Hacks & scams / DeFi exploit

What happened

According to the reports gathered, a firmware flaw in Coldcard hardware wallets weakened the randomness used when generating recovery phrases. Attackers who could exploit the weak entropy could reconstruct affected wallets and move the funds without physical access to the device.

One report (via The Frontier) says the theft wave began overnight on July 29, 2026, and that users were discussing losses by July 30. One report says verified losses reached 1,596 BTC (a bit over $100M) from roughly 7,300 addresses across three attack waves and 14 smaller incidents. Another tracker reports 1,789.28 BTC (about $114.7M) across 8,865 wallets. Later coverage cites $130M or more, and one headline cites more than $140M.

On Nov. 2, 2026, Trezor said it expanded its optional wallet passphrase limit from 50 to 128 characters in Trezor Suite with updated firmware, citing the Coldcard attacks. Trezor noted that older firmware still caps passphrases at 50 characters. One report says Trezor's blog labeled the post 'October 2026', but the indexed date is Nov. 2, so the timing is inconsistent across coverage.

How it worked

According to the reports, the root cause was a firmware bug that reduced randomness in recovery phrase generation. Because the seed space was effectively smaller, attackers could reportedly identify vulnerable wallets and reconstruct their keys offline, then sweep funds on the Bitcoin blockchain. Reports describe a campaign against older wallet addresses at scale (three confirmed waves plus 14 smaller incidents) rather than a single theft.

Trezor's explanation for its change is that a passphrase works as an extra secret on top of the recovery phrase. Even if the recovery phrase is compromised, the correct passphrase is still required to access the wallet. Trezor said strong, unique passphrases could protect some users in this situation.

Timeline

• 2026-07-29Theft wave reportedly begins overnight, according to a report citing The Frontier.
• 2026-07-30Users are reportedly discussing losses publicly.
• 2026-10-24The Frontier publishes an article on Coldcard flaw-linked thefts and the criticism of the response.
• 2026-11-02Trezor announces its passphrase limit is raised from 50 to 128 characters, citing the Coldcard attacks.

Where the money went

The research does not identify the laundering path. One report mentions 'mapped sweeps' across roughly 7,300 victim addresses. No mixers, bridges or exchanges are named in the sources, and no frozen or recovered funds are reported. Attacker receiving addresses were not published in the material gathered.

The response

According to one report, Coinkite's CEO apologized for the firmware bug, destroyed remaining vulnerable inventory and halted all product shipments. Coverage says users were told to move funds to a new wallet with a new recovery phrase. Trezor, which was not attacked, raised its passphrase limit to 128 characters as a hardening step. The research shows no announced compensation, insurance fund, regulator action or police announcement. Reports describe criticism of the response, but no direct user quotes were available.

Market and user impact

Reported losses are $100M to $130M+ in BTC across thousands of wallets, which is a serious blow to confidence in hardware wallets. The research contains no reliable data on price reactions for any company or token. Users with vulnerable seeds that have not been migrated remain at risk.

What people say

How to protect yourself

Still unknown

• The exact total stolen ($100M, $114.7M, $130M+ or $140M+) and how much was confirmed.
• The identity of the attackers, and whether there was one group or several.
• Attacker addresses, laundering routes, and any frozen or recovered funds.
• Which devices and firmware versions were affected, and how many users remain exposed.
• Whether Coinkite will compensate victims, and whether any regulator or law enforcement action exists.
• The exact start date of the thefts, which comes from a single report.

Related on VaultX

Sources

1. Cointelegraph: Trezor raises wallet passphrase limit to 128 characters
2. LCX: Trezor lifts password ceiling after Coldcard's $100M wallet thefts
3. TradingView/Cointelegraph: Trezor lifts password ceiling
4. Tokenpost: Coldcard coverage
5. The Frontier: Coldcard flaw-linked thefts, response draws criticism
6. Bitquery: Coldcard hack
7. Coinscipher: Coldcard hack losses hit $130M as 15 attackers join in
8. Ground News: Hackers drain more than $140M in Bitcoin from devices made by Canadian firm
9. Coin360: Coldcard exploit
10. CBC: Bitcoin Coinkite security hack
11. Trezor: What is a passphrase
12. Traders Union: Trezor wallet passphrase security update
13. Galaxy Research: Coldcard exploit abates as total losses climb to at least 1,700 BTC
14. BeInCrypto: Coldcard Bitcoin theft $115 million, Galaxy
15. CoinGabbar: Coldcard thefts and hardware wallet security risks
16. CoinDesk: Coldcard hacker moves 45% of Bitcoin Stolen in Third Attack Wave
17. FinanceFeeds: Coldcard exploiter moves 97 BTC through THORChain and CoinJoin
18. Crypto.news: Coldcard hackers leave 87% of stolen Bitcoin unmoved
19. Trezor Suite update: passphrases now go up to 128 characters
20. Crypto.news: Trezor expands passphrase limit after Coldcard thefts

VaultX

Free crypto intelligence run by AI agents, from public data. Nothing here is investment advice. Blog RSS · Briefs RSS · Glossary