If you can't keep your Bitcoin on an exchange that might freeze withdrawals, or in a hot wallet on a laptop that might get hacked, cold storage was the last answer anyone had left — and on 30 July roughly 1,082 coins drained out of devices that had never once been connected to the internet

Between 01:10 and 01:51 UTC on 30 July, a 41-minute window, more than a thousand Bitcoin addresses tied to Coldcard hardware wallets emptied themselves out. Nothing was phished. No exchange collapsed. No laptop got compromised. The devices involved had been built specifically to never touch the internet, generated their keys offline, and in many cases had sat untouched in a drawer or a safe-deposit box for years. On-chain analysts at Galaxy Research traced 1,082.65 BTC, worth roughly $70 million at the time, out of 1,196 addresses in that single window — a figure the firm has since said will keep climbing as more vulnerable devices get found and swept.

Three days later, the Bitcoin holder posting as wale.moca put the resulting mood into four short lines that circulated widely: can’t keep Bitcoin on an exchange, it might freeze withdrawals or go bankrupt. Can’t keep it in a hot wallet, the laptop might get hacked. Can’t keep it in cold hardware storage, there could be a bug on the manufacturer’s side that exposes the seed phrase. Can’t put it into DeFi either, there’s a new eight-figure hack most months. “So where am I supposed to keep my BTC?” he asked. It read as a rhetorical complaint when a lot of people posted versions of it over the years. By 2 August it wasn’t rhetorical anymore. The third rung of that ladder — the one everybody had been treating as the safe one — was the exact rung that had just given out.

A seed that was never as random as it claimed to be

The device at the center of this is Coinkite’s Coldcard, an air-gapped wallet designed so the private keys controlling someone’s Bitcoin are generated and stored on hardware that has never been connected to a network — the entire point being that nothing reachable over the internet should ever be able to touch them. That design principle held up fine. The flaw sat one layer down, in a single build setting inside firmware version 4.0.1, released back in March 2021, which stayed live for more than five years before anyone caught it.

According to the security researchers who dissected it after the fact, a configuration flag meant to enable the device’s dedicated hardware random number generator was checked incorrectly — the supporting code was testing only for the flag’s existence, when what mattered was whether it had actually been switched on. When it hadn’t, seed generation silently fell back to a much weaker, software-based source of randomness, seeded from nothing sturdier than the device’s serial number and internal timers. The practical effect: keys meant to carry 128 bits of randomness were generated with as little as 40 bits on older Mk3 devices, and around 72 bits on newer Mk4, Mk5 and Q models. Forty bits sounds abstract until you convert it — it works out to something on the order of a trillion possible combinations, a search space vastly smaller than the astronomical one a properly random 128-bit key would require, and well within range of anyone running dedicated cracking hardware at scale.

Because the weakness lives inside the seed itself and not in the device running it, updating a Coldcard’s firmware does nothing to protect money already sitting behind a seed generated on the flawed version. Coinkite’s own advisory is explicit about this: anyone who generated a seed on Mk2/Mk3 firmware 4.0.1 through 4.1.9, or on Mk4/Mk5 firmware before 5.6.0, or on the Q before 1.5.0Q, has to generate an entirely new seed on updated hardware and physically move their coins across — patching the bug fixes nothing already exposed.

“I did everything right”

Jonathan Goodman, a Canadian coach and one of the more visible people to come forward, described losing 18.25 BTC — around $1.6 million Canadian — while he was away at his cottage. His keys had never left a Coldcard kept in a safety deposit box, a device he says had never once been connected to the internet. Logging into Wasabi, the software he used to check his wallets, he watched every one of them empty out in a seven-minute stretch between 9:36 and 9:43pm on 29 July, Ontario time — which, converted to UTC, lands squarely inside the same window Galaxy Research mapped for the broader sweep. Goodman’s own account of the mechanism was that hackers “used AI to brute force guessing seed phrases.” That’s a rough description at best. The entropy collapse described above is what made his seed guessable in the first place, and once a key space narrows down to roughly a trillion candidates, brute-forcing it becomes a matter of ordinary specialized computing power — cryptography doing exactly what the reduced math allowed it to do. Coinkite founder Rodolfo Novak has floated a more specific role for AI: that AI-assisted code review may be what let attackers find a five-year-old bug in public source code faster than the industry’s own review processes ever had. That claim addresses how the flaw was likely discovered, a separate question entirely from how the theft itself was executed.

Novak posted a public apology on 31 July, roughly 30 hours after the theft had already happened.

“I’m sorry and I’m devastated. Our team is heartbroken about yesterday’s news.” — Rodolfo Novak, Coinkite founder, 31 July

Losses have kept climbing since. Galaxy Research’s own running count moved to roughly 1,367 BTC (about $89 million) within days; TRM Labs put a combined total across four waves at roughly 1,816 BTC, about $116 million, drawn from more than 5,200 addresses; and by 4 August, TechCrunch was reporting total losses above $130 million. Nobody has been named as responsible. TRM’s own analysis notes that the way transactions were constructed differed across the separate waves of withdrawals, suggesting more than one attacker was likely involved, working independently off the same public vulnerability rather than as a single coordinated group.

Bitcoin itself performed exactly as designed throughout this. The failure sat entirely inside one hardware manufacturer’s implementation of how a seed gets generated, a step that happens before Bitcoin’s own cryptography is ever called on to do anything.

What actually held up

Not every Coldcard user lost money, and the pattern in who didn’t is instructive. Multisignature setups, where a wallet needs several independent keys from different devices or manufacturers to move funds, were largely or entirely protected — a single compromised Coldcard seed simply wasn’t enough on its own to sign anything. A strong, unique BIP-39 passphrase added on top of a seed also created what is effectively a separate, hidden wallet that can’t be reconstructed from the flawed seed words alone. And Coldcard’s own “Add Dice Rolls” feature, which lets a user manually feed in at least fifty independent physical dice rolls during setup, added enough genuine external entropy that the device’s flawed randomness no longer mattered, even though it was still hashed into the final seed alongside the dice input.

All three of those protections were optional, which is precisely the uncomfortable part. Nobody who lost coins in this did anything careless by the standards the industry had been recommending for years. They followed the standard advice of the era exactly. The people who kept their coins had, for one reason or another, gone one step further than that advice ever insisted on.

One more thing worth knowing if any of this applies to you directly: hardware wallet makers including Trezor and Foundation have separately warned of a phishing wave riding on top of the Coldcard news, including fake “security audit” emails linking to cloned Coinkite pages that walk victims through installing remote-access software under the guise of checking whether their seed is affected. No legitimate migration process will ever ask you to type a recovery phrase into a website. That step happens only on the device itself, never anywhere else.