Home
Cryptocurrency
Cryptocurrency News
Bitcoin Wallet Exploit Costs Users $38 Million in 25 Minute Attack

Bitcoin Wallet Exploit Costs Users $38 Million in 25-Minute Attack

Security flaw in Coldcard key generation exposed hundreds of Bitcoin wallets to theft

Written by Rahul Dhingra, Edited by Rohan Pal | Updated: 31 July 2026 18:22 IST

Bitcoin Wallet Exploit Costs Users $38 Million in 25-Minute Attack

Photo Credit: Unsplash/Kanchanara

Researchers linked the theft to a vulnerability in Coldcard’s key generation process

Click Here to Add Gadgets360 As A Trusted Source

Highlights

Attack emptied 500 Bitcoin wallets within a three-block window
Flaw affected seed generation in specific Coldcard firmware versions
Coinkite says newer wallet models were not impacted

On Friday, 500 separate wallets, containing 584 Bitcoin, worth about $38 million (roughly Rs. 363 crore), were attacked and stolen. The attack was traced to a flaw in how Coldcard hardware wallets generated their keys. 1,324 chunks of BTC were moved across 500 transactions inside a three-block window. In response, 562 Bitcoin tokens were pooled into a single address that has not been moved. All of the emptied wallets were single-signature wallets containing more than 0.15 BTC.

Researchers Trace Attack to Weakness in Coldcard Key Generation

The exploit is now part of the growing number of crypto losses in 2026. Coldcard is a hardware wallet built by a Canadian company called Coinkite. The wallet is a tiny standalone device that stores Bitcoin keys offline, away from internet-connected devices. Mk2, Mk3, Mk4, Q, and Mk5 are subsequent generations of the said product, released after a few years, similar to how a cell phone company releases numbered models. Your exposure is dependent on the version of the firmware your device had when you initially created your wallet.

Crypto Hacks Discussion

Explore More...

Every wallet has a seed phrase, which is a secret phrase controlling the funds. All these phrases are drawn at random from a vast pool, and guessing them is next to impossible. But Coldcard's firmware was not doing that. According to the report released by the Bitcoin engineering and security teams at Block, one build flag caused the machine to ignore its own hardware random number generator, and the verification within a library module just checked for the existence of the flag, and not its status. The key generation silently failed back to a primitive software algorithm based on the serial number and time counter registers of the chip.

Samsung SDS Partners With Upbit Operator to Develop Stablecoin Infrastructure

In this regard, Coinkite informed users who created seeds using an Mk3 device in versions 4.0.1 and above that "Mk4, Q and Mk5 are not affected based on our early analysis." According to Block, the company informed Coinkite about its findings, and the Coinkite team acknowledged the same. The analyses by both companies are considered preliminary; according to Block, it published its findings without confirming the exploitability of the vulnerability, which was already exploited.

The exposure goes past wallet seeds. The generator was used to create Coldcard's paper wallet private keys, wherein the output is taken as the key without any further derivation, in addition to seed splitting masks, cloning keys, and Key Teleport transfers.

Reports by on-chain security platform Blockaid show that crypto losses have hit $1 billion (roughly Rs. 9,547 crore) during the first half of 2026 as the sector witnessed its highest tally of hacks within six months. The two blockchain networks, Ethereum and Solana, experienced the biggest impact of attacks on their systems. While code exploitation was the cause of Ethereum attacks, keys and signing infrastructure breaches were the reason behind Solana losses.

Cryptocurrency is an unregulated digital currency, not a legal tender and subject to market risks. The information provided in the article is not intended to be and does not constitute financial advice, trading advice or any other advice or recommendation of any sort offered or endorsed by NDTV. NDTV shall not be responsible for any loss arising from any investment based on any perceived recommendation, forecast or any other information contained in the article.

Cryptocurrency Prices across Indian exchanges

Comments

Get your daily dose of tech news, reviews, and insights, in under 80 characters on Gadgets 360 Turbo. Connect with fellow tech lovers on our Forum. Follow us on X, Facebook, WhatsApp, Threads and Google News for instant updates. Catch all the action on our YouTube channel.

Further reading: Crypto hacks, Frauds, Crypto Scams, Bitcoin

Rahul Dhingra

Email Rahul Dhingra

Rahul Dhingra is a crypto writer at Gadgets 360, where he covers the exciting world of Cryptocurrency, Blockchain, Defi and Web3. Before joining Gadgets 360, he worked as a content specialist for a European-based Crypto Exchange. Rahul loves storytelling, not just through the written word but also through the visual medium. Beyond his professional life, Rahul is a sports fanatic. Whether it’s cricket or football, his passion for the game is contagious. More