The same week the $282 million social-engineering loss surfaced, a separate vulnerability in Coldcard hardware wallets demonstrated that code risk can be just as fatal. A firmware bug introduced in March 2021 caused devices to fall back from a hardware random-number generator to a software-based one seeded with predictable chip data such as serial numbers and clock values. The effective entropy of seed phrases dropped from the intended 128 bits to roughly 40 bits on Mk3 models and 72 bits on Mk4, Mk5, and Q models — ranges small enough to be brute-forced with commercially available computing power.
Between 01:10 and 01:51 UTC on July 30, 2026, attackers drained 1,196 addresses of 1,082.65 bitcoin, worth approximately $70.2 million at the time, in a fully automated sweep. Coinkite, the manufacturer, acknowledged the flaw and released emergency firmware updates across the affected product lines.
Data from the first half of 2026 shows that compromised keys and signers accounted for more than $444 million of the roughly $972 million stolen across about 207 hacks — roughly 46% of total losses. North Korea-linked groups were tied to approximately $643 million of that total. The frequency of incidents has also accelerated: 158 separate hacks were recorded in the first seven months of 2026, already exceeding the 97 incidents logged in all of 2025, even as the average haul shrank from $26.3 million to $6.8 million. Private-key compromise ranked as the top vector by frequency.