What happened
A security vulnerability in the Coldcard cryptocurrency hardware wallet is being exploited to empty users’ funds. According to blockchain‑monitoring firms, the active attacks have already resulted in more than $130 million in losses.
“The total losses amount to more than $130 million, according to blockchain‑monitoring firms.” – TechCrunch, 4 August 2026
Coldcard, marketed as an “offline” hardware wallet, stores private keys on a physical device that is never supposed to touch the internet. The discovered flaw bypasses that isolation, allowing attackers to siphon crypto directly from the compromised wallets.
Why it matters
Trust in hardware wallets: Offline devices are a cornerstone of crypto security. A breach of this nature undermines confidence in a product class that many users rely on for protecting high‑value assets.
Financial stakes: $130 M is a sizable portion of the crypto market’s retail holdings, highlighting the real‑world impact of software bugs in security‑focused startups.
Startup reputation: Companies that build security‑critical hardware are often early‑stage ventures. A public exploit can affect funding, partnerships, and user acquisition for the whole niche.
Who is affected
Coldcard owners: Any user who keeps crypto on a Coldcard device is potentially exposed unless they have taken additional protective steps.
Broader crypto community: The incident serves as a cautionary signal for users of other hardware wallets, prompting re‑evaluation of asset storage strategies.
Investors and partners: Stakeholders in hardware‑wallet startups may reconsider risk assessments and due‑diligence processes.
What to watch next
Patch rollout: Expect an official security advisory from the Coldcard team outlining the vulnerability and a firmware update to remediate it.
User guidance: Look for recommendations on how affected users can recover or secure remaining assets, possibly including moving funds to a different wallet.
Regulatory attention: Authorities monitoring crypto‑related fraud may reference this breach in future guidance on hardware‑wallet security standards.
Industry response: Other hardware‑wallet providers are likely to audit their own products for similar weaknesses and may issue pre‑emptive updates.
Source: “Hackers steal over $130M by exploiting bug in offline hardware wallets,” TechCrunch, 4 August 2026.