Coldcard Bug Tied to Nearly $114M in Bitcoin Losses

Key Point

Coinkite disclosed in late July 2026 that a firmware build error introduced in March 2021 caused some Coldcard wallets to generate mnemonics from a smaller range. The error reduced the randomness of user private keys. Galaxy Research analysts stated that the Coldcard exploit occurred in multiple rounds. Galaxy Research analysts said observed Bitcoin losses rose from approximately $88 million to nearly $114 million within days. Researchers warned that other vulnerable addresses could still become targets.

Why it matters: Weak wallet entropy may turn a self-custody tool into a continuing loss channel if affected users do not isolate funds quickly.

Market Sentiment

Bearish, Stress-on, Tech-driven, De-risking.

Reason: Galaxy Research analysts said observed Bitcoin losses rose to nearly $114 million, which points to active self-custody security stress.

Similar Past Cases

Trust Wallet's CVE-2023-31290 showed a similar weak-entropy pathway. NVD said Trust Wallet Core before 3.1.1 used 32-bit entropy in affected browser extension versions and enabled theft in the wild in December 2022 and March 2023. (NVD) The key difference is that the Coldcard case involves a Bitcoin-only hardware wallet rather than a browser extension.

Ripple Effect

Weak key generation can turn a wallet flaw into a continuing sweep risk because attackers can test a reduced key space against funded addresses. If vulnerable users move Bitcoin from affected wallets, then the risk may remain concentrated in self-custody operations rather than broad spot-market selling. If new drains continue after the disclosure, then hardware-wallet trust could weaken across security-focused storage products.

Opportunities & Risks

Opportunities: When Coinkite or researchers clarify the affected build scope, then migration from exposed wallets becomes a direct risk-reduction signal. Traders can monitor whether vulnerable-address movement slows to judge containment.

Risks: If additional vulnerable addresses are drained, then reducing reliance on exposed wallet setups limits operational risk. If uncertainty persists around affected mnemonics, then self-custody confidence may remain under pressure.