Bankless · Friday, August 7, 2026
An exploit targeting Coldcard hardware wallets has resulted in the draining of approximately $130 million in Bitcoin from users who believed their assets were secure in cold storage. Hackers allegedly exploited a vulnerability in the seed phrase generation process, enabling AI-powered brute-force attacks. This incident has led to significant concerns about the reliability of self-custody, even when best practices are followed.
“Over $100 million of Bitcoin drained from what was thought to be very safe and secure Bitcoin cold storage.”
“Hackers discovered a vulnerability in the part of the hardware wallet code used to create seed phrases. This allowed them to use AI to brute force guessing seed phrases.”
“My Bitcoin was in cold storage. My keys were on a cold card device kept in a safety deposit box that had never been connected to the internet.”
“From 9.36 to 9.43 p.m. on July 9th, every wallet I ever had had been emptied. 18.2 Bitcoin gone, over $1.6 million Canadian. Perhaps the hardest part about this is that I did everything right. I never shared my seed phrase with anyone. My devices never touched the internet. Everything was kept in multiple safes and safety deposit boxes. None of it mattered.”
“Apparently the way that Coldcard was generating seed phrases was imperfect in its randomness, as in it had like a kink or a flaw in its randomness generation that allowed for AI to like detect that pattern and reduce the scope of how much randomness it would need to do.”