The Coldcard Wallet Hack; $80M Was Stolen in Just 41 Minutes

The Coldcard Wallet Hack: How $80M Was Stolen in Just 41 Minutes

The Coldcard wallet hack has highlighted one of the most important lessons in cryptocurrency security: even hardware wallets designed to keep Bitcoin offline can be compromised by weaknesses in how their wallet seeds are generated.

According to a detailed blockchain investigation by Bitquery, approximately 1,240 BTC, worth around $80 million, was stolen from 3,297 Bitcoin addresses during a campaign that began on 30 July 2026. The most significant phase of the attack happened extraordinarily quickly, with approximately $68 million taken during a 41 minute period.

For cryptocurrency users, businesses and investigators, the incident demonstrates why crypto forensic investigations and blockchain analysis are becoming increasingly important.

What happened in the Coldcard wallet hack?

The incident was not a conventional cyberattack involving malware, phishing or an attacker physically accessing victims’ devices.

Instead, the underlying problem involved the generation of wallet seeds. A Bitcoin wallet seed is effectively the foundation from which the wallet’s private keys and addresses are derived; if an attacker can predict or reproduce a seed, they can potentially derive the associated addresses and access the funds held within them.

Bitquery reports that a build error dating back to March 2021 caused certain affected Coldcard devices to generate wallet seeds using an ordinary software random number generator rather than the dedicated hardware randomness intended for the devices.

The result was a dramatically reduced level of randomness, or entropy, in some affected seeds. Coinkite’s security documentation explains that secure seed generation is fundamental to Coldcard’s security model and that its devices use multiple sources of true randomness, with users also able to supplement this process using dice rolls.

The critical point is that the attacker did not need to break into individual wallets; instead, compromised seeds could potentially be calculated and matched against publicly visible Bitcoin addresses.

$80 million disappeared in 41 minutes

The speed of the attack is perhaps the most striking aspect of the incident.

According to Bitquery’s reconstruction of the Bitcoin blockchain, the major theft began at approximately 01:10 UTC on 30 July 2026 and the serious part of the first wave was completed by approximately 01:51 UTC.
During those 41 minutes, three collection addresses received funds from approximately 1,199 Bitcoin addresses, accumulating around 1,050 BTC, worth approximately $68 million at the time.

This demonstrates the effectiveness of automation in modern cryptocurrency crime; once an attacker has identified a vulnerability affecting a large number of wallets, blockchain transactions can be generated and broadcast at scale. What might take a human attacker days or weeks to execute can potentially be completed in minutes using automated systems.

Bitquery also identified four waves of activity involving thousands of victim addresses.
The wider campaign was estimated to have involved approximately 3,297 victim addresses and 1,240.42 BTC in the investigation’s confirmed analysis.

Blockchain forensics reveals where the Bitcoin went

One of the most interesting aspects of the Coldcard incident is that the stolen Bitcoin has not simply disappeared. Bitcoin transactions are recorded permanently on the blockchain, creating an extensive source of potential digital forensic evidence.

Bitquery’s analysis found that approximately 95% of the Bitcoin traced in its investigation had not moved as of 7 August. Around 1,176 BTC was sitting in six addresses that had never made an outgoing transaction.

This creates a fascinating situation for investigators; the stolen cryptocurrency can be publicly observed on the blockchain, but visibility does not necessarily mean immediate recovery.

Investigators can monitor addresses, identify transaction patterns and establish relationships between wallets, but they cannot simply reverse Bitcoin transactions.

The moment stolen funds begin moving, however, blockchain investigators can potentially follow their path.

The importance of cryptocurrency investigations

The Coldcard incident illustrates why cryptocurrency investigations are increasingly important following a cyberattack or financial crime.

Traditional digital forensics may focus on computers, mobile phones, servers, emails, cloud accounts and other digital devices. Blockchain investigations add another layer by examining transactions and movements of cryptocurrency.

Investigators can analyse:

Bitcoin addresses and transaction histories
Wallet to wallet transfers
Transaction timing and patterns
Collection addresses
Cryptocurrency mixing activity
Exchange interactions
Blockchain clusters
Potential links between wallets and known services

In the Coldcard investigation, Bitquery identified a later transaction in which approximately 64.9 BTC was moved and subsequently entered a CoinJoin transaction, making the subsequent movement of the funds significantly more difficult to trace.

This illustrates why speed is critical in digital forensics. The earlier investigators identify stolen cryptocurrency and begin monitoring associated addresses, the greater the opportunity to document subsequent movements and potentially identify points where the funds interact with regulated services.

Why the Coldcard hack matters to businesses

Although the incident involved individual cryptocurrency wallets, its implications extend to businesses holding digital assets.

Companies increasingly use Bitcoin and other cryptocurrencies for investment, payments, treasury management and other commercial purposes. A compromise of cryptocurrency infrastructure can therefore create significant financial and reputational consequences.

The incident also demonstrates that cybersecurity cannot be limited to protecting devices from unauthorised access.
A system can be physically secure and operate offline, yet still have vulnerabilities in its underlying software, cryptography or key generation processes.

For organisations holding cryptocurrency, security should therefore include:

Secure wallet and seed generation procedures
Regular firmware and software updates
Strong backup controls
Multi signature arrangements where appropriate
Independent security reviews
Transaction monitoring
Incident response procedures
A clear cryptocurrency forensic investigation plan

What can investigators learn from the Coldcard wallet hack?

Perhaps the biggest lesson is that the blockchain itself can become a major source of forensic evidence.

Even when criminals attempt to hide their activity, transactions create a permanent record; investigators can reconstruct what happened, identify the addresses involved and establish a timeline of events.

The Coldcard case also demonstrates the value of analysing transaction behaviour rather than looking at individual transactions in isolation. The identification of multiple collection addresses, simultaneous transfers and later movement into CoinJoin activity provides investigators with behavioural clues that can help reconstruct an attack.

At Evidence IT, this type of analysis can form an important part of a wider IT forensic investigation; examining blockchain activity alongside computers, mobile devices, communications, financial records and other digital evidence can provide a more complete picture of what happened.

Preparing for cryptocurrency related cybercrime

The Coldcard wallet hack is a reminder that cryptocurrency security requires more than simply purchasing a hardware wallet. Businesses and individuals should consider the entire lifecycle of their digital assets, from wallet creation and key generation through to storage, transactions, backups and incident response.

If cryptocurrency is stolen, acting quickly is essential. Preserving relevant evidence, documenting transactions and identifying associated wallet addresses can help establish what happened and provide investigators with information that may become increasingly valuable as stolen funds move.

The $80 million Coldcard wallet hack shows just how quickly a cryptocurrency theft can unfold; within 41 minutes, more than a thousand Bitcoin addresses had been targeted and millions of dollars in digital assets had been transferred.

It also demonstrates why digital forensics and blockchain investigations are essential components of modern cybersecurity.

Cryptocurrency transactions may be irreversible, but they are not necessarily invisible. With specialist blockchain analysis and digital forensic techniques, investigators can follow the evidence, reconstruct events and potentially identify where stolen assets have gone.

For businesses dealing with cryptocurrency, preparing for that possibility before an incident occurs could make a significant difference when every minute matters.

Source: https://bitquery.io/investigations/coldcard-wallet-hack

CONTACT US FOR Digital Risk Management

You can be absolutely sure of a confidential, trustworthy and discreet service at all times, Evidence IT delivers results.