Can Hardware Wallets Be Hacked? Lessons From Coldcard
For years, hardware wallets have been presented as one of the safest ways to hold Bitcoin.
Keep your private keys offline. Don’t leave large balances sitting on an exchange. Don’t type your seed phrase into a computer. Use dedicated hardware and keep your recovery words somewhere safe.
That is still generally good advice.
But the recent Coldcard security failure exposed an uncomfortable reality about Bitcoin self-custody: a wallet can be completely offline and still fail in a way that puts your Bitcoin at risk.
The problem wasn’t that someone remotely connected to thousands of Coldcards. It wasn’t a phishing campaign convincing users to hand over their recovery phrases. And Bitcoin itself wasn’t hacked.
The problem was much more fundamental: some Coldcard firmware generated wallet secrets using far less secure randomness than intended.
That matters to anyone holding Bitcoin, but it is especially relevant to a site like ours. We spend a lot of time talking about Bitcoin as a payment method because it can solve real problems for industries that don’t always fit comfortably inside traditional payment networks. But accepting Bitcoin is only half of the equation.
Receiving Bitcoin securely and storing Bitcoin securely are two different problems.
If you’re going to use Bitcoin as actual money - whether as a customer, merchant or business - understanding custody matters just as much as understanding why people use Bitcoin in the first place.
The Coldcard incident doesn’t mean hardware wallets are useless, and it doesn’t mean Bitcoin has been broken.
It does mean we need to be more realistic about what a hardware wallet can - and cannot - protect us from.
This article reflects information available as of August 11, 2026. Coinkite’s investigation is ongoing.
What Happened With Coldcard?
Coldcard is a Bitcoin-only hardware wallet made by Coinkite. It has built a reputation around security-focused features including air-gapped transaction signing, secure elements and keeping private keys isolated from an everyday computer.
On July 30, 2026, Coinkite published a security advisory concerning the way certain Coldcard firmware versions generated wallet seeds.
Independent researchers working with Block’s Bitcoin Engineering and Security teams traced the problem to a random-number-generation integration error.
Coldcard was supposed to use secure hardware-derived randomness when creating wallet secrets. Instead, Block found that a software component could fall back to a deterministic pseudo-random number generator.
The consequences differed between device generations.
On affected Mk2 and Mk3 firmware, Block found that no cryptographically secure entropy was being added through that path. On Mk4, Q and Mk5 devices, secure-element randomness was added, but the implementation limited how much of that randomness ultimately differentiated the generator’s output.
The technical details are complicated.
The practical problem is much simpler:
Some wallets were choosing their secrets from a dramatically smaller pool of possibilities than users expected.
That can turn a private key that should be effectively impossible to guess into one that an attacker may be able to search for offline.
Blockchain intelligence company TRM Labs reported on August 5 that roughly 1,816 BTC had been stolen from more than 5,200 addresses across four waves, worth approximately $116 million at the time of its assessment.
TRM cautioned that those figures were preliminary and said it was not attributing the theft to a specific actor.
Bitcoin Wasn’t Hacked
This distinction is probably the most important part of the story.
The Coldcard incident was not a vulnerability in Bitcoin’s underlying cryptography.
Bitcoin transactions continued working. The blockchain continued working. Properly generated private keys did not suddenly become easy to guess.
The failure happened at the wallet layer.
A useful way to understand Bitcoin security is to separate it into three layers.
1. The Bitcoin network
This includes the blockchain, Bitcoin’s consensus rules and the cryptography used to authorize transactions.
2. Your wallet
The wallet generates and protects the secret information needed to control your Bitcoin.
3. Your custody setup
This includes your backups, passphrases, devices, storage methods and your own security practices.
A failure at one layer doesn’t automatically mean the other layers have failed.
In this case, Bitcoin continued operating normally. The problem was that affected wallet software could create weaker secrets than intended.
That’s an important distinction whenever headlines claim that Bitcoin, a cold wallet or a hardware wallet has been “hacked.”
