coldcard

Bitcoin News posted on the X platform that Coldcard is replenishing dealer inventory in batches as new devices are produced. About a month ago, Coldcard's entropy vulnerability led to the theft of over 100 million dollars worth of Bitcoin from users; the company stated that several dealers have applied for additional inventory, and the devices continue to sell.

According to Bitcoin News monitoring, hackers related to the third wave of theft incidents involving Coldcard wallets have begun to transfer the stolen funds for the first time, exchanging Bitcoin for ETH through THORChain. Alex Thorn from Galaxy Research stated that approximately 10% of the stolen BTC has been transferred, while the remaining 90% remains untouched.The attacker reportedly encountered difficulties when exchanging the funds, with multiple THORChain transactions being returned and retried. Researchers have traced the related exchange operations to a new Ethereum address, and Alex Thorn indicated that this address has been shared with relevant authorities and cryptocurrency companies. Galaxy Research noted that the broader Coldcard vulnerability exploitation incident has resulted in at least 8,865 addresses losing a total of 1,789 BTC, valued at approximately $115 million based on the price at the time of theft.

According to monitoring by Galaxy's research director, the COLDCARD Wave 3 attackers have transferred stolen funds for the first time and exchanged them for ETH through the THORChain cross-chain DEX. This is the first on-chain transfer of funds from the original hacker address in Waves 1, 2, or 3.

Blockstream stated that Jade is not affected by the Coldcard random number generator vulnerability and has released firmware 1.41 after receiving extensive AI-assisted security reviews. Jade indicated that it has undergone dozens of automated AI scans and multiple manual reviews, focusing on sensitive areas such as random number generation and transaction signing.The new firmware enhances stack protection, updates dependencies, audits sensitive memory cleanup processes, and upgrades the Jade runtime environment. Blockstream claims that Jade's random number generation mechanism uses multiple entropy sources, including hardware chip noise, timing data, sensor data, and camera noise, and mixes them using SHA-512 to prevent a single entropy source failure from affecting seed generation. The team stated that other lower-severity findings are still being addressed, and firmware 1.42 is expected to be released in a shorter development cycle.

According to monitoring by Galaxy's research director, Coldcard hackers are still active, and one hacker stole a key generated by increasing entropy through 5 dice rolls.

Coinkite's hardware wallet Coldcard has been exposed for a serious entropy vulnerability, which has gone undetected since 2021, resulting in over $100 million in Bitcoin being stolen, with victims mostly being users of single mnemonic wallets. The weak entropy allowed attackers to guess private keys through customized means, prompting the Bitcoin community to reassess the reliability of single-signature self-custody.Against this backdrop, multi-vendor multisig solutions are becoming the new custody baseline recommended by long-term holders. This solution requires users to construct multisig addresses using keys from different wallet vendors, such as Trezor Safe 7, Ledger Nano, and Casa recovery keys to form a 2-of-3 multisig, thereby reducing reliance on a single hardware vendor. Multisig can also defend against wrench attacks and has given rise to Bitcoin insurance services priced in BTC, such as AnchorWatch.However, multisig also has its drawbacks; users not only need to keep threshold keys but also need to save copies of the multisig script or template to independently recover funds when the wallet service is offline.

Bitcoin News posted on the X platform that BTC Sessions stated their team spent several weeks assisting Bitcoin holders affected by the Coldcard vulnerability in transferring their funds to safety, estimating that they protected Bitcoin worth tens of millions of dollars during this period. However, for many, it was too late.A member of the local Bitcoin community lost 90% of their Bitcoin, while another woman who spoke with them lost all of her Bitcoin. BTC Sessions stated that this could be the most severe self-custody incident in Bitcoin history. BTC Sessions indicated that this experience prompted them to rethink asset custody, with diversified security measures becoming a key lesson.

According to Cointelegraph, Galaxy Research has updated the tracking data of the Coldcard hardware wallet attack, confirming that 1,789.28 BTC (worth approximately $114.7 million at the time of the incident) was stolen from 8,865 addresses. Alex Thorn, head of Galaxy Research, stated that 87.3% (approximately 1,561 BTC) remains unspent in addresses controlled by the attackers, with all Bitcoin stolen in the first three waves of attacks still untouched.In subsequent attacks, some Bitcoin has been transferred through CoinJoin mixing transactions and small splits. The statistics are based on 221 victim reports, covering losses of 790.72 BTC, with a median loss of 1.04 BTC, and more than half of the reports involve losses exceeding 1 BTC. Galaxy has shared the attackers' addresses with exchanges, compliance companies, and law enforcement agencies, hoping that funds can be frozen when they flow into centralized intermediaries.

