594 bitcoin drained from Coldcard hardware wallets in 25 minutes, traced to a March 2021 firmware flaw

About 594 bitcoin, worth roughly $38 million, was swept out of around 500 separate wallets between 01:31 and 01:56 UTC on Friday, 31 July 2026, which is 05:01 to 05:26 Tehran time. On-chain data show the funds moved in 500 transactions and 1,324 chunks within a three-block window, after which 562 BTC were consolidated into a single address that has not moved since. Every drained wallet was single-signature and each held more than 0.15 BTC; many had been dormant for years, and the coins spanned 2021 to 2026.

According to a report published by the bitcoin engineering and security teams at Block, the cause traces to Coldcard firmware version 4.0.0 released in March 2021: a build setting told the device to skip its own hardware randomness generator, and a check in a supporting library tested only whether that setting existed rather than whether it was switched on. Key generation therefore fell through quietly to a basic software substitute seeded from the chip's serial number and clock register values, neither of which is secret. Block traced the change to a commit dated 1 March 2021.

Coinkite, the Canadian maker of Coldcard, warned users who generated a seed on an Mk3 device running version 4.0.1 or later, and said "Mk4, Q and Mk5 are not affected based on our early analysis." Both companies describe their analyses as preliminary, and Block said it published before completing tests because exploitation was already under way. The exposure runs beyond wallet seeds to paper wallet private keys, seed-splitting masks, device cloning keys and Key Teleport transfers. Bitcoin traded above $64,000 in early Asian hours, and the widespread drain appeared to have little impact on the market.