A firmware bug introduced in March 2021 by Canadian hardware wallet maker Coinkite quietly weakened the randomness used to generate seed phrases on affected Coldcard devices. Instead of drawing from a robust source of entropy, the flaw redirected seed generation to a software-based pseudorandom number generator. In plain English: the “random” numbers weren’t random enough, making it mathematically feasible for attackers to reconstruct private keys without ever touching the physical device.

How bad did it get

The first major attack wave hit on July 30, 2026. In roughly 25 minutes, approximately 594 BTC, worth around $38 million, disappeared from about 500 addresses. That was just the opening act.

Galaxy Research identified at least three separate waves of attacks. By early August 2026, total losses had climbed to 1,816 BTC, valued between $114 million and $116 million, spread across more than 5,200 compromised addresses. The attacks focused almost exclusively on single-signature wallets, the setup most everyday users run, without the additional security layers that multi-signature configurations provide.

Coinkite’s CEO and the engineering team at Block both confirmed the bug’s existence. Emergency firmware updates were issued, with urgent instructions for affected users to generate fresh seed phrases and move funds immediately. For many, that advice came too late.

The vulnerability itself dates back to March 1, 2021, affecting the Coldcard Mk3 and other major models of the era.

What this means for self-custody’s reputation

Hardware wallets were supposed to be the gold standard. Offline, air-gapped, immune to remote exploits. The Coldcard incident cuts directly against that narrative, and the timing matters: this isn’t a story about a sketchy exchange or a fly-by-night DeFi protocol. Coinkite is one of the most respected names in Bitcoin security culture.

That opens a door for Bitcoin ETFs. Spot Bitcoin ETFs already removed the operational burden of key management for institutional and retail investors who wanted Bitcoin exposure without the wallet anxiety. A $114 million hack of a trusted hardware device accelerates the case considerably.

Institutional custodians stand to benefit most directly. Firms already operating under regulatory frameworks, carrying insurance, and running multi-party computation or multi-signature custody at scale now have a fresh data point to lead with in every sales conversation.

Single-signature wallets, the primary target in these attacks, remain the most common setup among individual holders. Any meaningful migration away from that model, whether toward ETFs, multi-signature arrangements, or managed custody services, would represent a structural shift in how Bitcoin ownership is distributed.