According to monitoring by Galaxy's research director, the Coldcard vulnerability incident involved 8,865 addresses, resulting in a total loss of 1,789.28 BTC, valued at $114.7 million at the time of theft, currently worth $138.8 million.By address statistics, the median loss per address was 0.00152 BTC, with an average of 0.20184 BTC; the median dormancy period was 3.2 years, with an average of 3.6 years. In 221 victim reports, the median loss was 1.04272 BTC, with an average of 3.57792 BTC; the median dormancy period was 3.25 years, with an average of 2.99 years. The losses reported by victims amounted to 790.72 BTC, accounting for 44.2% of the total loss. If medium-confidence losses are included, and the related losses have not yet been confirmed, the total loss will reach 1,824 BTC, valued at $140 million based on the price at the time of loss.

Bitcoin News posted on the X platform that Coinkite has released a new firmware update for Coldcard to fix the security issue with the mnemonic phrases.The previously vulnerable mnemonic phrases are still not safe and should be replaced.

Coldcard has released the latest firmware 5.6.1 (Mk4/Mk5) and 1.5.1Q (Q). This update is based on a three-week security review following an emergency fix, focusing on addressing the security risks posed by previous mnemonic phrase generation attacks. Each newly generated mnemonic phrase must include at least one user entropy source, such as irregular key presses at least 65 times, physical dice rolls 50 times, or physical coin tosses 128 times, combined with fresh entropy provided by STM32 TRNG, SE1, and SE2.The new firmware also adds pre-signing phased PSBT verification, strengthens USB connection and firmware update boundaries, improves Delta Mode isolation mechanisms, fixes active wallet backup issues, enhances random number generator initialization and fault checking, adjusts SIGHASH default settings, and includes multiple security and correctness improvements. Coldcard states that this update aims to further reduce the risk of the device being attacked.The official reminder is that updating the firmware cannot fix existing mnemonic phrases generated by previously affected firmware. If a user's mnemonic phrase falls within the scope of this security announcement, they should first update the device, then generate and verify a brand new mnemonic phrase, and migrate funds to the new wallet. Coldcard recommends that all Mk4, Mk5, and Q users update their devices promptly and verify the signatures of the downloaded firmware.

According to on-chain detective Specter, the victim claims to have transferred funds from Bitcoin to Ethereum due to a hack on Coldcard. However, on-chain data shows that 73 BTC (worth $4.6 million) originally came from the Whirlpool mixer two weeks ago, with some of it crossing over to Ethereum and subsequently deposited through a phishing Tornado Cash interface.Two mixers were used during the related fund transfer process. The individual was also found to be present in Telegram groups related to private key searches and brute force cracking. On-chain detective Specter indicates that the victim may be a threat actor, and their funds may have also been stolen by another threat actor.

According to Bitcoin Magazine, the investigation into the large-scale theft of Coldcard hardware wallets in July 2026 has made progress. Approximately 1,082.65 BTC (about $118 million) from the first wave of attacks remains in the attackers' addresses. The investigation found that the attackers used a paid account from a certain blockchain data service provider, and the internal logs "highly match" the theft pattern. Relevant clues have been handed over to law enforcement. Galaxy Research analyst Alex Thorn stated that the identity of the first wave of attackers "may have been grasped by law enforcement."Subsequent waves of attacks resulted in a total theft of about 2,000 BTC, with the second wave accounting for approximately 76 BTC. The operational pattern was similar to the first wave, possibly indicating the same perpetrator. The incident originated from an entropy generation vulnerability introduced in Coinkite's code update in March 2021, which caused some devices using MK2 and later models, with firmware version 4.1 and above, to generate low-strength private keys that could be brute-forced. Coinkite has released a fixed firmware and advised users to migrate their assets, but the scope of the vulnerability's impact is still being assessed.

