Coldcard Firmware Flaw Let Attackers Remotely Drain 1,816 BTC ($116M), TRM Labs Says

Published October 16, 2026, 17:42 PKT. Based on TRM Labs's report "The Largest Hardware Wallet Exploit of 2026", Basis Desk's October 16 summary of the report, and reporting by Decrypt, Altcoin Buzz and CryptoNewsBytes.

Attackers drained 1,816 bitcoin, worth about $116 million, from more than 5,200 Coldcard hardware wallets by exploiting a firmware flaw that had been silently weakening the devices' wallet seeds since March 2021, according to blockchain intelligence firm TRM Labs. The report, summarized by Basis Desk, calls it the largest hardware wallet exploit of 2026 and the third-largest crypto hack of the year. The attackers never touched the physical devices.

Four waves starting July 30, 594 BTC in 25 minutes

The drain began on July 30, 2026 and unfolded in four distinct transaction waves, TRM Labs said. The first wave was the fastest: roughly 594 bitcoin moved from about 500 wallets into a single consolidation address within 25 minutes, according to Basis Desk's summary of the findings. Three more waves followed, ultimately reaching 1,816 BTC across more than 5,200 addresses. Because the weakness sat in the generated seeds rather than in the devices, updating the firmware does not protect funds created on affected versions; affected users must move their bitcoin to newly generated wallets, Decrypt noted.

The March 2021 firmware error that killed the randomness

The flaw lived in Coldcard firmware version 4.0.1, released in March 2021, TRM Labs said. A build configuration error caused certain devices to bypass the hardware random number generator on their STM32 chips and fall back to a weak software random number generator during seed creation, Basis Desk reported. That collapsed effective cryptographic key strength from the designed 128 bits down to as few as 40 bits on some devices, enabling remote brute-force attacks against self-custody wallets without physical access. Altcoin Buzz, drawing on the firms' technical breakdowns, added that Coinkite estimates roughly 40 bits of effective entropy on Mk3 models and about 72 bits on the Mk4, Mk5 and Q, against 128 bits for a standard 12-word BIP-39 seed, and that the software fallback, called Yasmarang, was seeded from the chip's unique ID and timer registers.

What a firmware update cannot fix

Updating the device firmware prevents new weak seeds, but it does not repair recovery words already generated. CryptoNewsBytes's write-up stresses that users who created a Coldcard seed between March 2021 and July 2026 should treat that seed as compromised, update to the latest firmware, generate a completely new seed, and migrate all funds, because restoring the old recovery words on any device recreates the same vulnerable wallet.

Dice rolls and strong passphrases offered a defense

Not every Coldcard user was exposed. According to the CryptoNewsBytes summary, users who generated their seeds using at least 50 private dice rolls, or who applied a strong BIP-39 passphrase on top of the generated seed, were not affected by the entropy flaw.

White hats moved 52 BTC into a recovery trust

A small slice of the stolen funds was rescued. Altcoin Buzz reported that white-hat actors moved 52.37 BTC tied to the exploit into an address controlled by the Crypto Recovery Trust, a Wyoming statutory trust, a transfer recorded in Bitcoin block 967,948 and flagged by Galaxy Digital head of research Alex Thorn. The trust now holds roughly 2.8 percent of the exploit funds Galaxy is tracking, while the remaining 1,816 BTC sits in attacker-controlled addresses.

This article is news reporting and is not investment advice.

Sources

• TRM Labs, "The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack", primary source for the 1,816 BTC and 5,200-address totals, the four attack waves, the 594 BTC first-wave consolidation, the firmware 4.0.1 March 2021 defect, the 128-to-40-bit entropy collapse, and the remote brute-force method
• Basis Desk, Coldcard Bug Enables $116M Bitcoin Wallet Exploit, October 16, 2026, secondary source summarizing the TRM Labs report
• Altcoin Buzz, Coldcard entropy exploit: 52 BTC moved to Crypto Recovery Trust, secondary source for the Yasmarang software RNG detail, the 40-bit Mk3 and 72-bit Mk4/Mk5/Q estimates, and the 52.37 BTC white-hat recovery via the Crypto Recovery Trust
• Decrypt, What Is a Hardware Wallet? Crypto Cold Storage Explained, October 16, 2026, secondary source confirming the TRM Labs figures and the migrate-not-update guidance
• CryptoNewsBytes, Coldcard Hack: $116M Bitcoin Stolen via 2021 Firmware Flaw, secondary source for the March 2021 to July 2026 exposure window and the dice-roll and BIP-39 passphrase exemptions