Key facts
- Thousands of Coldcard hardware wallets were drained of bitcoin due to a firmware flaw.
- Approximately 1,600 BTC, worth over $100 million, was stolen.
- Swan Bitcoin CEO Cory Klippsten stated users are upgrading self-custody, not abandoning it.
- Affected users are migrating to collaborative multisig solutions like Swan Vault.
- Coinkite has patched all affected devices.
Thousands of Coldcard hardware wallets were compromised in a series of attacks that began on July 31, 2026, leading to the theft of approximately 1,600 BTC, valued at over $100 million. The exploit targeted a firmware flaw present since a March 2021 update, which had remained undetected for five years. Attackers swept funds from around 7,300 addresses across three waves of attacks.
Swan Bitcoin CEO Cory Klippsten described the event as a "brutal weekend" for many bitcoin holders. In response, Swan paused withdrawals for at-risk clients, issued in-app warnings, and extended migration support beyond its own customer base, assisting anyone needing help to secure their funds. Klippsten noted that his team worked through the night to help affected individuals.
Toronto-based Coinkite, the maker of Coldcard, has since patched all affected device lines. A volunteer team funded by OpenSats scanned over 150 open-source repositories and found no evidence that the vulnerability extended beyond Coldcard wallets. While nearly 90% of the stolen coins remain unmoved on-chain, confirmed attacker addresses have been shared with U.S. federal law enforcement.
The exploit has prompted some in the industry to question the viability of self-custody, with suggestions that investors consider alternatives like exchange-traded funds. However, Klippsten asserted that users are not abandoning self-custody but are instead seeking to enhance it. Many are migrating to collaborative multisig products, such as Swan Vault, where no single compromised device can put funds at risk.
Klippsten expressed measured optimism about the incident's long-term impact, suggesting that while it was devastating for those who lost coins, Bitcoin's antifragile nature and improving tools could ultimately strengthen the practice of self-custody.