Coldcard Firmware Flaw Linked to Theft of 1,082 Bitcoin in 41 Minutes
A defect in the firmware of COLDCARD hardware wallets degraded randomness when generating seed phrases and has been linked to coordinated sweeps that drained more than 1,000 Bitcoin in under an hour.
On 30 July 2026 an automated attacker emptied 1,082.65 BTC from 1,196 addresses in only 41 minutes. The operation followed a predictable pattern of rapid, offline seed enumeration made possible by insufficient entropy in seeds created on affected COLDCARD devices from Coinkite.
The vulnerability originated in an integration error introduced in March 2021. Instead of using the hardware RNG of the STM32 microcontroller, certain firmware versions routed seed creation to a deterministic software PRNG seeded solely with the chip’s unique identifier and boot-time registers. No additional entropy was mixed after startup, reducing effective entropy to approximately 40 bits on Mk3 units and 72 bits on Mk4, Mk5 and Q models—far below the 128 bits expected from a standard 12-word BIP39 seed.
Seeds remain vulnerable based on the firmware version present at the moment of creation, not the version running today. Affected ranges include Mk2 and Mk3 devices on versions 4.0.0–4.1.9, Mk4 and Mk5 devices before 5.6.0, and Q devices before 1.5.0Q. Corrected builds were also released in the Edge branches for earlier Mk4/Mk5 and Q hardware.
Coinkite published an emergency firmware release on 31 July 2026 that improves entropy for new seeds. Updating the device does not strengthen an already-generated weak seed; funds must be moved to a freshly created seed after the update.
Users who added manual entropy with dice are considered unaffected only if they performed at least 50 fair, independent, and private rolls. A strong, unique BIP39 passphrase creates a separate wallet and adds a defensive layer but does not replace the need to replace the underlying seed. Multisig setups are safe only when the required quorum does not rely exclusively on keys generated by vulnerable firmware.
Owners of potentially affected addresses are advised to monitor on-chain activity and move funds at the first sign of consolidation or unauthorized sweeps. Once an attacker locates a valid seed, automated draining can occur within minutes.
Related articles
Hydra Darknet Marketplace Loses Anonymity: Alleged Leaders Identified by Investigators
Russian investigators have identified three individuals allegedly involved in the leadership and financial operations of the Hydra darknet marketplace. The probe began with surnames mentioned during the trial of Alexey Baykov in Perm. One suspect, Alexey Kornienko, previously worked in legitimate furniture sales and is now wanted both federally and internationally. Vladimir Verevkin, who handled information security for the Khabarovsk city administration until 2015, is accused of preparing Hydra's financial reports and tracking cryptocurrency flows. Roman Savonin is linked to converting cryptocurrency into cash. Although the marketplace was shut down in 2022, legal proceedings continue as authorities seek to prove the suspects' roles.
French Bank Crédit Mutuel Arkéa Confirms Cyberattack with Blockchain Investigation Estimating $133 Million in Losses
Crédit Mutuel Arkéa has confirmed a cyberattack that enabled fraudulent transactions, though the bank provided no official figures on the financial impact. Blockchain investigator ZachXBT traced more than $106 million moved on November 1 and an additional $27 million, bringing the total beyond $133 million. The funds originated in USDC and USDT, were converted to Ethereum, moved across multiple blockchains, and ultimately exchanged for Monero to hinder tracking. The bank stated that customer assets remained unaffected, operations were gradually restored, and authorities were notified, while warning clients against phishing attempts tied to the incident. Reports have linked the breach to the group's digital bank Fortuneo, a connection the institution has not confirmed. The case highlights how blockchain analysis can reveal the scale of financial crime before official disclosures from the victim.
Binance Hit by Record $6.3 Billion Theft After Engineer Laptop Compromise
Binance suffered what could become the largest crypto theft in history, with approximately $6.3 billion in assets drained from exchange wallets over three days in late October. On-chain analysts at Arkham and Glassnode first detected the movement of $5.3 billion, including $1.66 billion in USDT, 17,985 ETH worth $1.45 billion, and $767 million in USDC. Binance confirmed the incident, halted deposits and withdrawals, froze around $3 billion on-chain with law enforcement and partners, and pledged to cover all losses from its SAFU fund. The root cause was traced to a compromised laptop belonging to a development operations engineer, allowing attackers to access a service container and issue authorized-looking withdrawal transactions without any private key exposure. The attack bypassed traditional cold wallet protections by impersonating legitimate privileged access rather than stealing cryptographic keys. Industry observers note this highlights systemic risks in developer endpoint security, long-lived credentials, and control-plane protections across exchanges.
Mercado Bitcoin Freezes $11 Million After Hacker Drains Hot Wallets Across Multiple Chains
Mercado Bitcoin detected a security incident in the early hours of November 2, 2026, and quickly blocked approximately $11 million in assets to prevent further losses. The exchange confirmed that hot wallets connected to the internet were targeted, allowing unauthorized transactions to spread funds across 17 different networks. Chainalysis, Arkham, and several stablecoin issuers including Tether, Circle, and Paxos collaborated to freeze around $10 million, primarily in stablecoins. The company stated that no customer funds were lost and no data was leaked, though the exact method used by the attackers remains undisclosed. Different analytics firms reported varying totals, with estimates ranging from $38 million to $49 million in total movement. Mercado Bitcoin has committed to absorbing identified losses and restoring services only after full security is ensured.