1,816 Bitcoin Drained From Coldcard Wallets in Seed Generation Exploit
Key Facts
Attackers drained about 1,816 Bitcoin, worth nearly $116 million, from more than 5,200 addresses in attacks exploiting a weakness in Coldcard wallet seed generation, according to an assessment by TRM Labs on 5 August 2026. The firm said the attacks began on 30 July 2026 and spanned 4 waves of withdrawals from affected addresses. Detailing the speed of the initial withdrawals, law firm Fieldfisher said about 594 Bitcoin disappeared from roughly 500 wallets within about 25 minutes of the first wave. Coinkite, the wallet manufacturer, said attackers exploited weak seeds outside the devices to regenerate private keys. In its explanation of the incident, it said "the Coldcard devices themselves were not hacked, accessed or taken over remotely." The company confirmed that the software fix corrects future seed generation but does not fix an affected seed that has already been created.
The official security advisory covered seeds from Mk4, Q and Mk5 models that predated the patched firmware releases. According to Coinkite, affected seeds provided about 72 bits of randomness, instead of the expected 128 bits. The flaw is linked to the seed creation process used by the wallets, and the company said the Yasmarang generator became part of that process with the switch to the libngu library in March 2021. In its account of the technical background, the company linked the generator's introduction into seed creation to that software transition. On responsibility for the firmware failure, law firm WeirFoulds said Coinkite Chief Executive Rodolfo Novak had publicly apologised. The firm added that Novak said the company took full responsibility for the failure.
On legal proceedings, Coinkite announced a temporary suspension of the automatic deletion of customer data. It said the decision included preserving records potentially relevant to ongoing and anticipated legal proceedings. On cryptocurrency recovery, Steptoe said in a September statement that the Crypto Recovery Trust had returned more than 20 Bitcoin to its owner. The firm said white-hat security specialists had deposited about 50 Bitcoin linked to the Coldcard exploit with the trust. On the options available to those affected, law firm Stoltmann said tracing the cryptocurrency could support reports to law enforcement, evidence preservation requests and urgent court proceedings. But it stressed the limits of that approach, saying "recovery of funds is never guaranteed, and prompt reporting generally provides more options than waiting."
In the market, Bitcoin fell 0.8% to $62,650.4 during initial coverage of the incident on 3 August 2026, according to Investing.com. The price was recorded at 13:32 GMT. The decline came amid pressures including the Coldcard incident and weak results from companies in the sector. The price move coincided with the continued waves of cryptocurrency withdrawals identified by TRM Labs in its subsequent assessment. The pressures discussed in the market coverage combined security developments and the performance of cryptocurrency companies.
For owners of affected seeds, Coldcard's migration guide sets out a procedure beginning with installing the patched firmware release on the device. The company then recommends generating an entirely new seed for the wallet to which the funds will be transferred. Verification of the new wallet comes before transferring the balance to it, according to the sequence published by the company. After verification, it recommends moving the funds to the wallet created with the new seed to complete the migration from the affected seed. Alongside this guidance, the company says a separate, detailed technical report on the incident remains in preparation.