ColdCard firmware bug exposed Bitcoin to theft; users seek alternative wallets

Coinkite, the company behind ColdCard hardware wallets, disclosed on July 30 that a firmware bug dating to March 2021 had compromised the seed generation process on multiple device models. The flaw affected ColdCard Mk2 and Mk3 units running firmware versions 4.0.1 through 4.1.9, as well as early releases of Mk4, Mk5, and Q models. Seeds generated on these devices during the vulnerable period became susceptible to compromise if users relied solely on the device's randomization without supplementing it with dice rolls or a strong BIP-39 passphrase.

Blockchain intelligence firm TRM Labs quantified the damage in its analysis. Starting July 30, 2026, attackers began systematically sweeping Bitcoin from affected ColdCard-secured wallets across four waves, ultimately draining approximately 1,816 BTC—valued around $116 million—from more than 5,200 addresses. This made it the third-largest crypto hack of the year according to TRM Labs' assessment.

Coinkite acknowledged in its security advisory that the incident represented some of the most difficult days in the company's history, recognizing that users had lost savings accumulated over years. The critical caveat is that updating firmware provides no protection for wallets already created during the vulnerable window. Users who generated seeds on affected ColdCard devices during the five-year vulnerability period must treat those seeds as compromised and migrate their funds to entirely new seeds, a process that goes beyond a routine security patch. This requirement has prompted affected users and self-custody practitioners to explore alternative hardware wallet providers.