How Can an Offline Hardware Wallet Be Hacked?
The Coldcard incident challenges one of the biggest misconceptions surrounding cold storage:
Offline does not mean invulnerable.
Keeping private keys isolated from an internet-connected computer eliminates or reduces many potential attacks.
But being offline doesn’t make faulty software correct.
Imagine buying an incredibly strong physical safe.
It has thick steel walls, reinforced hinges and no electronic connection to anything outside your home.
But the manufacturer accidentally creates every combination using a much smaller set of numbers than intended.
An attacker doesn’t need to break through the steel.
They need to figure out the combination.
The same principle applies to cryptographic keys.
A hardware wallet can do an excellent job protecting a private key from malware while still failing if the private key itself wasn’t generated securely in the first place.
The Coldcard Problem Was Randomness
When you create a Bitcoin wallet, the wallet needs to generate a secret that nobody else could realistically predict.
That requires entropy, which in this context basically means unpredictability.
A properly generated wallet secret has such an enormous number of possible combinations that searching through all of them isn’t realistically achievable.
But cryptographic algorithms cannot magically create randomness that wasn’t there to begin with.
If a wallet starts with weak or predictable input and then hashes that input, the result might look random while still belonging to a much smaller set of possible secrets.
Block’s analysis found that affected Coldcard firmware could use MicroPython’s deterministic Yasmarang generator rather than the intended hardware RNG path.
On Mk2 and Mk3 devices running affected v4 firmware, Block found no cryptographically generated secret input was added through that path. On Mk4, Q and Mk5, secure-element entropy was incorporated, but only four bytes reached the reseeding function, limiting the securely differentiated output space to at most 2^32 possibilities once the other state was fixed.
You don’t need to understand the math to understand the lesson:
A secret is only as strong as the uncertainty that went into creating it.
Making the output look random isn’t enough.
Updating Firmware Doesn’t Fix an Already Weak Seed
This is one of the most important practical lessons from the incident.
Software vulnerabilities can normally be patched. Weakly generated secrets are different.
If your seed was created using vulnerable software, updating the hardware wallet afterward doesn’t somehow make that old seed more random.
Coinkite explicitly warns that installing corrected firmware does not repair an existing affected seed.
Think about the safe analogy again.
The manufacturer can fix the machine that generates combinations for all future safes. That doesn’t change the combination already assigned to yours.
The same applies here. Affected users need to follow current migration guidance rather than assuming a firmware update alone protects an existing wallet.
Which Coldcard Firmware Is Affected?
According to Coinkite’s current advisory, Mk2 and Mk3 seeds generated on firmware versions 4.0.1 through 4.1.9 are affected under the conditions described in its advisory.
Coinkite also says seeds generated on Mk4, Mk5 and Q devices before their respective fixed releases are affected, although it describes the impact on those newer devices as less severe than on Mk2 and Mk3.
The current fixed releases are:
- Mk2/Mk3: 4.2.0 or later
- Mk4/Mk5 Standard: 5.6.0 or later
- Q Standard: 1.5.0Q or later
- Mk4/Mk5 Edge: 6.6.0X or later
- Q Edge: 6.6.0QX or later
Standard and Edge are separate firmware tracks. Coinkite specifically warns Edge users not to assume that an older 6.x release is fixed simply because its version number appears higher than the Standard release.
There is also a small discrepancy worth noting: Block’s technical analysis traces the affected Mk2/Mk3 code path to firmware 4.0.0, while Coinkite’s customer-facing advisory specifies 4.0.1 through 4.1.9.
Anyone determining whether their own wallet is affected should rely on Coinkite’s latest security advisory rather than treating this article as device-specific recovery guidance.
Coinkite also says that users who supplied at least 50 fair, independent and private dice rolls while generating their seed have enough independently supplied entropy to avoid this particular RNG issue.
Can Hardware Wallets Really Be Trusted?
Yes, but not blindly.
A hardware wallet is still hardware and software built by humans. It can contain bugs, its firmware can have vulnerabilities, random-number generation can be implemented incorrectly, and the hardware itself can have weaknesses. Users can make mistakes too.
