The $70 Million Bitcoin Heist: How a Coldcard Flaw Made It Possible in 41 Minutes

Robert Moore · 2026-08-01

It was a nightmare scenario that played out in less time than it takes to watch a sitcom. On July 30, an attacker swept through 1,196 Bitcoin addresses in just 41 minutes, walking away with 1,082.65 BTC—roughly $70.2 million at the time. The crypto community was left scrambling for answers, and Galaxy Research stepped up to piece together the digital breadcrumbs. Their conclusion? The theft wasn't a clever social engineering trick or a hacked exchange. It traced back to a firmware flaw in the Coldcard, a Bitcoin-only hardware wallet built by Canadian firm Coinkite. For years, Coldcard had a reputation as one of the most secure options on the market—a fortress for your keys. But this incident showed that even fortresses can have cracks in the walls. ### What Actually Went Wrong? Here's where things get technical, but stick with me because it's fascinating. The problem stemmed from a firmware integration error that dates back to March 2021. When Coldcard updated its software, a critical piece of code that handles seed generation got routed to the wrong place. Instead of using the hardware's true random number generator—the gold standard for cryptographic security—the system fell back on a deterministic software pseudorandom number generator (PRNG). That might sound like alphabet soup, but here's the simple version: your Bitcoin seed is the master key to your wallet. If it's generated using a predictable algorithm instead of true randomness, an attacker who knows the flaw can recreate your seed. It's like locking your front door but leaving the key under the mat—and telling everyone where to look. ### The Domino Effect of a Single Bug What's chilling about this attack is the scale. The attacker didn't just hit one wallet. They systematically drained 1,196 addresses, which suggests they had a list of vulnerable seeds or a way to calculate them in real time. The speed—41 minutes for over a thousand addresses—points to an automated script running through the math like a hot knife through butter. Galaxy Research's mapping of the sweep is a masterclass in forensic analysis. They connected the dots between the firmware flaw and the compromised addresses, showing how a single line of code from years ago could cascade into a multi-million-dollar disaster today. It's a stark reminder that in the world of cryptocurrency, your security is only as good as your last update. ### What This Means for Your Bitcoin If you're using a Coldcard wallet, you're probably wondering if you're at risk. Here's the thing: the flaw was tied to a specific firmware version from early 2021. Coinkite has since released patches, and they've been transparent about the issue. But the incident raises bigger questions about how we trust hardware wallets in general. - **Always verify your seed generation**: After any firmware update, do a test run. Generate a new seed and make sure it's truly random. - **Keep your firmware current**: Old versions are like unlocked doors. Update as soon as patches drop. - **Consider a multi-signature setup**: Don't put all your eggs in one basket. Split your keys across different devices. ### The Bigger Picture This isn't just a Coldcard problem. It's a wake-up call for the entire crypto ecosystem. Hardware wallets are supposed to be the safest place for your coins, but they're still software at the end of the day. And software has bugs. The key takeaway here isn't to panic—it's to stay vigilant. Think of it this way: you wouldn't buy a safe and then never change the combination. The same logic applies to your wallet. Regular maintenance, firmware updates, and a healthy dose of paranoia can keep your assets safe from the next 41-minute heist. As for Coinkite, they've handled the situation with a mix of accountability and technical detail that's rare in this industry. But for the rest of us, the lesson is clear: in the wild west of digital currency, the only person you can really trust is yourself—and maybe a good random number generator.