Bitcoin hardware wallet hacks force a rethink of self-custody

Hardware wallets were supposed to be the safe answer to crypto’s oldest warning: not your keys, not your coins. In 2026, that answer developed some uncomfortable footnotes. A Forbes analysis frames the year’s Bitcoin hack losses at more than $500 million. Axis Intelligence estimates total hardware wallet losses for the year exceeded $240 million, with the research placing the figure at approximately $241 million when the major incidents and other reported attacks are combined. Two breaches, two very different failures The first incident hit Coinkite’s Coldcard devices. A flaw in Coldcard firmware weakened the randomness used to generate seed phrases. The affected firmware dated back to builds from March 2021 onward. In late July and early August 2026, attackers drained an estimated 1,800+ BTC from thousands of wallets, with the haul valued at somewhere between $100 million and $150 million. The attackers did not need to touch the devices. The weakness lived in how the keys were born, not in how they were stored. Owners could have kept their Coldcards in a safe, and the coins would still have been exposed. According to Galaxy Research, funds from the Coldcard breach remained largely...