None of that makes hardware wallets pointless. The useful question isn’t whether a hardware wallet can ever fail, of course it can.
The better question is:
Which risks does a hardware wallet reduce, and which risks remain?
A major advantage of a hardware wallet is that it can isolate your private keys from your everyday computer or phone. That reduces exposure to threats such as malware stealing wallet files or private keys stored directly on an internet-connected machine. A properly designed device can also allow transaction details to be verified independently before a signature is created.
Those are real security benefits.
But a hardware wallet cannot automatically protect you from:
- Poorly generated wallet seeds
- Firmware or implementation bugs
- Exposed recovery backups
- Weak or reused passphrases
- Social engineering
- Incorrectly verified transactions
- Hardware vulnerabilities
- Supply-chain problems
- Losing your recovery information
- Human error
The Coldcard incident doesn’t erase the value of hardware wallets.
It shows why a hardware wallet should be viewed as one part of a security system rather than the entire security system.
“Not Your Keys, Not Your Coins” Is True But Incomplete
One of Bitcoin’s most famous sayings is:
Not your keys, not your coins.
The idea is simple.
If your Bitcoin is sitting with an exchange or another custodian, that company controls the private keys. If it freezes withdrawals, collapses or suffers a security breach, you may lose access to your money.
Self-custody removes that particular dependency.
But once you control the keys, you become responsible for custody.
There may be no fraud department capable of reversing a transaction. There may be no password reset if critical recovery information is lost. And there is no hardware device that removes every security responsibility from you.
Self-custody doesn’t eliminate risk.
It exchanges one category of risk for another.
Coldcard is an unusually dramatic example of why that distinction matters.
Why This Matters for Bitcoin Payments
A vulnerability in one hardware wallet does not make Bitcoin stop functioning as a payment network.
A merchant can still receive Bitcoin. A customer can still send Bitcoin. Transactions can still settle without being approved by a credit-card network.
None of those properties depend on Coldcard.
What this incident changes is the conversation about what happens after Bitcoin has been received.
That distinction is especially relevant in industries that have stronger reasons than most to look outside traditional payment networks.
Why the Adult Industry Should Pay Attention
For the adult industry, the Coldcard story matters for a specific reason.
Bitcoin is often discussed as a solution to payment problems: processor restrictions, chargebacks, account closures and customers who may be reluctant to put credit-card information into an adult website.
Those are real reasons that Bitcoin and other cryptocurrencies have gained traction in the industry, and they form part of the broader benefits and risks of using cryptocurrencies for online payments.
But accepting Bitcoin creates a second responsibility that doesn’t exist in quite the same way with a conventional merchant account:
The business has to decide how those funds are actually held.
A successful Bitcoin payment isn’t the end of the security story.
If revenue is moved from a payment wallet into long-term self-custody, the security of that custody setup effectively becomes part of the business’s payment infrastructure.
Where are received funds stored?
How much remains available for day-to-day use?
How much is moved into longer-term storage?
Who controls the wallets?
How are backups handled?
What happens if the wallet software or hardware later turns out to have a serious vulnerability?
These aren’t arguments against accepting Bitcoin. They are signs that cryptocurrency payments need to be treated as a complete operational system rather than simply another checkout button.
The same applies on the customer side. Someone can reasonably prefer Bitcoin because they don’t want to provide payment-card details to a website, while still needing to think separately about how their Bitcoin wallet is secured.
That is one reason the pros and cons of cryptocurrency payments in the adult industry go beyond transaction fees or convenience.
Removing a traditional payment processor from the chain doesn’t remove risk.
It changes where that risk sits.
Privacy and Security Are Not the Same Thing
The Coldcard incident also illustrates why several ideas that often get grouped together need to be separated.
Privacy is not the same thing as security. Self-custody is not the same thing as anonymity. Cold storage is not the same thing as invulnerability.
