Incident All ledgers
COLDCARD: $116.0m
COLDCARD lost $116.0m on 31 July 2026. Ranked 38th of 1,272 crypto failures, with method, returned funds and comparable incidents.
- Date
- 31 July 2026
- Lost
- $116.0m
- Returned or repaid
- None recorded
- Target
- Wallet
- Category
- Key Compromise
- Method
- Weak Key Generation
- Chains
- Bitcoin
Beginning 30 July 2026, attackers stole about $116 million in BTC over four waves from thousands of addresses whose seeds came from Coldcard wallets on firmware 4.0.0+, where a bug skipped the hardware RNG and weakened keys enough to brute-force offline.
Against the ledger
- It ranks 38th of the 1,272 incidents with a known loss, and 7th in 2026.
- It accounts for 45.5% of the $254.7m in known losses in July 2026.
- 153 incidents in the ledger are classified as Key Compromise, for $8.96bn in total. This one is 1.3% of that.
- The ledger records no returned funds.
Closest in size by the same method
| Date | Target | Lost | Type | Method | Returned |
|---|---|---|---|---|---|
| 13 Dec 2021 | Vulcan Forged | $140.0m | DeFi Protocol | Hot Wallet Key Compromised | — |
| 30 Oct 2021 | BXH | $139.0m | DeFi Protocol | Private Key Compromised | — |
| 07 Jul 2023 | Multichain | $126.0m | DeFi Protocol | Validator Key Compromised | — |
| 23 Jun 2022 | Harmony Bridge | $100.0m | DeFi Protocol | Validator Key Compromised | — |
| 19 Aug 2021 | Liquid Global | $91.3m | CEX | Hot Wallet Key Compromised | — |
All failures in 2026 · The failures ledger
Amounts are DefiLlama’s estimates and can change as incidents are revalued. Its returned figure can include money a company repaid itself, not only funds recovered from attackers. Source: DefiLlama.
Cite this Bitminer.io, “COLDCARD, failures ledger”, data to 2 November 2026, https://bitminer.io/ledger/incident/coldcard-2026-07-31/. How this is built