Coldcard Exploit Exposes Nearly $114M Bitcoin Wallet Losses

Key Point

A Coldcard firmware exploit resulted in nearly $114 million in Bitcoin losses. Coinkite disclosed in late July 2026 that a firmware build error introduced in March 2021 reduced seed phrase randomness for some Coldcard wallets. Galaxy Research researchers said observed losses grew from about $88 million to nearly $114 million within days. The incident prompted many Coldcard users to move their Bitcoin after researchers warned that additional vulnerable addresses could still be targeted.

Why it matters: Weak seed phrase randomness could turn offline wallet security into a firmware trust problem rather than only an internet exposure problem.

Market Sentiment

Bearish, Stress-on, Event-driven, De-risking.

Reason: The Coldcard exploit caused nearly $114 million in Bitcoin losses, which can weaken confidence in self-custody hardware security.

Similar Past Cases

In September 2022, Wintermute lost about $160 million after a Profanity-linked private key compromise affected its DeFi vault, and the firm said it would continue on-chain trading afterward. (The Block) The key difference is that Wintermute involved an institutional setup, while the Coldcard incident affects consumer hardware wallet seed generation.

Ripple Effect

Weak wallet randomness can shift custody risk from online attacks to firmware and hardware supply-chain trust. If more vulnerable addresses are targeted, then the incident could pressure wallet makers to provide clearer verification and migration processes.

Opportunities & Risks

Opportunities: If researchers identify more vulnerable addresses, then reducing exposure to affected Coldcard setups limits custody risk.

Risks: When Coinkite provides remediation details, then verifying device status before signing new transactions can help avoid using a vulnerable wallet.