Coldcard Breach Losses Top $115 Million, Research Firm Says

“This is one of the largest hardware-wallet failures in Bitcoin’s history, and coverage broadly describes it as one of the largest single crypto thefts of 2026,” Twenty-One Million said.

Twenty-One Million noted that weak randomness has affected bitcoin wallets before. The 2023 Milk Sad bug and the 2022 Wintermute hack both involved predictable randomness that looked identical to real randomness until someone checked, the company said. Open-source, auditable hardware eventually exposes such bugs because they sit in public code, Twenty-One Million said. The same trait means open source catches problems eventually, not instantly, and does not replace extra protections such as passphrases or multisig, the company added.

PYMNTS wrote earlier this month that the Coldcard failure undercuts the idea that offline storage ends the security discussion. “A device disconnected from the internet can still generate a vulnerable key,” the report said. Open-source software can still hide a flaw, the report said, and assets can vanish without the device ever leaving a safe.

Institutional custodians face a narrower lesson from the breach, PYMNTS argued. The critical security questions sit outside the blockchain, in the hardware and software and in the governance and operational controls that determine who can produce a valid signature.

Losses from crypto-related thefts reached about $972 million in the first seven months of 2026, according to a recent CoinDesk report. The Coldcard case is among them.