The Coldcard Entropy Flaw — All You Need to Know

Hardware wallets are considered the gold standard of cryptocurrency security. The promise is simple, keep your keys on a device that never touches the internet and you are safe. But have you ever thought about what happens when the keys themselves are born weak?

If the answer is YES, it’s great you are a real researcher.

If the answer is NO, let us explore this article.

On July 30, 2026, attackers started draining Bitcoin from thousands of addresses belonging to Coldcard hardware wallet users. In the first wave alone, about $70.2 million (1,082.65 BTC) was swept from 1,196 addresses in roughly 41 minutes, according to Galaxy Research’s mapping of the sweep. By early August, TRM Labs reported the totals at around $116 million, roughly 1,816 BTC across 5,200+ addresses in four waves, and called it the largest hardware wallet exploit of 2026 and the third-largest crypto attack of the year. Some estimates (Galaxy Research, with Elliptic calling the number roughly correct, via TechCrunch) put the figure above $130 million, and the numbers were still climbing when the reports were published.

The most shocking part is this. The victims did not click a phishing link. They did not install malware. Their devices were never stolen or touched. One victim, Jonathan Goodman, who lost around $1.6…