A second wave of thefts linked to Coldcard hardware wallets has been identified. Galaxy Research now tracks 1,158.81 BTC stolen from 2,673 addresses across the two attacks.

The first wave on July 30 drained over 1,082 BTC, while the second took an additional 76 BTC from a larger number of smaller wallets.

The losses stem from a firmware flaw that made certain seed phrases far more predictable than intended.

Coinkite has released emergency updates and urges affected users to move funds to newly generated seeds.

Users who created seeds on vulnerable firmware should follow the company's official security guidance immediately.

A new technical analysis suggests the Coldcard seed vulnerability may have started with a simple compiler fix in 2021. A developer reportedly set `MICROPY_HW_ENABLE_RNG` to 0 to resolve a build conflict between firmware layers. That change caused the device to fall back to MicroPython's weaker software random number generator instead of the hardware RNG. As a result, some wallets created after the change had far less entropy than intended.

The commit message left at the time was simply 'runs.'

The findings highlight how a small integration error can create serious security risks in hardware wallets.

The Coldcard bug explained in simple terms:

Normally, a hardware wallet generates your 12 word seed phrase using true randomness.

Think of it like a lottery with roughly 340 undecillion possible tickets (that's a 340 followed by 36 zeros). Every ticket has an equal chance of… pic.twitter.com/bZfm4s3sO7

— Quinten | 048.eth (@QuintenFrancois) July 31, 2026