Bitcoin Wallet Exploit Costs Users $38 Million in 25-Minute Attack

On Friday, 500 separate wallets, containing 584 Bitcoin, worth about $38 million (roughly Rs. 363 crore), were attacked and stolen. The attack was traced to a flaw in how Coldcard hardware wallets generated their keys. 1,324 chunks of BTC were moved across 500 transactions inside a three-block window. In response,  562 Bitcoin tokens were pooled into a single address that has not been moved. All of the emptied wallets were single-signature wallets containing more than 0.15 BTC. 

Researchers Trace Attack to Weakness in Coldcard Key Generation

The exploit is now part of the growing number of crypto losses in 2026. Coldcard is a hardware wallet built by a Canadian company called Coinkite. The wallet is a tiny standalone device that stores Bitcoin keys offline, away from internet-connected devices. Mk2, Mk3, Mk4, Q, and Mk5 are subsequent generations of the said product, released after a few years, similar to how a cell phone company releases numbered models. Your exposure is dependent on the version of the firmware your device had when you initially created your wallet.

Every wallet has a seed phrase, which is a secret phrase controlling the funds. All these phrases are drawn at random from a vast pool, and guessing them is next to impossible. But Coldcard's firmware was not doing that. According to the report released by the Bitcoin engineering and security teams at Block, one build flag caused the machine to ignore its own hardware random number generator, and the verification within a library module just checked for the existence of the flag, and not its status. The key generation silently failed back to a primitive software algorithm based on the serial number and time counter registers of the chip. 

In this regard, Coinkite informed users who created seeds using an Mk3 device in versions 4.0.1 and above that "Mk4, Q and Mk5 are not affected based on our early analysis." According to Block, the company informed Coinkite about its findings, and the Coinkite team acknowledged the same. The analyses by both companies are considered preliminary; according to Block, it published its findings without confirming the exploitability of the vulnerability, which was already exploited. 

The exposure goes past wallet seeds. The generator was used to create Coldcard's paper wallet private keys, wherein the output is taken as the key without any further derivation, in addition to seed splitting masks, cloning keys, and Key Teleport transfers.

Reports by on-chain security platform Blockaid show that crypto losses have hit $1 billion (roughly Rs. 9,547 crore) during the first half of 2026 as the sector witnessed its highest tally of hacks within six months. The two blockchain networks, Ethereum and Solana, experienced the biggest impact of attacks on their systems. While code exploitation was the cause of Ethereum attacks, keys and signing infrastructure breaches were the reason behind Solana losses.