this is a large number, it is well within the capabilities of a modern, distributed cracking effort. Attackers were able to systematically generate keys, check them against the Bitcoin blockchain for a balance, and drain any wallets they successfully guessed.
Affected Systems
- Product: Coinkite Coldcard hardware wallets
- Versions: Any wallet that had a seed phrase generated on a device running firmware released between March 2021 and the emergency patch in July/August 2026.
Exploitation Status
The flaw has been actively and widely exploited since late July 2026. Researchers at Galaxy Research have observed multiple distinct hacking groups participating in the theft, suggesting the vulnerability's details may have been privately traded or discovered independently. The attacks occurred in waves, with one notable event seeing nearly 1,200 addresses drained in under an hour. The victims reportedly include high-profile users such as federal investigators and cybersecurity firms.
Impact Assessment
This incident has a devastating financial impact, with over $100 million in Bitcoin stolen. More importantly, it severely damages trust in a product line that was considered among the most secure in the industry. It demonstrates the catastrophic consequences of a single, subtle flaw in cryptographic implementations. For users, the promise of "cold storage" was broken, as their funds were stolen without their devices ever being physically touched or connected to the internet. The incident serves as a stark reminder that even the most secure hardware is only as strong as its underlying software and generation process.
Cyber Observables — Hunting Hints
For users and exchanges, identifying compromised wallets is key.
Detection Methods
Detection of this vulnerability is not possible from the user's end after the fact, other than by observing that their funds are missing. The vulnerability is in the initial generation of the seed phrase. The only reliable method of detection is to know the firmware version and date the wallet was created.
Remediation Steps
Coinkite has issued emergency firmware patches, but this is only a partial solution.
CRITICAL WARNING: Simply updating the firmware on an existing wallet does NOT fix the problem. If the seed phrase was generated with the weak firmware, it is permanently vulnerable.
- Immediate Fund Migration: Any user who generated a seed phrase on a Coldcard wallet between March 2021 and August 2026 MUST assume their wallet is compromised.
- Create a New Wallet: Users must update their device to the latest patched firmware.
- Generate a New Seed: After updating, users must generate a completely new seed phrase on the secure device.
- Transfer Funds: Users must then transfer all funds from their old, vulnerable wallet to the new, secure wallet address. This is the only way to secure the funds.
Timeline of Events
Article Updates
August 27, 2026
Specific Coldcard models affected by the firmware flaw have been identified, including MK2, MK3, MK4, Q, and MK5.
Update Sources:
MITRE ATT&CK Mitigations
Update device firmware before generating a new seed.
The core issue was a build configuration error, emphasizing the need for secure software development and testing processes.
Timeline of Events
Vulnerable firmware is released for Coldcard wallets.
Large-scale attacks draining vulnerable wallets begin.
Coinkite releases emergency firmware patches and urges users to migrate funds.
Sources & References(when first published)
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.