Predictable Coldcard randomizer flaw let hackers steal 1,816 BTC
A major vulnerability in Coldcard's hardware wallet let hackers steal about 1,816 BTC (about $114 million) across four waves of attacks since July 30, 2026.
The problem was a predictable randomizer in a firmware update from March 2021, which made it easy for attackers to recreate users' private keys.
In the latest wave, hackers used Bitcoin's replace-by-fee feature, giving victims a small window to recover funds if they acted fast.
Coinkite released emergency firmware
The first attack drained 1,083 BTC from 1,196 addresses in just 41 minutes.
By the end of the weekend, losses had spread to 4,585 addresses (multisignature wallets were safe).
Coinkite quickly released emergency firmware and told users who had generated a seed on the flawed software to move their Bitcoin to new wallets with freshly generated seeds.