Archive · 2 Aug 2026
Coldcard Wallet Hack Steals $70M in 41 Minutes
A group of hackers stole about 1,000 bitcoins, worth around $70 million, from a bunch of special Bitcoin wallets called Coldcards.
These wallets are usually offline, so the hackers had a hard time getting in.
But the Coldcard software had a mistake that let the attackers guess the secret numbers that protect the wallets.
They used these guesses to find the wallets on the public Bitcoin network and moved the money in just 41 minutes.
The hack shows that even offline devices can be broken if their software isn’t perfect.
Nearly 1,000 bitcoins (~$70M) were drained from 1,196 Coldcard wallets in a 41‑minute window.
The theft exploited a firmware flaw that caused the device to use a predictable seed instead of a hardware random number generator.
Attackers generated candidate seeds, derived addresses, and checked them against the public blockchain to locate the wallets.
The breach affected older MK2 and MK3 Coldcard models, with newer MK4, Q, and MK5 also potentially vulnerable.
The incident underscores the risk of offline hardware wallets and the evolving threat landscape.
- Who
- Unknown attackers targeting Coldcard hardware wallets
- What
- Stole approximately 1,000 bitcoins (~$70M) from offline wallets
- When
- Between 01:10 and 01:51 UTC
- Where
- Bitcoin blockchain
- Why
- Exploited a firmware flaw that used a predictable seed instead of a hardware random number generator
- Total BTC stolen
- 1,082.65 BTC
- Estimated value
- $70 million
- Time window
- 41 minutes (01:10-01:51 UTC)
- Affected models
- Coldcard MK2, MK3, MK4, Q, MK5
- Key vulnerability
- Predictable seed due to firmware build setting