Hackers target Bitcoin’s safest hiding place in ongoing Coldcard attack

NEW YORK – Hackers have found a software flaw in a brand of “cold” Bitcoin wallet – considered one of the safest places to store cryptocurrency – and are siphoning tens of millions of dollars in an ongoing attack.

Late last week, Canada-based Coinkite notified users of its Coldcard devices that a security flaw in the keys that protect their cryptocurrency had compromised some wallets. By Aug 3, roughly 1,367 Bitcoin worth some US$86 million (S$110 million) had been drained from more than 4,500 wallets, according to Galaxy Research.

Coldcard is a brand of hardware device that allows users to secure their Bitcoin in so-called cold wallets. These wallets are supposed to be the safest place to keep cryptocurrency because they are isolated from the internet.

However, a flaw in the software of the Coldcard devices meant that the generated “seed phrase” – a long string of words used to gain access to a wallet – was predictable, according to a report from financial technology company Block’s engineering team.

“It exposes the fallacy of your crypto being offline,” said Aneirin Flynn, chief executive of cybersecurity technology firm Failsafe. “The device is just responsible for generating your passwords, and if the underlying math is broken, then your passwords can be reverse-engineered.”

For some users, news of the attacks was at first unfathomable.

Jonathan Goodman, one of the victims, said he figured it did not impact him, but he checked his wallet anyway.

But the moment it loaded, he knew he was in trouble. He said: “Between 9.36 and 9.43pm on July 29th, all three of my wallets were completely drained.”

The core of the issue was how Coinkite implemented the random-number generator when producing the phrases, according to Block. True randomness is a critical component of cryptographic security, but Coldcard wallets had a fallback mechanism that resulted in keys generated using deterministic values such as the device serial numbers.

The result was that attackers have been able to systematically recalculate and drain user wallets. Reports on July 31 placed losses at around US$38 million, but the figures quickly climbed over the weekend.

In a statement on its website, Coinkite confirmed that funds controlled by seeds generated on affected firmware are at risk. Fixed firmware is now available for every affected model and release track, it said.

The attack has drawn widespread attention online, with influencers to company executives weighing in on the implications.

For 2026 so far, the amount of crypto stolen is down from 2025. The first half of the year has seen total losses reach US$972 million, less than half of the US$2.3 billion stolen during the first half of 2025, according to a TRM Labs report published in July.

Still, the total number of hacks climbed to 207, the highest recorded in any six-month period.

Ari Redbord, TRM’s global head of policy, said infrastructure and key compromises make up about 15 per cent of incidents while accounting for 76 per cent of losses. “Coldcard shows that self-custody moves the risk, it does not remove it,” he said.

For Goodman, the incident highlighted how much “blind faith” he has put in the technology he uses. He would not be investing in Bitcoin or using cold wallets going forward, he said.

“If it really is this complicated and technical, perhaps it’s not worth doing,” Goodman said. “Nobody knows how basically anything works.” Bloomberg