Starting 30 July 2026 attackers drained BTC in four waves from thousands of addresses whose seeds were generated on Coldcard hardware wallets running firmware 4.0.0+ (March 2021 onward), where a firmware bug bypassed the dedicated hardware RNG during key generation, cutting effective key strength to as little as 40 bits and allowing offline brute-forcing.

Coldcard hardware wallets (by Coinkite) suffered from a firmware bug (since March 2021 on certain versions) that generated seeds with insufficient entropy (~40 bits on Mk3, ~72 bits on newer models vs. the intended 128 bits). Attackers offline brute-forced predictable private keys and drained numerous single-signature Bitcoin addresses across multiple waves without ever accessing the devices, with cumulative losses exceeding $100 million and the incident ongoing.