Coldcard: $116 million in Bitcoin stolen despite cold storage

Coldcard cold wallets emptied: $116 million in Bitcoin gone

A cold wallet is supposed to be untouchable. That myth has just been shattered: since Thursday, hackers have drained more than $116 million in Bitcoin in four waves of attacks against Coldcard hardware wallets, according to Galaxy Research's on-chain analysis. The device that promised "hyper-secure" storage has seen 5,200 individual addresses wiped out. And the date, August 3, 2026, will go down as the day the last line of defense stopped being one.

The weak point isn't the chip, it's the "recovery" process

The technical explanation points to an uncomfortable contradiction: a wallet's security is defined not by cryptography but by the "recovery" procedure. If someone manages to replicate that recovery, the wallet is emptied even if the device is sitting in a drawer. This is the hypothesis circulating as the main attack vector: there's no need to touch the hardware, the seed phrase is enough.

Bitcoin, or its intermediaries?

At its core, the debate separates the protocol from its custodians. The problem is almost never Bitcoin itself, but trusting your money to whoever claimed to be "safer." Every multi-million-dollar theft revives the same suspicion: with no entity to claim from, no insurance, no guarantee, the investor is left alone facing the hole. Crypto skeptics find it easy to point out that the risk remains exactly where nobody wanted to see it.

If a cold wallet can be emptied without physical contact, what does that leave for the rest of the ecosystem? Nobody has answered that yet.