Wallet flaw drains $38M BTC funds

TLDR

A flaw in certain Coldcard Bitcoin hardware wallets let an attacker guess wallet seeds and drain about 594 BTC, roughly $38 million, from hundreds of wallets.

1. The incident centers on a Coldcard firmware randomness bug that made some seed phrases guessable, enabling an automated sweep of around 500 single?signature wallets.
2. Risk is concentrated in seeds created on specific Coldcard firmware versions without extra entropy or a BIP?39 passphrase; newer devices and protected seeds appear far safer.
3. Bitcoins price and broader market have barely moved, but the event is a serious wake?up call on hardware wallet auditing, randomness, and seed?generation hygiene.

Deep Dive

1. What Actually Happened

Multiple reports describe an attacker exploiting a Coldcard firmware bug to drain about 594 BTC, worth roughly $38 million, from around 500 single?signature wallets in a three?block window between 01:31 and 01:56 UTC on 3031 July 2026, with most funds consolidated to a single address that has not moved yet. This sweep and its timing are detailed in incident coverage from outlets such as CoinDesk, which traced a broken randomness check that caused devices to fall back to predictable key generation seeded by chip data rather than true hardware entropy, turning unguessable seeds into brute?forceable ones.

Several analysts believe the attacker used automated tooling, potentially including AI, to scan open?source firmware history and target the weak seed space, though the AI angle remains speculative and not strictly necessary to explain the attack.

Confidence: moderate because onchain traces and independent reports align, but the full technical post?mortem is still in progress.

2. Who Is At Risk And Why

Coinkites advisory and follow?up analyses indicate highest risk for Coldcard Mk3 seeds generated on firmware 4.0.1 through 5.0.3, with some reporting that older Mk4, Q, and Mk5 firmware also produced seeds with reduced entropy before later fixes, while updated versions are considered safe for new seeds. Coverage of the advisory notes that affected seeds may have only 72 bits of entropy instead of the expected 128, dramatically shrinking the search space and making private keys feasibly guessable for a determined attacker.

Several reports stress that updating firmware does not repair a seed already created on a vulnerable version; any wallet or multisig using that seed remains at risk even if imported into another wallet. At the same time, seeds protected with a strong, unique BIP?39 passphrase or generated with sufficient dice?roll entropy are described as having much lower exposure, because the attacker would need to break both the weak base seed and the extra secret.

3. Impact On Bitcoin And Hardware Wallet Trust

Market coverage notes that despite the headline size, Bitcoin stayed roughly in the mid?$60,000 range, with only modest intraday swings and no major breakdown tied directly to the exploit. Some analysts flag the attack as one contributor to cautious sentiment, but macro factors and ETF flows appear more important for price action than this single hack.

The deeper impact is reputational. Hardware wallets are marketed as offline safety, yet this incident shows that if firmware randomness is flawed, seeds can be weak even without any user mistake. It is already prompting calls for more independent audits of wallet code, deterministic tests of hardware entropy, and greater user awareness of seed?generation methods, passphrases, and multisig design.

Risk note: Weak randomness and opaque firmware turn self?custody into a single point of failure, where one bug can expose many long?dormant high?value wallets at once.

Conclusion

A single firmware bug in a popular Bitcoin hardware wallet turned supposedly secure seeds into guessable targets, enabling an automated theft of roughly $38 million in BTC without any direct user interaction. While Bitcoins price impact has been limited so far, the event sharply underlines that self?custody security depends on audited randomness, robust seed practices, and defense?in?depth, not just using a hardware device. For crypto users, the practical takeaway is to pay close attention to how seeds are created, what firmware and entropy they rely on, and to follow trustworthy vendor and independent security guidance when evaluating whether old wallets could be exposed.