Market
Hackers Drain $116 Million From Coldcard Hardware Wallets in Multi-Wave Attack
12 Aug 2026, 09:48
23 views
Admin
A four-wave attack beginning July 30 drained roughly 1,816 BTC from over 5,200 Coldcard wallet addresses in one of the year's largest hardware wallet exploits.
A coordinated attack beginning July 30 drained approximately 1,816 BTC, worth roughly $116 million at the time, from more than 5,200 addresses linked to Coldcard hardware wallets, in what security researchers are calling one of the largest hardware wallet exploits on record. The theft unfolded in four distinct waves rather than a single event, suggesting attackers methodically worked through a list of compromised addresses over an extended period rather than executing one smash-and-grab operation.
Hardware wallets like Coldcard are typically marketed as one of the most secure ways to store cryptocurrency, keeping private keys isolated from internet-connected devices and requiring physical confirmation for transactions. An exploit at this scale, affecting thousands of addresses, raises serious questions about whether the vulnerability originated in the device firmware itself, in a supply-chain compromise, or in how affected users generated or backed up their seed phrases. Investigations into the precise root cause were still ongoing as the full scope of the incident became clear.
The Coldcard breach adds to what has already been a difficult year for crypto security. Data from blockchain analytics firms shows that hacks and exploits surpassed $1.2 billion across 276 incidents by late July, with crypto platforms alone losing close to $76 million to roughly 40 separate hacks in June. Earlier in the year, a $293 million exploit of Kelp DAO and a $285 million Drift Protocol breach, the latter reportedly linked to a long-running social engineering campaign attributed to North Korean-affiliated hackers, had already pushed 2026 toward record territory for stolen funds.
For individual holders, the incident is a reminder that no storage method is entirely risk-free, and that hardware wallets are only as secure as the processes used to set them up, back them up and keep their firmware current. Security researchers are urging Coldcard users to move funds to newly generated wallets as a precaution while the investigation continues.
Hardware wallets like Coldcard are typically marketed as one of the most secure ways to store cryptocurrency, keeping private keys isolated from internet-connected devices and requiring physical confirmation for transactions. An exploit at this scale, affecting thousands of addresses, raises serious questions about whether the vulnerability originated in the device firmware itself, in a supply-chain compromise, or in how affected users generated or backed up their seed phrases. Investigations into the precise root cause were still ongoing as the full scope of the incident became clear.
The Coldcard breach adds to what has already been a difficult year for crypto security. Data from blockchain analytics firms shows that hacks and exploits surpassed $1.2 billion across 276 incidents by late July, with crypto platforms alone losing close to $76 million to roughly 40 separate hacks in June. Earlier in the year, a $293 million exploit of Kelp DAO and a $285 million Drift Protocol breach, the latter reportedly linked to a long-running social engineering campaign attributed to North Korean-affiliated hackers, had already pushed 2026 toward record territory for stolen funds.
For individual holders, the incident is a reminder that no storage method is entirely risk-free, and that hardware wallets are only as secure as the processes used to set them up, back them up and keep their firmware current. Security researchers are urging Coldcard users to move funds to newly generated wallets as a precaution while the investigation continues.