Massive Bitcoin Heist: Hackers Exploit Coldcard Flaw, Steal $89M
WHO:
Fox Business - Coinkite, the Canadian company that makes Coldcard wallets.
Fox Business - Rodolfo Novak, CEO of Coinkite.
Fox Business - Galaxy Research, the firm that reported the attacks.
Fox Business - Samson Mow, CEO of Jan3.
WHAT:
Fox Business - Researchers at Galaxy identified two additional suspected waves of attacks, increasing the estimated losses to nearly $89 million.
Fox Business - Coinkite CEO Rodolfo Novak stated, "I'm sorry and I'm devastated. Our team is heartbroken about yesterday's news."
Fox Business - Coinkite warned that moving the same recovery phrase into another wallet does not solve the problem because the weakness follows the recovery phrase itself, not the physical device.
Cointelegraph - Galaxy research head Alex Thorn warned that unconfirmed transactions may give some Coldcard users a narrow opportunity to save their funds.
Cointelegraph - The “sickening” loss of $90 million of Bitcoin from cold storage weighs heavily on sentiment, as the Clarity Act stalls with just five days left to hold a Senate vote.
Fox Business - Hackers exploited a vulnerability in Coldcard wallets, draining approximately $89 million in Bitcoin.
99 Bitcoins - A firmware bug in Coldcard's random-number generator allowed attackers to reconstruct private keys, resulting in the theft of 1,367 BTC from 4,585 addresses.
Fox Business - The attacks drained more than 1,000 Bitcoin from 1,196 digital wallets in just 41 minutes on July 30.
Fox Business - Coinkite released a software update to prevent the issue from affecting newly created wallets.
WHERE:
Fox Business - The attacks affected users of Coldcard wallets globally, as they are used by cryptocurrency investors to store Bitcoin offline.
WHEN:
Fox Business - The initial wave of attacks occurred on July 30.
Fox Business - Coinkite is urging users to create a new recovery phrase and move their Bitcoin immediately.
WHY:
Fox Business - A coding mistake in certain versions of Coldcard weakened a key security feature, making recovery phrases predictable for attackers.
HOW:
Cointelegraph - The five-year bug escaped detection because auditors verified that the intended random number generator existed, but not that it was being called.
Fox Business - The vulnerability allowed sophisticated attackers to figure out recovery phrases, enabling them to steal Bitcoin without physical access to the wallets.
Fox Business - Coinkite warned that simply updating the firmware does not protect users who generated a recovery phrase using the affected software.
(UPDATED August 3, 2026 18:38 UTC)
Researchers at Galaxy have identified two additional suspected waves of attacks, raising the estimated losses to nearly $89 million, which has left the cryptocurrency community reeling. Coinkite CEO Rodolfo Novak expressed his devastation over the situation, stating that the team is heartbroken about the recent news, while also warning that moving the same recovery phrase into another wallet does not resolve the underlying issue. Meanwhile, Galaxy's research head Alex Thorn cautioned that unconfirmed transactions might provide some Coldcard users with a slim chance to recover their funds, as the “sickening” loss of $90 million from cold storage looms heavily over the industry, especially with the Clarity Act stalling just five days before a crucial Senate vote.
--
(UPDATED August 3, 2026 16:25 UTC)
Hackers have exploited a vulnerability in Coldcard wallets, draining approximately $89 million in Bitcoin from users globally, with the initial wave of attacks occurring on July 30. The firmware bug in Coldcard's random-number generator allowed attackers to reconstruct private keys, leading to the theft of 1,367 BTC from nearly 4,600 addresses in just 41 minutes. In response, Coinkite has released a software update and is urging users to create a new recovery phrase and move their Bitcoin immediately, as simply updating the firmware does not protect those who used the affected software.