On July 30, 2026, an attacker began systematically draining Bitcoin from Coldcard hardware wallets by exploiting an entropy generation bug present since March 2021. The first wave alone stole 1,082.65 BTC, with total estimated losses exceeding 2,000 BTC, worth approximately $118 million, from over 5,000 addresses. Block’s investigation suggests law enforcement may already know the attacker’s identity after tracing on-chain activity to a paid account at a blockchain data provider, whose internal logs matched the theft pattern with extraordinary specificity. The stolen funds from the first wave remain untouched in the attacker’s address, leaving hope for potential restitution to victims. The bug originated from a cryptographic library replacement made by Doc-Hex, Coinkite’s Chief Technical Officer, switching the hardware random number generator to a low-entropy software pseudo-random number generator.
Source: Read the original article
