The Coldcard vulnerability is a major lesson for hardware wallets; Galaxy Research estimates losses exceeding $70 million.

Galaxy Research estimates the damage from the Coldcard vulnerability to exceed $70 million, after more than 1,196 user wallets had Bitcoin stolen due to a bug in seed phrase generation.

August 2, 2569 – Hardware wallets are often considered one of the most secure ways to store digital assets because users hold the assets themselves (self-custody). However, the recent Coldcard attack has demonstrated that even if the device isn't compromised, a flaw in the seed phrase generation process can cripple the entire security.

This is considered one of the most serious hardware wallet incidents of 2026 because the problem wasn't due to hacking the device itself, but rather a flaw in the seed phrase generation, which is the core of all security.

Upon initial activation of a Hardware Wallet, it will automatically generate a seed phrase. Users must note down either a 12- or 24-word phrase and enter it before conducting any transaction. The seed phrase is generated from random numbers converted into words; the key is that the numbers must be truly random, otherwise others could guess the seed.

The problem lies in a firmware version of Coldcard, a hardware wallet brand specifically for storing Bitcoin, developed and manufactured by Coinkite, a Canadian company. A bug in its random number generation system causes it to use a software fallback system instead of the primary random number generator.

To explain, a typical hardware wallet has a True Random Number Generator chip. The function of this chip is to generate truly unpredictable numbers. However, in case this chip malfunctions, the program has a backup plan called...

Software fallback refers to using software to generate numbers instead, because the developers' original idea was to at least continue using the machine.

However, the problem arose because the Coldcard's firmware had a bug that caused the software fallback to be executed even though the random number generation chip was not faulty. If the software fallback had been well-designed without vulnerabilities and with sufficient entropy, it could have been used safely.

However, as Coinkite has admitted, this bug significantly reduces the complexity of randomness (entropy). For example, the entropy level should be around 256 bits, but it's reduced to about 40 bits. This smaller amount is easily guessable in large clusters.

Once the attackers realized the Coldcard firmware had this bug, they generated every possible seed phrase under the bug's constraints, calculated the public address from all the seeds, and compared the addresses to the blockchain (since all Bitcoin addresses are publicly disclosed). Upon finding an address with funds, they used the calculated seed phrase to create a private key, signed the transaction, and immediately transferred the BTC.

What's shocking is that Galaxy Research, the research arm of the crypto investment company Galaxy Digital , found 1,196 addresses linked to this incident, with Bitcoin transferred out within 41 minutes. It's possible the perpetrator calculated the possible seed sequences in advance, allowing them to send Bitcoin transactions from multiple addresses within a short period.

However, this bug is specific to certain firmware versions. Therefore, the impact is on those who created seeds during the period when the firmware was affected. Subsequent updates will not help because the seeds were created from the buggy firmware, which was a mistake from day one. Updates only prevent the system from creating the same erroneous seeds again. The solution is to create all new seeds and transfer the Bitcoin to a new wallet.

Galaxy Research estimated the damage from the Coldcard vulnerability to be over $70 million (based on market prices at the time), representing the loss of over 1,082.65 BTC.

Galaxy Research tracked the Bitcoin movement path that occurred between 01:10 AM and 01:51 AM on July 30th, covering blocks 960,183 to 960,191, or approximately 30 hours before Coldcard released its first security alert, based on a post on platform X on Friday.

Previously, an initial analysis by Rob Hamilton, CEO and co-founder of AnchorWatch , estimated that 594.48 BTC, worth approximately $38 million, was transferred through around 500 transactions within just three blocks.

However, Galaxy Research later noted that all detected transactions exhibited a distinctly similar pattern, characterized by the same transaction fee of 30 satoshis per virtual byte (sat/vB) across all transactions, and the absence of any change output for receiving change back into the sender's wallet.

The company states that this pattern makes it possible to identify early attack activity from on-chain data. However, Galaxy warns that if future attacks target wallets created using ColdCard, the transaction patterns may not necessarily be the same, making detection more difficult.

Rodolfo Novak, co-founder of Coinkite, the developer of the Coldcard wallet, stated that the company takes responsibility for the bug in the firmware and is urgently investigating to assess the full extent of the damage caused by this incident. He also revealed that Coinkite has released a hotfix to disable the software fallback path related to the issue.

However, he warned that the update could not protect against seed phrases created with the vulnerable firmware version. Therefore, users who had created seed phrases on the affected firmware should immediately transfer all their assets to a new wallet using the new seed phrase to prevent future asset theft.

This is considered one of the most serious hardware wallet incidents of 2026 because the problem wasn't due to hacking the device itself, but rather a flaw in the creation of the seed phrase, which is the core of all security.

References: coldcard.com , blog.coinkite.com , cointelegraph.com

Read news related to All situations around the world can be found here.