Coldcard Hack Congests Bitcoin Mempool: $130 Million Stolen

A critical software flaw identified in Coldcard, a leading Bitcoin hardware wallet, has resulted in the theft of approximately $130 million worth of Bitcoin through ongoing attacks since July 30, 2026. This large-scale breach has sparked concern within the cryptocurrency community and led to unprecedented congestion in the Bitcoin network's memory pool (mempool) as users scramble to transfer potentially compromised funds to secure wallets.

The vulnerability, stemming from a March 2021 firmware update by Canadian manufacturer Coinkite, involved the use of a deterministic software-based pseudorandom number generator (PRNG) instead of a hardware random number generator (RNG) for wallet seed phrase generation. This error made the seed phrases predictable, allowing attackers to reconstruct private keys without physical access to the device. Initial reports from blockchain analytics firm Galaxy Research indicated that 1,082.65 BTC, valued at roughly $70.2 million, was stolen from 1,196 addresses. Subsequent attack waves have seen this figure rise to $89 million, with a potential fourth wave pushing the total to $130 million from an estimated 7,300 addresses.

These extensive fund movements have caused a notable surge in activity within the Bitcoin network's memory pool. As Coldcard users attempt to transfer their funds to secure addresses and other Bitcoin holders take precautionary measures, the number of unconfirmed transactions in the mempool spiked to 89,031, marking the highest level since February 2025. While this could lead to increased transaction confirmation times and higher fees, Bitcoin's spot price has remained relatively stable, trading within the $62,000 to $65,000 range. However, the incident has negatively impacted social sentiment surrounding Bitcoin.

The Coldcard incident has reignited significant discussions within the cryptocurrency market regarding the security of cold storage and the practice of self-custody. Hardware wallets, which gained popularity after the collapse of the FTX exchange in 2022, have faced scrutiny following this vulnerability. Nevertheless, security experts and analysts have emphasized that the flaw is specific to certain Coldcard firmware versions and not an inherent weakness in the Bitcoin protocol itself.

Analysts and market observers suggest that the traceability of stolen funds on the blockchain may hinder the attackers' ability to cash out their illicit gains. Firms like Galaxy Research are collaborating with U.S. law enforcement agencies, cryptocurrency exchanges, and blockchain investigation firms to flag and track the movement of these funds. In response, Coinkite promptly released an emergency firmware update and advised affected users to generate new seeds on patched firmware and migrate their funds securely. This event underscores the continuous need for rigorous review and enhancement of hardware and software security standards across the cryptocurrency ecosystem.