Coldcard Vulnerability Sparks Massive Bitcoin Movement, Active Addresses Surge

A severe security vulnerability discovered in Coldcard, a popular Bitcoin hardware wallet, has sent ripples through the cryptocurrency markets, prompting users to take immediate action to secure their funds. According to Coldcard's manufacturer, Coinkite, a firmware bug present since March 2021 in certain firmware versions led to insufficient randomness in wallet seed generation. This flaw has resulted in the theft of millions of dollars worth of Bitcoin (BTC) due to predictable private keys, with reports indicating that attacks are still ongoing.

The vulnerability affects Coldcard Mk2, Mk3, Mk4, Mk5, and Q models. Initial estimates suggested approximately 594 BTC (around $38 million) was stolen from about 500 wallets. However, on-chain analysis by Galaxy Research later updated these figures, revealing a total of 1,367.05 BTC (roughly $88.6 million) drained across 4,585 addresses. The issue stemmed from wallet seeds being generated via a deterministic software pseudorandom number generator (PRNG) instead of the intended hardware random number generator (RNG). For Mk3 models, this reduced the intended 128 bits of entropy to approximately 40 bits, making private keys susceptible to brute-force attacks.

The largest single wave of attacks occurred on July 30, 2026, efficiently sweeping 1,082.65 BTC (approximately $70.2 million) in just 41 minutes. Galaxy Research noted that the first two attack waves exhibited similar transaction fingerprints, suggesting a single operator. However, subsequent attacks showed different patterns. Coinkite released emergency firmware updates for all affected models on July 31, 2026. Crucially, the company emphasized that these updates do not remediate existing, insecure seeds, and users must generate new seeds on patched firmware and move their funds to new addresses.

This development triggered significant activity in the Bitcoin market. According to Julio Moreno, Research Director at crypto analytics firm CryptoQuant, following the Coldcard vulnerability news, Bitcoin's daily active addresses surged from 645,000 on July 30 to nearly 1 million on July 31. This marked the highest daily level since December 2024, driven primarily by a sharp increase in sending addresses. Exchange deposits under 10 BTC also spiked to 7,300 BTC, reaching their highest level since February. This incident once again underscored the critical importance of hardware wallet security for crypto assets.

The Coldcard incident highlights the ongoing challenges and responsibilities associated with self-custody in the cryptocurrency ecosystem. While hardware wallets are designed to provide robust security for private keys, this event demonstrates that even these devices can be vulnerable to unforeseen software flaws. Some reports even suggest that artificial intelligence (AI) may have been used by the attacker to identify such a vulnerability. This indicates an increasingly sophisticated threat landscape in cybersecurity, demanding continuous vigilance for the protection of crypto assets.

Coinkite has stated that its investigation into the matter is ongoing, and a more detailed technical review will be released. Analysts and market experts are urging Coldcard users to promptly migrate their funds to secure, newly generated addresses, considering all wallet seeds created with the affected firmware versions are at risk. This event broadly emphasizes the need for enhanced security standards and user awareness across the cryptocurrency market.