# Firmware Flaw in Coldcard Bitcoin Wallets Enables $116 Million Multi-Wave Heist

*2026-08-05 06:01 UTC · Technology · 1 min read*

> A 2021 firmware bug in Coinkite's Coldcard hardware wallets let hackers drain over $116 million in Bitcoin across four waves of theft.

Hackers exploited a five-year-old firmware bug in Coldcard hardware wallets, made by Canadian security firm Coinkite, to drain more than $116 million in Bitcoin from over 5,200 addresses across four separate waves of theft beginning July 30, 2026.

The vulnerability traces to a March 2021 firmware update that mistakenly routed recovery-phrase generation through a predictable software random-number generator instead of the device's dedicated hardware chip, leaving some wallets with as little as 40 bits of effective entropy versus the 128 bits needed for real security. That gap let attackers reverse-engineer seed phrases and empty wallets without ever touching the physical devices. The first wave alone drained roughly 1,083 Bitcoin, worth about $70 million, in just 41 minutes.

Coinkite CEO Rodolfo Novak called the company "heartbroken" and took "full accountability," shipping emergency firmware for every affected model on July 31. Security researchers at Galaxy Research and Block, who first flagged the pattern, say the case underscores how a years-old software oversight in supposedly offline "cold storage" devices can still leave crypto holders exposed.

## Sources

- [fortune.com](https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/)
- [thehackernews.com](https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html)
- [cbc.ca](https://www.cbc.ca/news/world/bitcoin-coinkite-security-hack-9.7295582)

---
TechTools News · https://techtools.cz/tools/news/article/2134-firmware-flaw-in-coldcard-bitcoin-wallets-enables-116-million-multi-wave-heist
Česká verze: https://techtools.cz/tools/news/clanek/2207-chyba-ve-firmwaru-bitcoinovych-penezenek-coldcard-umoznila-loupez-za-116