{"id":53815,"date":"2026-08-03T09:05:38","date_gmt":"2026-08-03T14:05:38","guid":{"rendered":"https:\/\/bitcoinmagazine.com\/?p=53815"},"modified":"2026-08-03T09:05:55","modified_gmt":"2026-08-03T14:05:55","slug":"coldcard-bitcoin-theft-continues","status":"publish","type":"post","link":"https:\/\/bitcoinmagazine.com\/news\/coldcard-bitcoin-theft-continues","title":{"rendered":"Coldcard Bitcoin Theft Continues, Now Estimated Over $114 Million In Total Stolen"},"content":{"rendered":"<div id=\"bsf_rt_marker\"><\/div>\n<p class=\"wp-block-paragraph\">Hackers continue to drain Coldcard Bitcoin wallets, with the total amount stolen now estimated to be standing at over $114 million.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A fourth wave of attacks likely started on Sunday evening, <a href=\"https:\/\/x.com\/intangiblecoins\/status\/2084079706320646300\">according<\/a> to Galaxy Research&#8217;s Alex Thorn. Posting at around 7:50pm in New York, he revealed then that 388.9 Bitcoins worth over $29 million had been moved in new transactions that were highly likely to be part of the theft.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hackers started by taking over $35 million in Bitcoin from wallets on Thursday. Coinkite, which makes Coldcard, said that a firmware bug in Coldcard Mk3 devices \u2014 starting with version 4.0.1 in March 2021 \u2014 caused seed generation to fall back to a weak software Pseudorandom Number Generator instead of the hardware true random number generator, allowing hackers to essentially guess investor seedphrases.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The theft continued throughout the weekend while Coinkite and other Bitcoiners urged Coldcard users to immediately move their funds.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Posting on X on Monday, Trezor&#8217;s Josef T\u011btek wrote that the biggest transaction in the ongoing theft so far was 51 Bitcoins.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">The biggest drained address (so far) is 51 BTC. Damn. Imagine owning 50+ btc in cold storage and losing it all. Must be absolutely crushing. <a href=\"https:\/\/t.co\/qu6CiQOjeV\">pic.twitter.com\/qu6CiQOjeV<\/a><\/p>&mdash; Josef T\u011btek (@JosefTetek) <a href=\"https:\/\/x.com\/JosefTetek\/status\/2084196479292346599?ref_src=twsrc%5Etfw\">August 3, 2026<\/a><\/blockquote><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Coinkite has since admitted all of its models were vulnerable following more thefts. Engineers have warned that all Bitcoin addresses related to Coldcard could be <a href=\"https:\/\/bitcoinmagazine.com\/news\/coldcard-security-risk-immediate-action-required\">at risk<\/a> eventually.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The company said Sunday that it was asking &#8220;hard questions about our company.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;The last three days have been some of the hardest in this company&#8217;s history, and for a lot of the people reading this, they&#8217;ve been something much worse,&#8221; Coinkite said.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Money that took years to save, gone. Trust that took years to build, broken. That impact is real, and for some, the damage is permanent.&#8221;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The company added that it had destroyed its remaining Coldcard inventory manufactured with the vulnerable firmware, and shipments of the product have been halted.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Coinkite makes a number of Bitcoin products, including the popular cold storage hardware wallets.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Engineers at payments company Block investigated the hack and reported that the hackers used a top blockchain services provider for help in moving the funds, and that they\u2019ve contacted the provider and federal authorities with their findings.&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Bitcoin wallets continue to be drained in the ongoing hack. <\/p>\n","protected":false},"author":3860,"featured_media":53816,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4378],"tags":[76,1263,1692,594],"class_list":["post-53815","post","type-post","status-publish","format-standard","has-post-thumbnail","category-news","tag-bitcoin","tag-coinkite","tag-coldcard","tag-hack"],"author_data":{"id":3860,"name":"Mathew Di Salvo","nicename":"mathewdisalvo","avatar_url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2026\/07\/cropped-Mathew-Di-Salvo-scaled-1.jpeg"},"featured_image_url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2026\/08\/Coldcard-Bitcoin-Theft-Continues.jpg","_links":{"self":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/53815","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/users\/3860"}],"replies":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/comments?post=53815"}],"version-history":[{"count":1,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/53815\/revisions"}],"predecessor-version":[{"id":53817,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/53815\/revisions\/53817"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/media\/53816"}],"wp:attachment":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/media?parent=53815"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/categories?post=53815"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/tags?post=53815"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}