Coldcard Wallet Hack Drains $1.6 Million in Bitcoin

A Canadian entrepreneur recently lost over 1.6 million dollars in Bitcoin after his hardware wallet was drained in just seven minutes. Despite keeping his device in a safety deposit box and never connecting it to the internet, he found his balance wiped out on July 29, 2026. This incident is part of a much larger trend, with researchers estimating that over 1,367 BTC have been stolen across more than 4,500 addresses.

The vulnerability stems from a flaw in the code used to generate seed phrases on certain devices, likely dating back to 2021. Experts believe attackers used brute force methods to target the weak randomness in how these seeds were created. Because the security issue exists at the generation level, users who did everything correctly were still left exposed to theft.

Galaxy Research, which identified the ongoing attack waves, warns that the stolen funds remain stationary in attacker wallets. The majority of the victims appear to be long term holders. Security analysts are now urging all Coldcard users to generate new seeds and move their funds to safer setups immediately.

This incident highlights a major tension in self custody where users must decide how much trust to place in their hardware. While the company encourages a verify your own security approach, the default settings on these devices are now at the center of the controversy. Owners should check the latest official security advisories and migrate their assets to new, secure wallets without delay.