The Vault Got Robbed: What the $116M Coldcard Exploit Says About Everyone's Cold Storage

Beginning July 30, attackers drained roughly 1,816 BTC — about $116 million — from more than 5,200 addresses associated with Coldcard hardware wallets, according to TRM Labs' technical analysis. Bloomberg first reported the ongoing attack on August 3.

The mechanism matters more than the number. Per TRM, a firmware bug introduced in March 2021 weakened the randomness used when some devices generated their wallet seeds, cutting effective key strength from 128 bits to as little as 40. At 40 bits, keys fall to brute force — no physical access, no phishing, no user error required. The wallets did exactly what their owners asked; the math underneath had quietly failed years earlier.

The bug was in the build, not the cryptography

It is worth being precise about what actually broke, because the popular summary — "a firmware bug weakened the randomness" — makes this sound like a cryptographic design error. It wasn't one. Per TRM's analysis, the fault was a build configuration error: affected devices fell back on a weak software random number generator instead of drawing on the hardware entropy sources the design called for. The cryptography was correct. The seed-generation scheme was correct. The device was simply compiled in a way that quietly bypassed the good source of randomness and used a bad one instead.

That distinction is not pedantry, and it is not exculpatory — if anything it is worse. A flawed algorithm can be found by reading the algorithm. A build that silently substitutes one entropy source for another produces a device that behaves correctly in every functional test: it generates seeds, the seeds work, the wallets receive and spend. Nothing is visibly wrong. The only way to catch it is to audit the output of the shipped binary for randomness quality, on real hardware, rather than to audit the source code that was supposed to produce it. Most security review — including most of what the industry markets as an audit — reads the source.

Then consider the dwell time. Firmware 4.0.1 shipped in March 2021. The first coins moved on July 30, 2026. For more than five years the flaw sat in circulating hardware, generating permanently weakened seeds, while the devices holding them were held up as the conservative choice. Whoever eventually went looking did not need to break anything. They needed to notice.

Four waves, and a first one that lasted 25 minutes

The shape of the theft is as informative as the total. TRM's reconstruction describes an opening wave on July 30 that took roughly 594 BTC — about $38 million — from some 500 wallets in 25 minutes, followed by four more waves across the next four days.

Twenty-five minutes is not the signature of someone hunting for keys in real time. Brute-forcing a 40-bit keyspace takes compute and time; spending the funds once you hold the keys does not. A first wave that fast implies the cracking was already finished — that someone had quietly ground through the weak-seed space in advance, assembled a target list, and then executed against all of it at once. The public part of this incident was the withdrawal. The expensive part happened earlier, offline, where nobody was watching.

TRM also declines to pin the theft on a single actor, noting that "transaction construction differs across the four waves, suggesting more than one attacker may be involved." That is a genuinely unsettling possibility: it would mean the weak-seed derivation was independently discovered or shared, rather than held by one group — a vulnerability with more than one owner.

The money is sitting still

Most of the proceeds have not moved. TRM records only minimal laundering — a single 64.9 BTC deposit to Wasabi and 200 ETH sent to Tornado Cash on August 4 — with the bulk pooled at consolidation addresses and little onward transfer. Funds parked in plain sight are not a sign of restraint; they are a sign that moving $116 million in traced bitcoin is the hard part of the job, and that the attackers are willing to wait.

The stillness is also evidence, and TRM treats it that way. Professional cybercrime crews typically begin aggressive laundering within hours of a large theft — chain-hopping, mixer deposits, automated peel chains — because the window in which stolen funds are still fungible closes fast once exchanges flag the addresses. What happened here was close to the opposite: one Wasabi deposit, one Tornado Cash transaction, at most a single consolidation hop, and then nothing. That pattern does not match the operational tempo of the state-linked groups that dominate the top of the annual theft tables, and TRM explicitly declines to attribute the theft to any of them.

Put that next to the other anomaly — transaction construction that differs across the waves, pointing to more than one hand — and the most consistent reading is uncomfortable. This does not look like one professional crew executing a planned operation. It looks like a weakness that several parties found, or passed between them, and then drained at their own pace, with no shared playbook for what to do with the proceeds afterward. A vulnerability with one owner gets exploited once. A vulnerability with several has no natural end date.

Related The vendor nobody chose: how a dashboard bug leaked hardware-wallet buyers

The patch does not save the already-generated

One detail deserves to be stated flatly, because it inverts the usual security advice. The flaw sat in firmware version 4.0.1, released in March 2021. Updating firmware stops a device from generating new weak seeds — it cannot repair a seed already produced. Any Coldcard that generated its seed between March 2021 and the fix carries that weakness permanently, in the seed itself, no matter how current the software on the device is today. "I'm fully patched" is not an answer here. The only remedy is generating a new seed on known-good firmware and moving the coins to it.

Why this one stung

Hardware wallets occupy a special place in crypto's security story: they are the thing you buy so you can stop worrying. As Fortune observed, this exploit hurt more than a typical bridge hack precisely because it hit the people doing everything "right." TRM ranks it the third-largest crypto theft of 2026, in a year already past $1.2 billion across 276 incidents.

The compounding problem: doxxed owners

The same month, SafePal disclosed a breach exposing order records — names, home addresses, contact details — for 39,798 hardware-wallet customers. No funds were touched; none needed to be. A verified list of cold-storage owners, with home addresses, is raw material for targeted phishing at minimum.

And the tempo is rising

TRM reports AI adoption across crypto crime up roughly 40% year over year, and industry leaders warned in The Block that autonomous agents could make current loss figures "look like pennies." The Coldcard brute-forcing — patient, automated, aimed at everyone with a weak seed simultaneously — is what that future looks like at small scale.