$86M Vanishes in Coldcard’s Silent Bitcoin Flaw: What’s Lurking Behind the PRNG?
Imagine losing $86 million not because you clicked the wrong link or left your wallet unattended, but due to a nearly invisible bug lurking quietly in your hardware wallet’s very code since 2021. That’s exactly what the latest Bitcoin hack unveiled—a catastrophic flaw in Coldcard’s firmware, stealthily draining 1,367 BTC across thousands of addresses without the usual suspects like phishing or physical theft. It’s a harsh wakeup call reminding us that the fortress of self-custody hinges entirely on the randomness of seed generation—a single misconfigured macro, and years of security evaporate into thin air, unnoticed. In a world where securing your crypto often feels like guarding fortune with digital fairy dust, how much faith can we really place in the “random”? Buckle up, this isn’t just a Coldcard failure; it’s a systemic vulnerability echoing through the very foundations of crypto security. LEARN MORE.
The latest Bitcoin hack happened when a pseudo-random number generator (PRNG) vulnerability embedded in Coldcard hardware wallet firmware since March 2021 has resulted in the confirmed loss of 1,367 BTC, roughly $86M, across 4,585 addresses, according to on-chain mapping published by Galaxy Research as of August 2, 2026.
The incident is the worst hardware wallet hack in Bitcoin history by confirmed losses, and it required no phishing, no physical device access, and no user error. This is not simply a Coldcard product failure.
🚨 A 3rd wave in what we suspect are hacks of Coldcard-generated addresses has been identified in which 207.7294 BTC has been drained.
Our estimated observed size of the Coldcard hack is now 1,367.05 BTC (~$88.6m) across 4,585 addresses.
More updates in the thread below 👇 https://t.co/hPtXh9444D pic.twitter.com/g6xA4OOi2f
— Galaxy Research (@glxyresearch) August 1, 2026
It is a structural demonstration that the security guarantee of any self-custody arrangement, hardware or software, rests entirely on the entropy quality of its seed generation, and that a single misconfigured preprocessor macro can silently collapse that guarantee for years without triggering any observable alarm.
This latest Bitcoin hack came as BTC USD trades -1.4% down on the day, sitting at $62,250 following a volatile seven days that have seen it fall from over $65,000. 24-hour trading volume sits at $16.9Bn, down from over $20Bn yesterday.
Bitcoin Hack Mechanics: How a Misconfigured Macro Broke Five Years of Seed Generation
The root cause of the issue identified by Block’s engineering team lies in Coldcard’s libngu library. Coinkite configured the board to zero to disable MicroPython’s RNG, intending to use its hardware true random number generator (TRNG). However, the libngu guard only checked if the macro was defined, allowing zero to pass the check.
As a result, MicroPython compiled out the STM32 hardware RNG call and relied on Yasmarang, a software PRNG with only about 40 bits of effective entropy instead of the expected 128 bits for a BIP-39 seed phrase.
While later models (Mk4, Mk5, Q) improved to an estimated 72 bits of effective entropy, this still falls short of the ideal. The disparity between 40 bits and 128 bits is significant, making it easier for attackers to target weak seeds.
On July 30, 2026, Coinkite issued a security notice just hours before an attack that drained approximately 594 BTC from 500 addresses. Two additional waves were tracked, totaling 1,367.05 BTC across 4,585 addresses by August 2. Most of the stolen Bitcoin remains unspent, suggesting the attacker is biding their time before moving the funds.
DISCOVER: Best Meme Coins to Buy in 2026
Crypto Security Context: A Recurring Entropy Failure Pattern
$1.6 million dollars in Bitcoin was drained from my account on July 29th in the Cold Card wallet hack.
My Bitcoin was in cold storage. My keys were on a ColdCard device kept in a safety deposit box that had never been connected to the internet.
This part’s nerdy, but here’s… pic.twitter.com/Lf9kJv9Jo4
— Jonathan Goodman 🇨🇦 (@itscoachgoodman) August 1, 2026
The Coldcard incident fits a documented pattern. Android’s SecureRandom flaw in 2013 repeated nonces across ECDSA signatures, exposing keys across multiple Bitcoin wallets. The Profanity vanity address generator used in the Wintermute hack of 2022 seeded key generation with 32 bits of entropy, enabling an attacker to drain $160 million.
The Milk Sad disclosure in 2023 found that bx seed in Libbitcoin Explorer used a Mersenne Twister seeded by system time, collapsing 256 bits of expected entropy to roughly 32 and exposing more than 120,000 wallets. Different codebases, different chains, the same structural failure: a randomness source assumed to be strong was not.
Ari Redbord, global head of policy at TRM Labs, characterized the incident as evidence that self-custody transfers risk rather than eliminates it, a framing consistent with TRM Labs’ H1 2026 data showing that infrastructure and key compromises, while representing only 15 percent of incidents, accounted for 76 percent of total dollar losses across a record 207 hack events.
Galaxy said it has reported roughly 600 suspected attacker-controlled addresses to federal investigators, compliance vendors, and cybersecurity firms, while cautioning that its Coldcard attribution rests on on-chain heuristics rather than per-address computational seed reconstruction.
EXPLORE: Best Meme Coins to Buy for August
Disclaimer: Coinspeaker is committed to providing unbiased and transparent reporting. This article aims to deliver accurate and timely information but should not be taken as financial or investment advice. Since market conditions can change rapidly, we encourage you to verify information on your own and consult with a professional before making any decisions based on this content.
Daniel Frances is a technical writer and Web3 educator specializing in macroeconomics and DeFi mechanics. A crypto native since 2017, Daniel leverages his background in on-chain analytics to author evidence-based reports and deep-dive guides. He holds certifications from The Blockchain Council, and is dedicated to providing “information gain” that cuts through market hype to find real-world blockchain utility.