Bitcoin transactions are recorded on a public blockchain and can often be analyzed or connected with other information.
Likewise, holding your own Bitcoin gives you control of your keys, but it doesn’t guarantee those keys were generated or protected correctly.
Crypto has been surrounded by absolute claims for years:
Bitcoin is anonymous.
Cold wallets can’t be hacked.
Hardware wallets are unhackable.
Self-custody means you don’t have to trust anyone.
Reality is more nuanced.
Bitcoin changes which intermediaries and systems users have to trust.
It does not make trust, security engineering or good operational practices disappear.
A Note on the Wider Coldcard Controversy
The confirmed RNG vulnerability has become mixed together online with speculation about Coinkite, its employees and the company’s response.
One unusual detail is confirmed: on August 2, Coinkite said it had destroyed its remaining Coldcard inventory manufactured with the vulnerable firmware and halted shipments when the vulnerability was confirmed.
That has generated plenty of discussion, but it should be kept separate from what has actually been established about the RNG bug.
Block’s published analysis describes a specific software failure. TRM has said it is not currently attributing the theft to a particular actor.
Speculation about intent or responsibility is therefore not evidence of a second vulnerability or proof that anyone associated with Coinkite was involved in the theft.
For this article, the security failure itself is significant enough without adding claims that haven’t been established.
The Real Lesson From Coldcard
The biggest lesson from this incident isn’t that Coldcard is uniquely untrustworthy.
And it isn’t that another hardware-wallet brand must automatically be safer.
The lesson is that every form of self-custody has assumptions and failure modes.
Bitcoin lets users reduce their dependence on financial intermediaries. That doesn’t mean it makes sense to replace absolute trust in a bank or exchange with absolute trust in one small electronic device.
The more value being protected, the more important it becomes to understand the entire custody setup rather than treating one product as a magic security box.
Someone experimenting with a small amount of Bitcoin has different requirements from someone holding significant savings. A business regularly receiving Bitcoin has different requirements from someone making an occasional transaction.
There is no single custody setup that makes sense for everyone.
But one rule applies broadly:
Security should not depend on one assumption being perfect.
Frequently Asked Questions
Can hardware wallets be hacked?
Yes. Hardware wallets can contain vulnerabilities in their hardware, firmware or cryptographic implementations. They can substantially reduce some common key-theft risks, but they do not eliminate every possible attack.
Was Bitcoin hacked in the Coldcard attack?
No. The Coldcard incident involved the way affected wallet software generated secret information. Bitcoin’s underlying network and cryptography were not broken.
Does updating Coldcard firmware fix an affected seed?
No. Corrected firmware fixes seed generation going forward, but Coinkite says it does not retroactively repair a seed that was generated using affected firmware. Users potentially affected should follow Coinkite’s current migration guidance.
Can Bitcoin be stolen from a cold wallet?
Yes. Keeping keys offline protects against many remote attacks, but Bitcoin can still be at risk if private keys were generated insecurely, recovery information is exposed, wallet hardware or software contains vulnerabilities, or the owner authorizes a malicious transaction.
The Bottom Line
The Coldcard incident is one of the clearest examples we’ve seen of why offline and secure aren’t synonyms.
A wallet can be air-gapped. Its private keys can never touch your computer. The hardware can sit locked inside a safe.
None of those protections solve the problem if the secret controlling the wallet was insufficiently unpredictable from the beginning.
But this isn’t evidence that Bitcoin or self-custody has failed.
It’s evidence that self-custody is more complicated than buying a hardware wallet and assuming security has been solved.
That’s especially relevant in industries like adult entertainment, where Bitcoin can solve genuine payment problems that traditional processors sometimes create.
The ability to receive a payment without relying on a credit-card network remains useful.
But once Bitcoin is being used as actual money, custody becomes part of the payment problem too.
Bitcoin can reduce reliance on traditional financial intermediaries. It cannot remove the need for good security.
And as the Coldcard incident demonstrated, sometimes the most important question isn’t where your keys are stored.
It’s how those keys were created in the first place.