Coldcard: The $116M Bitcoin Theft That Never Touched a Device

Every drained wallet was offline. That is the part that broke people. The devices sat in safes, in drawers, in a Toronto safety deposit box, and had never been connected to anything. None of them was touched. None of them needed to be.

Coldcard is a bitcoin-only hardware wallet: a small device, about the size of a calculator, that holds the secret key to someone's bitcoin and never connects it to the internet. Think of it as a home safe for a bearer bond. It is made by Coinkite, a company in Toronto, and it is the wallet of choice for many people who take security most seriously. On 30 July 2026 thieves began emptying thousands of them at once.

By the time Galaxy Research, the research arm of the investment firm Galaxy, had matched the losses to victims, the count stood at about 1,790 bitcoin taken from more than 8,800 addresses, roughly $115 million at the time of the thefts. TRM Labs, another tracing firm, put it at $116 million and called it the largest hardware wallet theft ever recorded. No victim lost less than 0.15 bitcoin, about $10,000. The median loss was 0.41 bitcoin, about $26,500. The largest single loss was 29.9 bitcoin, nearly $2 million. The thieves paid about $2,800 in total network fees to move it all.

A key that was never really random

Everything in a bitcoin wallet flows from one secret: a recovery phrase of 12 or 24 ordinary words, which works like the master key to a safe deposit box. Whoever has the words has the money. The safety of the system rests on one idea. The words are picked so randomly from such a vast number of possibilities that no computer could ever guess them, in the way that nobody could guess the winning lottery numbers for the next thousand draws in a row.

To pick them, a Coldcard was supposed to use a dedicated chip that generates true randomness from electrical noise, the electronic equivalent of rolling real dice. In March 2021 Coinkite rewrote a large part of the device's software. One settings check in the new code asked the wrong question. It checked whether the switch for the dice chip existed, rather than whether it was turned on. It existed. So the software quietly fell back to a backup formula that produces numbers from the device's serial number and its internal clock. The numbers looked random. They were not. Given the same starting point, the formula gives the same answer every time.

Firmware 4.0.0, the device's operating software, shipped with the flaw on 17 March 2021, and every update after it carried it for more than five years. Coinkite later estimated that keys on older Mk3 devices had the strength of about 40 bits instead of the intended 128, and newer Mk4, Mk5 and Q models about 72. In plain numbers: the pool of possible keys shrank from more than all the grains of sand on Earth to something a rented bank of computers can work through.

How the theft worked

Once the flaw was known, the theft came down to computing power. The thief's computers generated candidate keys the way a faulty Coldcard would have, worked out the bitcoin addresses each key would produce, and checked those addresses against the bitcoin blockchain, the public ledger that anyone can download and that shows every balance. When a guess matched a funded address, the coins were moved. The victims' devices played no part. They could have been switched off in a vault on another continent.

The first sweep, mapped by Galaxy, took 1,082.65 bitcoin from 1,196 addresses between 01:10 and 01:51 UTC on 30 July, about $70 million in 41 minutes. More waves followed over the next week as other people worked out the same trick, and Galaxy now believes at least a dozen separate operators ended up mining the same weak keys. Every drained wallet used a single key. Wallets that needed signatures from several devices, known as multisig, the equivalent of a joint account that needs two signatures, were not hit unless every device involved was a faulty Coldcard. Owners who had set up their wallets with at least 50 rolls of real dice, an option Coldcard offers, were not exposed by this bug.

A wrong answer, then an apology

At 18:10 UTC on the first day Coinkite's chief executive, Rodolfo Novak, told users there was no need to panic and suggested the victims had leaked their own recovery phrases. By then Kevin Loaec of the wallet firm Wizardsardine had already told his followers "this is not a drill", and the developer Jameson Lopp was reporting thefts from people who had done nothing wrong. Engineers at Block, Jack Dorsey's payments company, which makes its own Bitkey wallet, traced the fault to the firmware and published before Coinkite's first formal advisory, which came about 30 hours after the first sweep.

Novak reversed within a day. "I'm sorry and I'm devastated," he wrote on 31 July, taking full accountability and admitting that Coinkite's own review process had failed. Fixed firmware shipped for every model the same day. But a fix only protects future keys. It cannot repair a recovery phrase that already exists, so every owner who created one on a Coldcard since 2021 had to make a new one and move their money.

The bug did not appear from nowhere. The March 2021 rewrite replaced code borrowed from the rival maker Trezor, which had been picked over by security researchers for years, with a new library written mostly by one developer. A member of Coinkite's own Telegram group warned against the switch five weeks after it shipped, and Novak dismissed the warning. Researchers who have since picked through that decision have so far found no clear evidence that the flaw was planted on purpose.

Where the money is now

The one real lead came from Block. Clay Garrett, an engineering lead on Bitkey, said the first-wave thief had used a paid account at a well-known blockchain data company to look up the target addresses while the sweeps were running, and that the company's logs matched the attack "with extraordinary specificity". Block passed the information to authorities. Alex Thorn, Galaxy's head of research, later said the first-wave thief's identity "may be known to law enforcement". No agency has confirmed a suspect, a case, an arrest or a seizure.

The first wave's 1,082.57 bitcoin has not moved since July, sitting in addresses that analysts watch around the clock. Coins that are never laundered can sometimes be recovered. Later thieves were less patient. By 7 September the third-wave operator had moved about 97 bitcoin, roughly $7.8 million, through THORChain, a service that swaps one coin for another without asking who is swapping, and through CoinJoin, a mixer that pools many people's coins so payments can no longer be told apart.

Some money has been saved rather than stolen. On 21 September Thorn disclosed that white hats, independent researchers who moved coins out of vulnerable wallets before the thieves could, had gathered 52.37 bitcoin into the Crypto Recovery Trust, a Wyoming trust set up to return funds to verified owners, with lawyers from the Washington firm Steptoe advising its trustee.

Victims have had a harder time getting anyone official to listen. Jonathan Goodman, who lost 18.25 bitcoin, was told by a Toronto police station to file online, then had his online report rejected for being too large. Coinkite has offered help with police reports and insurance claims but no compensation. On 22 October it emerged that an owner had already sued. Amir Reza Naderi, of Los Angeles, filed a proposed class action, a lawsuit brought on behalf of every buyer in the same position, against Coinkite, Novak and his co-founder Peter D. Gray in the Ontario Superior Court of Justice on 11 September 2026. He says he lost about 1.23 bitcoin on 6 August, and his claim alleges the defendants knew of the flaw by May 2025 and did not warn customers. None of it has been tested in court. Coinkite told Bitcoin.com News it could not comment on pending litigation. On 11 October someone used Coldcard's own account on X to post a fake security alert pointing owners to a phishing site. Coldcard said its own logins showed no sign of access and asked X to investigate.

This is the third failure of its kind. Milk Sad exposed a weak random number generator in a popular wallet tool in 2023, and Coinspect's Ill Bloom research found guessable keys in software wallets weeks before Coldcard. In every case the failure happened at the moment the wallet was created, the one moment its owner has no way to check.