Coldcard hardware wallets hit by a $70 million exploit as the maker issues emergency updates

A firmware vulnerability in Coldcard hardware wallets led to the theft of more than $70 million in crypto assets. The incident was reported on Saturday 1 August 2026.

Coinkite, the maker of Coldcard, confirmed the bug, apologised for it and released emergency updates. The company warned that updating the firmware alone is not enough, and that users who created their wallet with an affected version must generate new recovery keys and move their assets to fresh addresses.

Changpeng Zhao, founder of the Binance exchange, wrote on the social network X: "Even hardware wallets can have bugs. Even old wallets with a long track record can be vulnerable. What is the solution? Perhaps splitting assets across several wallets. That carries different risks, because nothing is 100 percent." The incident has reopened debate over the limits of self custody and key management in the crypto market.