$86M in Bitcoin Lost to Coldcard’s Silent PRNG Flaw Over Five Years

The latest Bitcoin hack happened when a pseudo-random number generator (PRNG) vulnerability embedded in Coldcard hardware wallet firmware since March 2021 has resulted in the confirmed loss of 1,367 BTC, roughly $86M, across 4,585 addresses, according to on-chain mapping published by Galaxy Research as of August 2, 2026. The incident is the worst hardware wallet hack in Bitcoin history by confirmed losses, and it required no phishing, no physical device access, and no user error. This is not simply a Coldcard product failure. 🚨 A 3rd wave in what we suspect are hacks of Coldcard-generated addresses has been identified in which 207.7294 BTC has been drained. Our estimated observed size of the Coldcard hack is now 1,367.05 BTC (~$88.6m) across 4,585 addresses. More updates in the thread below 👇 https://t.co/hPtXh9444D pic.twitter.com/g6xA4OOi2f — Galaxy Research (@glxyresearch) August 1, 2026 It is a structural demonstration that the security guarantee of any self-custody arrangement, hardware or software, rests entirely on the entropy quality of its seed generation, and that a single misconfigured preprocessor macro can silently collapse that guarantee for years without triggering a...