A reported attack on Coldcard hardware wallets is said to have affected more than 1,000 Bitcoin addresses, though the full scope of the incident remains only partially verified. The claim centers on Bitcoin addresses tied to a Coldcard seed-generation weakness, not on any flaw in the Bitcoin network itself.
A reported attack on Coldcard hardware wallets is said to have affected more than 1,000 Bitcoin addresses, though the full scope of the incident remains only partially verified. The claim centers on Bitcoin addresses tied to a Coldcard seed-generation weakness, not on any flaw in the Bitcoin network itself.
What has been reported about the Coldcard hack
According to reporting from Fox Business, the attack drained Bitcoin from roughly 1,200 addresses linked to affected Coldcard devices. The same broad account has been echoed by Fortune, which framed the incident around research into the wallet’s key generation.
The current research record for this story is incomplete and marked as only partially verified, with low overall confidence. No independent on-chain confirmation of the total number of affected addresses or the exact amount lost has been established at this stage, so the figures should be treated as reported rather than confirmed. For related coverage, see Best Bitcoin Hardware Wallets in 2026.
It is worth stressing that the story concerns individual Bitcoin addresses generated by specific wallets, not a vulnerability in Bitcoin’s protocol or ledger. Readers weighing their own setups may find our overview of the best Bitcoin hardware wallets in 2026 useful for context on how cold storage devices differ. For related coverage, see Bitcoin ETFs Post $172M in July Inflows, Ending Two-Month Slide.
How the Coldcard seed-generation issue fits into the report
The exposure has been tied to how certain Coldcard devices generated wallet seeds rather than to a conventional remote hack. Coinkite, the maker of Coldcard, previously published a seed-generation warning for the Coldcard Mk3 addressing entropy concerns in wallet key creation. For related coverage, see Hashdex to Close and Liquidate $14.26M Bitcoin ETF, Trading Ends Aug. 17.
Coinkite has also documented the technical background of its randomness process in an entropy backgrounder, which explains how the device is intended to gather and combine sources of randomness when producing a seed. Weak or predictable entropy at that stage can make the resulting private keys guessable.
Engineers at Block described a related mechanism in detail, documenting a predictable RNG fallback and a 32-bit reseed in Coldcard firmware. According to that write-up, the behavior could narrow the pool of possible keys enough to make brute-force recovery feasible for an attacker. Further background on the underlying flaw is covered in our report on the Coldcard vulnerability that enables Bitcoin theft.
Additional coverage from The Hacker News has linked the reported thefts to this hardware-wallet flaw rather than to phishing or user error, consistent with the seed-generation framing above.
What remains unverified and what to watch next
Key details of the incident are still unconfirmed. The precise number of affected addresses, the confirmed total losses, and the specific attribution of the theft have not been independently verified in the available record, which lists no fully verified facts despite several cited sources.
The competitor and source-validation review for this story was also incomplete, and the internal assessment recommended narrowing the angle rather than asserting a definitive loss figure. That caution is reflected here: the numbers circulating in early reports should be read as preliminary.
Coinkite’s confirmation of the underlying bug is documented separately in our coverage of how the Coldcard bug let hackers guess Bitcoin wallet keys. Users of older Coldcard devices should follow Coinkite’s official guidance and monitor further disclosures as the investigation into the full scope continues.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.