The Coldcard Hack: If You Made Your Seed on One, Move Your Bitcoin Now
10 min readUpdated 3 August 2026
Loading...
10 min readUpdated 3 August 2026
If you have ever created a bitcoin wallet seed phrase on a Coldcard hardware wallet, stop reading in a minute and go check it. This one is urgent and it is still happening.
A software bug that sat undetected for about five years made the seed phrases produced by some Coldcard devices far easier to guess than they were supposed to be. Attackers worked that out, and since 30 July 2026 they have been emptying wallets in waves.
By 3 August 2026, on-chain analysis by Galaxy Research put the total at roughly 1,816 BTC, about $116 million, across more than 5,200 addresses. The figure has risen every single day this week.
It has come in four distinct waves, and the later ones went after smaller balances:
| Wave | Dates | BTC taken | Running total | Addresses |
|---|---|---|---|---|
| 1 | 29 to 30 July | 1,082.65 | 1,082.65 | 1,196 |
| 2 | 31 July to 1 Aug | 199.35 | 1,282.00 | 2,800 |
| 3 | 2 to 3 Aug | 85.05 | 1,367.05 | 4,585 |
| 4 | 3 Aug, live | ~449 | ~1,816 | 5,200+ |
If you see a lower figure quoted somewhere, around $88 million from 4,585 addresses, that is the wave 3 total and it was accurate a day ago. This is a live incident and every number in this article carries a date for that reason.
A seed phrase is the list of words that controls your bitcoin. Whoever knows it owns the coins. It is supposed to be generated from genuine randomness, so that guessing it is impossible.
Coldcard devices contain a dedicated chip for producing true randomness. Because of a build error, some firmware versions quietly stopped using that chip and fell back to an ordinary software random number generator instead. Software randomness of that kind is predictable if you know how it works.
The result was seeds with far less randomness than advertised.
| Device | Randomness it should have had | What it actually had |
|---|---|---|
| Coldcard Mk3 | 128 bits | about 40 bits |
| Mk4 and Mk5, before the patch | 128 bits | about 72 bits |
Those numbers look abstract, so here is what they mean. Every bit you lose halves the work an attacker has to do. Going from 128 bits to 40 bits does not make guessing a bit easier, it turns something impossible into something a determined attacker can simply grind through. That is exactly what happened.
Reporting indicates the first wave drained around $38 million in under half an hour.
This part is worth understanding, because it explains why "just audit the code" is harder than it sounds. Two separate mistakes lined up.
First, a safety check asked the wrong question. The code contained a guard specifically designed to catch this exact mistake and refuse to build. But it was written to ask "has this setting been mentioned?" rather than "is this setting switched on?". The setting had been mentioned, and switched off. So the guard saw the mention, concluded everything was fine, and let the build through.
Second, two different functions had the same name. With the hardware generator switched off, the build quietly included a backup software generator. That backup and the real hardware driver both used the identical function name. When the parts were assembled into the final program, the wrong one was selected. No warning was produced, because from the machine's point of view nothing was wrong.
The hardware random-number code was still sitting in the finished device, still being used for other things like encrypting backups. It simply was not being used for the one job that mattered most.
Reported by multiple outlets as affected:
Coinkite, the company that makes Coldcard, initially flagged the Mk3 and later acknowledged that its other models were affected too. Its CEO, Rodolfo Novak, has apologised publicly and said he takes full accountability.
Coinkite released fixes on 31 July 2026: version 4.2.0 or later for Mk2 and Mk3, 5.6.0 or later for Mk4 and Mk5, and 1.5.0Q or later for Q. If you run the experimental "Edge" builds, the equivalents are 6.6.0X and 6.6.0QX.
Two things reportedly reduce the risk considerably:
This is the part most coverage has skipped, and getting it wrong can cost you money during the rescue.
First the good news. None of the attack waves so far has touched multisig setups, which fits the flaw affecting single-key seeds. If one key in your multisig came from an affected Coldcard, the attacker needs more keys than they have.
Now the danger, and it is genuinely counter-intuitive.
If your setup has any alternative spending route that a single compromised key could satisfy, such as an expired timelock or a recovery path, an attacker can build a competing transaction, attach a higher fee, and have it confirmed instead of yours. Bitcoin has a built-in mechanism, replace-by-fee, that makes this straightforward.
So if you hold multisig, a timelocked wallet, or anything more complicated than a single seed:
"Not your keys, not your coins" is the oldest advice in bitcoin, and it is broadly right. Holding your own keys removes the risk that an exchange fails, freezes, or turns out to be lying about its reserves.
But this event shows the other half of the trade honestly.
Self-custody moves the risk. It does not delete it. You stop depending on an exchange and you start depending on a device, its firmware, and the correctness of code you cannot inspect. This bug was invisible for five years. Nobody holding one of these wallets did anything wrong. They followed the best advice available and were still exposed.
The practical version of that lesson is boring and effective: do not keep everything in one place, under one method, with one point of failure. Split across custody methods the same way you would split across assets. We wrote about the general shape of that problem in how much crypto is too much.
Some clarity, because a story this size produces a lot of noise.