Hackers Funnel Millions Through Crypto Mixers
The recent Coldcard hardware wallet exploit has sent shockwaves through the Bitcoin community, as attackers managed to siphon off at least $100 million in Bitcoin from more than 7,300 wallets.
These mixers are designed to break the on-chain link between source and destination addresses, making it difficult for investigators to trace funds. While most victim funds remain consolidated in a handful of attacker-controlled wallets, only limited attempts at mixing had been observed by Thursday, according to TRM Labs’ onchain tracing.
On Tuesday, 64 Bitcoin from address bc1q0 was sent to the Wasabi mixing protocol, according to CertiK.
On paper, blockchain transparency should make theft harder to hide; but in practice, sophisticated laundering tools like Wasabi and Tornado Cash complicate recovery efforts. Galaxy Digital has identified three confirmed attack waves so far and suspects a fourth could push total losses up to $130 million in BTC. The magnitude of this exploit places it as the third-largest cryptocurrency hack of 2026.
Firmware Flaw Leaves Wallets Exposed
At the heart of the Coldcard breach is a firmware bug dating back to March 2021 that undermined the randomness—or entropy—used during private key generation. This flaw reduced key strength from 128 bits down to just 40 bits for some devices, according to TRM Labs’ investigation. As a result, attackers were able to “guess” seed phrases with far less computational effort than should be possible with properly implemented cryptography.
Coinkite, the company behind Coldcard, disclosed the entropy-generation issue on July 31 and quickly issued firmware fixes while urging affected users to migrate their funds.
It’s important to note that this vulnerability did not compromise Bitcoin’s underlying cryptography itself; instead, it exploited a weakness in how certain Coldcard wallets generated their keys. Every hardware wallet relies on random data to create secure seed phrases—if that randomness is weak or predictable, even strong encryption becomes moot.
Red Team Uncovers Thousands of Flaws
In response to the Coldcard incident, a volunteer group known as the Bitcoin Red Team launched an intensive security audit across the ecosystem. Within just under 30 hours, their AI-assisted review flagged 4,962 potential vulnerabilities spanning 390 different open-source Bitcoin projects. Of these findings, 85 were classified as critical severity and another 635 as high severity—meaning roughly 14.5% of all issues identified could have significant security implications if left unaddressed.
The team consists of 16 volunteers—including AnchorWatch CEO Rob Hamilton and developer Calle—and uses both automated scans and manual review to evaluate codebases. Calle noted that on average, each person was identifying one critical exploit per hour during their review period. So far, only about 21% of findings have been dynamically reproduced with proof-of-concept code; meanwhile, fewer than 5% of affected projects have had upstream disclosures made public.
Multiple Attackers Target Same Vulnerability
Galaxy Digital’s research revealed that at least 15 different attackers exploited the same Coldcard vulnerability over several coordinated attack waves. This multi-pronged approach contributed to both the scale and complexity of the breach—making attribution and fund recovery even more challenging for investigators and affected users alike.
Despite rapid response efforts by Coinkite and third-party security teams, most stolen funds remain pooled in attacker-controlled addresses with minimal mixing attempts observed by Thursday’s report. It’s unclear whether this indicates hesitation among thieves or simply a waiting game as law enforcement and blockchain analysts close in.
The Coldcard saga has reignited debate over hardware wallet safety standards across the industry. While no evidence suggests that all hardware wallets are now insecure by default, this breach underscores how even established brands can be undermined by subtle bugs—especially those affecting key generation processes.
What may drive the next phase
If the suspected fourth wave of Coldcard-related attacks identified by Galaxy Digital materializes, bringing total losses to about $130 million in BTC, immediate attention will shift to further victim wallet liquidations and potential new mixing activity; however, confirmation of this fourth wave remains unclear as of the latest reports.
