On 30 July 2026, an attacker drained 1,082.65 Bitcoin — worth roughly $70 million at the time — from 1,196 wallet addresses in a single 41-minute window, without ever touching a physical device. The victims all used Coldcard, a popular Bitcoin-only hardware wallet made by Canadian firm Coinkite and marketed as one of the more security-conscious options on the market. Researchers at Galaxy Research traced the sweep to a firmware bug dating back to March 2021: a build setting meant to route key generation through the device's dedicated hardware random number generator was checked for whether it existed, not whether it was actually enabled, so key generation silently fell back to a weak software substitute seeded from predictable values — the chip's serial number and internal clock registers.
That fallback made supposedly random wallet seeds computationally guessable. The attacker generated candidate seeds on their own hardware, worked out which Bitcoin addresses each one would produce, and checked those addresses against the public blockchain — no need to compromise a single victim's device or network. Coldcard's Mk3 model was hit hardest, with roughly 40 bits of entropy instead of the 128 bits a secure seed needs; newer Mk4, Mk5 and Q models fared better at around 72 bits, but Coinkite still called the exposure serious. Coinkite shipped emergency firmware on 31 July, but patching doesn't undo an already-generated seed — and there's no test to tell an individual owner whether their specific seed falls inside the guessable range. Owners have to assume exposure and move their coins to a freshly generated seed.
What this means for your business
You don't need to hold Bitcoin to take a lesson from this. Coldcard spent years marketing itself on exactly the security properties that failed here, and the bug sat undiscovered in a widely used, professionally built product for five years. The takeaway isn't "don't trust hardware wallets" — it's that a vendor's security claims, however credible-sounding, are marketing copy until something independently proves them. The same fallback trap applies to anything your own systems generate to protect value: API keys, session tokens, password-reset links, encryption keys. If a developer or vendor tells you those are generated securely, ask specifically what generates them and how it's tested — "it's encrypted" or "it's random" isn't an answer, it's a claim. A five-year gap between a bug shipping and it being found is the norm, not the exception, unless someone is actually checking.