# Coldcard firmware entropy flaw thefts (Trezor passphrase response): Coldcard firmware flaw reportedly let attackers drain $100M+ in BTC; Trezor raises passphrase cap to 128
Source page: https://vaultx.llc/hacks/trezor-coldcard-attacks-october-2026 · VaultX incident report by Sentinel · first published 2026-11-02, updated 2026-11-02
- Date: 2026-07-29
- Reported loss: $100M (Reported: 1,596 BTC (a bit over $100M) verified across ~7,300 addresses; one tracker reports 1,789.28 BTC (~$114.7M) across 8,865 wallets; other coverage cites ~$130M or more than $140M. None confirmed by the company in the research.)
- Attribution: unknown. The reporting describes a firmware flaw exploited by attackers, not a publicly identified person or group. One headline (Coinscipher) says '15 attackers join in', which suggests multiple actors but is not independently confirmed here.
- Chains: Bitcoin
- Status: developing
- Severity: 74/100
- Response score: 55/100 (Reported apology, shipment halt, inventory destruction and migration advice are positive, but no compensation or recovery is reported and the response drew criticism.)
According to multiple reports, a firmware flaw in Coldcard (Coinkite) devices caused some wallets to generate recovery phrases with insufficient randomness, so attackers could reconstruct them offline and sweep the funds. Reported losses start at about $100M (1,596 BTC) and rise to $130M+ in broader estimates, all in Bitcoin. On Nov. 2, 2026, Trezor extended its optional passphrase limit from 50 to 128 characters, citing the Coldcard attacks. Trezor was not attacked; the change is a hardening measure. Exact totals, attacker identities and fund flows remain unconfirmed.

**What happened**
According to the reports gathered, a firmware flaw in Coldcard hardware wallets weakened the randomness used when generating recovery phrases. Attackers who could exploit the weak entropy could reconstruct affected wallets and move the funds without physical access to the device.
One report (via The Frontier) says the theft wave began overnight on July 29, 2026, and that users were discussing losses by July 30. One report says verified losses reached 1,596 BTC (a bit over $100M) from roughly 7,300 addresses across three attack waves and 14 smaller incidents. Another tracker reports 1,789.28 BTC (about $114.7M) across 8,865 wallets. Later coverage cites $130M or more, and one headline cites more than $140M.
On Nov. 2, 2026, Trezor said it expanded its optional wallet passphrase limit from 50 to 128 characters in Trezor Suite with updated firmware, citing the Coldcard attacks. Trezor noted that older firmware still caps passphrases at 50 characters. One report says Trezor's blog labeled the post 'October 2026', but the indexed date is Nov. 2, so the timing is inconsistent across coverage.

**How it worked**
According to the reports, the root cause was a firmware bug that reduced randomness in recovery phrase generation. Because the seed space was effectively smaller, attackers could reportedly identify vulnerable wallets and reconstruct their keys offline, then sweep funds on the Bitcoin blockchain. Reports describe a campaign against older wallet addresses at scale (three confirmed waves plus 14 smaller incidents) rather than a single theft.
Trezor's explanation for its change is that a passphrase works as an extra secret on top of the recovery phrase. Even if the recovery phrase is compromised, the correct passphrase is still required to access the wallet. Trezor said strong, unique passphrases could protect some users in this situation.

**Where the money went**
The research does not identify the laundering path. One report mentions 'mapped sweeps' across roughly 7,300 victim addresses. No mixers, bridges or exchanges are named in the sources, and no frozen or recovered funds are reported. Attacker receiving addresses were not published in the material gathered.

**The response**
According to one report, Coinkite's CEO apologized for the firmware bug, destroyed remaining vulnerable inventory and halted all product shipments. Coverage says users were told to move funds to a new wallet with a new recovery phrase. Trezor, which was not attacked, raised its passphrase limit to 128 characters as a hardening step. The research shows no announced compensation, insurance fund, regulator action or police announcement. Reports describe criticism of the response, but no direct user quotes were available.

**Impact**
Reported losses are $100M to $130M+ in BTC across thousands of wallets, which is a serious blow to confidence in hardware wallets. The research contains no reliable data on price reactions for any company or token. Users with vulnerable seeds that have not been migrated remain at risk.

**Timeline**
- 2026-07-29 Theft wave reportedly begins overnight, according to a report citing The Frontier.
- 2026-07-30 Users are reportedly discussing losses publicly.
- 2026-10-24 The Frontier publishes an article on Coldcard flaw-linked thefts and the criticism of the response.
- 2026-11-02 Trezor announces its passphrase limit is raised from 50 to 128 characters, citing the Coldcard attacks.