A Bitcoin wallet created in 2012 transferred 212 Bitcoins after being dormant for 14 years, valued at 13.72 million dollars based on the price at the time of transfer. The wallet address was created on August 10, 2012. This batch of Bitcoins was initially worth 2,346 dollars, with a price of 11.07 dollars per coin; based on the price of 64,761 dollars mentioned, if sold entirely, the holder could realize a return of 584,725%. The identity of the wallet owner remains unknown.212 Bitcoins have been transferred from an old P2PKH wallet to an unmarked Bech32 wallet, and after being received in multiple batches, they are stored centrally. A Coldcard vulnerability led to nearly 2,000 Bitcoins being stolen, which may have prompted some long-term holders to transfer their assets, but this address has not been linked to any known entities.

According to the monitoring by the head of Galaxy Research, attacks targeting Coldcard are still ongoing. Users who continue to use Coldcard should remain vigilant and verify their device settings.They continue to assist victims and gather intelligence about the attackers, and they express hope that victims seeking help to track stolen funds can contact them via private message.

Bitcoin News posted on the X platform that Prince Filip learned during his vacation that COLDCARD was hacked. As a Mk3 user, he was at risk of having all his Bitcoin stolen at any moment.

According to the monitoring by the head of Galaxy Research, it has communicated with over 190 victims of Coldcard vulnerability attacks and has asked victims who have not yet contacted them to reach out via private message so that they can provide tracking information and assist in reporting losses to the relevant authorities.Since August 6, no new attack incidents have been confirmed, but this does not mean that new attacks will not occur, and vigilance is required.

According to monitoring by Bitcoin News, new research published by @PraveenPerera shows that Coldcard attackers seem to first identify addresses with vulnerabilities, then sort them by the amount of Bitcoin held, starting to transfer in batches from the addresses with the highest holdings. The transfer software used was relatively crude.One address had 225 spendable UTXOs, and the attackers extracted exactly the latest 200, leaving the earliest 25, which included a UTXO worth 0.16 BTC. This aligns perfectly with the limitation of a blockchain API investigated by researchers, which defaults to returning 200 records, indicating that the attackers may have failed to load the next page of data. The software even spent a UTXO of 294 satoshis, reportedly increasing the transaction fee by about 2040 satoshis, with the spent amount significantly higher than the value of the UTXO itself.The authors of the study believe that the builders of this tool may have a better understanding of the account balance system than of the Bitcoin UTXO model. Although the attackers seem to have obtained the complete seed of the victims, at least 75 BTC still remain in other addresses derived from the same seed. The biggest suspicion currently is that among the 153 stolen addresses, there are still 132.95 BTC, and researchers have been unable to reproduce the seed behind these addresses, so it cannot be ruled out that the attackers obtained undisclosed private device data or candidate data.

After the Coldcard hardware wallet firmware vulnerability was exploited, approximately 2,100 bitcoins were stolen, resulting in a loss of nearly $130 million. On-chain data shows that long-term holders transferred about 233,000 bitcoins from their wallets in the days before and after the incident, worth approximately $15 billion.Casa CEO Nick Neuman stated that some of the transferred funds came from Coldcard users migrating to multi-signature wallets, and Ledger and Trezor users also took similar measures after the incident. During the same period, about 22,000 bitcoins were transferred to exchanges. Coinkite has requested that users who generated recovery phrases using firmware versions 4.1 to 4.1.9 consider the related wallets compromised and immediately migrate to new recovery phrases. The aforementioned versions cover from March 2021 to July 2026.

According to The Block, due to the wallet migration triggered by the Coldcard vulnerability, the number of new Bitcoin addresses surged from about 260,000 to over 330,000 last week, reversing the downward trend that persisted for most of 2026.Since July 30, Coinkite hardware wallet users have lost at least 1,816 BTC (approximately $116 million) in four waves of attacks. The vulnerability originated from a firmware defect in 2021—using a less secure software random number generator when generating mnemonic phrases instead of the device's built-in hardware entropy source, allowing attackers to brute-force wallets generated offline. Coinkite has advised users who generated wallets between March 2021 and the release of the security patch to migrate to new wallets.This incident highlights the risks associated with self-custody, as users are reassessing the pros and cons of self-custody versus custodial solutions like centralized exchanges or ETFs.