Coldcard Bitcoin Hardware Wallet Hack Causes Devastating $111M Theft

The Coldcard hack has drained at least $111 million in Bitcoin from affected users, making it the third-largest cryptocurrency breach of 2026 by confirmed losses.

Galaxy Research put the figure in a preliminary estimate published on August 8, adding that total theft could exceed $130 million once all affected wallets are tallied. The breach has shaken confidence in hardware wallets, devices long regarded as the gold standard for protecting Bitcoin holdings outside of exchanges.

Key Takeaways

• Galaxy Research published a preliminary estimate on August 8 placing confirmed losses from the breach at $111 million
• The REKT database counted 276 cryptocurrency hacking incidents in 2026 through August 8, totaling roughly $1.2 billion in combined losses
• Coinkite, a Canadian firm, has sold Bitcoin signing hardware since 2018
• The attack does not require physical access to the device, only connection to a compromised or malicious signing interface

How The Coldcard Hack Exposed A Trusted Device

Coldcard wallets are physical devices built by Coinkite, a Canadian firm that has sold signing hardware to Bitcoin holders since 2018.

Unlike software wallets stored on internet-connected computers, hardware wallets keep private keys on a dedicated chip that never touches an online network. The core promise is simple: even if a user’s computer is fully compromised by malware, the private key stays locked inside the device and cannot be extracted remotely.

The Coldcard hack appears to have subverted that promise.

While Coinkite has not published a full post-mortem as of August 8, on-chain data and security community reporting indicate the exploit targeted the signing flow rather than the chip itself. Attackers manipulated what the device was asked to sign, tricking firmware into authorizing transactions that drained wallets without the owner’s knowledge.

The attack does not require physical access to the device, it requires only that the user connect the hardware wallet to a compromised or malicious signing interface, such as a fake wallet application or a browser extension that intercepts the transaction before it reaches the device.

The user confirms what looks like a routine operation. The device signs what is actually a transfer to an attacker-controlled address, with the true destination obscured in the transaction format presented to the Coldcard firmware.

The Scale That Makes This Breach Historic

Galaxy Research’s (BTC) $111 million confirmed figure already places the Coldcard hack among the most damaging hardware-level exploits in cryptocurrency history.

The REKT database, which tracks on-chain losses across all incident types, counted 276 cryptocurrency hacking incidents in 2026 through August 8, totaling roughly $1.2 billion in combined losses.

The Coldcard breach alone accounts for approximately 9% of that annual figure.

That comparison matters for two reasons.

First, the vast majority of large cryptocurrency exploits target decentralized finance protocols, bridges, or centralized exchange hot wallets. A hardware wallet breach of this magnitude is rare.

Second, the victim profile differs sharply from typical DeFi exploits.

Hardware wallet users skew toward long-term holders who keep large, consolidated positions precisely because they believe the device is secure.

The losses per victim in the Coldcard hack are likely far higher than in protocol exploits, where the damage is spread across liquidity pools.

Galaxy Research’s upper estimate of $130 million reflects wallets that have not yet moved funds and may still be at risk.

The gap between the confirmed figure and the ceiling suggests investigators are still mapping the full scope of affected addresses.

From Cold Storage Promise To Warm Attack Surface

The Coldcard hack lands at a moment when the self-custody movement has been gaining mainstream momentum. Bitcoin ETF inflows through 2025 and into 2026 pushed more retail investors into the asset class, and financial advisers increasingly recommended hardware wallets as the safest way to hold Bitcoin outside of custodied products.

Coinkite’s Coldcard line was a frequent recommendation in that category, positioned as the most security-focused option on the market due to its air-gap capabilities and open-source firmware.

The breach changes that calculus. If the exploit targeted the signing interface rather than the device’s internal chip, the vulnerability exists at the intersection of hardware and software, a gap that no amount of chip-level security can close alone.

That is a structural problem for the entire hardware wallet category, not just Coldcard. Every major hardware wallet that supports third-party signing interfaces faces a version of the same exposure.

Also Read: Browser Agent With $700M Backing Poised to Dominate Web Automation

What Victims Face And What Comes Next

Bitcoin transactions are irreversible.

Unlike a credit card fraud case or a bank transfer recall, there is no authority that can claw back funds once they have moved on-chain. Victims of the Coldcard hack face permanent loss unless they can identify attackers and pursue civil or criminal remedies, a process that historically recovers a small fraction of stolen funds.

Coinkite’s response will be closely watched.

If the exploit required a firmware interaction, a patch may mitigate future risk but does nothing for wallets already drained. If the attack vector involves malicious signing software rather than device firmware, Coinkite may argue the vulnerability lies outside its control, a position that will likely face pushback from the affected community.

Security researchers at Black Hat, the annual cybersecurity conference running this week in Las Vegas, had already flagged the growing exposure of AI-assisted hacks against cryptocurrency infrastructure.

The Coldcard breach adds a concrete, large-scale example to that warning. Regulators in the United States have not historically treated hardware wallet vendors as financial institutions subject to security standards.

That may change as loss figures from incidents like this one accumulate.

Read Next: Galaxy Sharplink Onchain Yield Fund Opens with $125M, the Real Test Comes Next