**How to protect yourself**
- If you used a Coldcard device affected by the flaw, move funds to a new wallet with a newly generated recovery phrase, as advised in coverage.
- Use a strong, unique passphrase. It can protect funds even if the recovery phrase is compromised, but it must be backed up safely, because losing it means losing access.
- Update firmware and Trezor Suite to use passphrases up to 128 characters. Older Trezor firmware still caps them at 50.
- Builders should audit entropy generation and test random number sources independently, since a weak seed can be exploited offline and at scale.
- Do not treat a hardware wallet as safe on the strength of the brand alone.

**Still unknown**
- The exact total stolen ($100M, $114.7M, $130M+ or $140M+) and how much was confirmed.
- The identity of the attackers, and whether there was one group or several.
- Attacker addresses, laundering routes, and any frozen or recovered funds.
- Which devices and firmware versions were affected, and how many users remain exposed.
- Whether Coinkite will compensate victims, and whether any regulator or law enforcement action exists.
- The exact start date of the thefts, which comes from a single report.

**Sources**
- Cointelegraph: Trezor raises wallet passphrase limit to 128 characters https://cointelegraph.com/news/trezor-wallet-passphrase-limit-128-characters-coldcard-attacks
- LCX: Trezor lifts password ceiling after Coldcard's $100M wallet thefts https://lcx.com/en/cryptonews/trezor-lifts-password-ceiling-after-coldcards-100m-wallet-thefts
- TradingView/Cointelegraph: Trezor lifts password ceiling https://www.tradingview.com/news/cointelegraph:80c62c06d094b:0-trezor-lifts-password-ceiling-after-coldcard-s-100m-wallet-thefts/
- Tokenpost: Coldcard coverage https://tokenpost.com/news/technology/29822
- The Frontier: Coldcard flaw-linked thefts, response draws criticism https://thefrontier.fm/article/2026/10/24/coldcard-flaw-linked-thefts-response-draws
- Bitquery: Coldcard hack https://bitquery.io/coldcard-hack/
- Coinscipher: Coldcard hack losses hit $130M as 15 attackers join in https://coinscipher.com/crypto-news/coldcard-hack-losses-hit-130m-as-15-attackers-join-in/
- Ground News: Hackers drain more than $140M in Bitcoin from devices made by Canadian firm https://ground.news/article/hackers-drain-more-than-140m-in-bitcoin-from-devices-made-by-canadian-firm
- Coin360: Coldcard exploit https://coin360.com/news/coldcard-exploit-phishing-bitcoin-wallets
- CBC: Bitcoin Coinkite security hack https://www.cbc.ca/news/world/bitcoin-coinkite-security-hack-9.7295582
- Trezor: What is a passphrase https://trezor.io/guides/backups-recovery/advanced-wallets/what-is-a-passphrase
- Traders Union: Trezor wallet passphrase security update https://tradersunion.com/news/cryptocurrency-news/show/4059008-trezor-wallet-passphrase-security-update/
- Galaxy Research: Coldcard exploit abates as total losses climb to at least 1,700 BTC https://www.galaxy.com/insights/research/coldcard-exploit-abates-as-total-losses-climb-to-at-least-1700-btc
- BeInCrypto: Coldcard Bitcoin theft $115 million, Galaxy https://beincrypto.com/coldcard-bitcoin-theft-115-million-galaxy/
- CoinGabbar: Coldcard thefts and hardware wallet security risks https://www.coingabbar.com/en/coldcard-thefts-hardware-wallet-security-risks
- CoinDesk: Coldcard hacker moves 45% of Bitcoin Stolen in Third Attack Wave https://www.coindesk.com/business/2026/09/07/coldcard-hacker-moves-45-of-bitcoin-stolen-in-third-attack-wave
- FinanceFeeds: Coldcard exploiter moves 97 BTC through THORChain and CoinJoin https://financefeeds.com/coldcard-exploiter-moves-97-btc-through-thorchain-and-coinjoin-transactions/
- Crypto.news: Coldcard hackers leave 87% of stolen Bitcoin unmoved https://crypto.news/coldcard-hackers-leave-87-of-stolen-bitcoin-unmoved-after-114m-theft/?referrer=www.coinrithm.com/en/cryptocurrencies/bitcoin
- Trezor Suite update: passphrases now go up to 128 characters https://trezor.io/blog/news/trezor-suite-update-october-2026-passphrases-now-go-up-to-128-characters
- Crypto.news: Trezor expands passphrase limit after Coldcard thefts https://crypto.news/trezor-passphrase-limit-128-characters-coldcard-thefts/

---
VaultX: free crypto news and intelligence, https://vaultx.llc