August 3, 2026 | NCFA Insight | Cybersecurity And Fraud, Digital Assets Blockchain And Tokenization, Risk Compliance And Regtech
Coldcard Firmware Flaw And Bitcoin Self Custody
On July 30, 2026, security researchers linked a rapid series of Bitcoin transfers to a reported Coldcard firmware flaw. Coldcard is a Bitcoin hardware wallet made by Toronto based Coinkite. Current reporting citing Galaxy Research estimates that more than 1,000 bitcoin left 1,196 wallets in 41 minutes, followed by two suspected waves that brought the estimated loss close to US$89 million. Researchers haven't confirmed that every wallet in those totals was created with the affected software.The Bitcoin network was not hacked. The reported failure occurred when certain Coldcard software generated wallet recovery phrases with too little randomness. If an attacker can narrow the possible phrases far enough, the private keys protecting the bitcoin may be calculated without stealing or touching the device.
It exposes a dependency that is easy to miss in self custody. Removing an exchange or custodian leaves the owner in control, but the owner still relies on the device, its firmware, the code that creates the recovery phrase and the process used to install updates.
The Failure Began When The Wallet Created Its Seed
A hardware wallet protects the private keys used to authorize Bitcoin transactions. The published Coldcard security model combines firmware controls with secure elements and offline signing. When a new wallet is created, the device generates a recovery phrase, often called a seed. That phrase can recreate the wallet and control its funds, so it needs enough randomness to keep attackers from guessing it.
The reported Coldcard flaw weakened that first step. A recovery phrase can look random to its owner while still coming from a much smaller set of possibilities than intended. An attacker doesn't need to defeat the device's secure elements or intercept a transaction if the phrase created at setup can be predicted.
That makes this incident different from phishing, a stolen backup or malware replacing a payment address. The weakness was reportedly built into the credential at creation. Keeping the device offline couldn't correct a weak phrase already produced by its firmware.
The scale remains under review. Current incident reporting says Coinkite confirmed a firmware bug, issued updated software and advised affected users to create a new recovery phrase. Coinkite hasn't yet published the complete technical account needed to confirm the full scope, every affected version or final losses.
An Update Cannot Repair An Exposed Recovery Phrase
Updated Coldcard firmware can correct how a device creates new recovery phrases, but it can't make an existing phrase more random. Moving the same phrase to another device also carries the weakness into the new wallet.
Users whose recovery phrases were created with affected software reportedly need to install the corrected firmware, generate a completely new phrase and transfer their bitcoin to addresses controlled by the new keys. Anyone uncertain about the device, firmware or setup method used for an existing phrase needs clear instructions from Coinkite before deciding what to do.
This is where incident response becomes part of the product. Customers need a precise affected version list, a safe migration process, a way to verify authentic firmware and an explanation of which setup methods changed the risk. Public reporting says recovery phrases created with at least 50 private dice rolls are not affected by this specific weakness alone. That exception still needs to be read against Coinkite's final technical disclosure.
The company also has to communicate without helping an active attacker. Publishing too little leaves customers unsure. Publishing exploit details too early can increase the danger. The standard is practical clarity first, followed by a complete account once users have had time to protect their funds.
Self Custody Still Has A Vendor Layer
Self custody changes who controls the asset. It doesn't remove the product and operational chain behind that control. A holder still depends on the wallet’s hardware, firmware and recovery phrase generation. Companion software, signed updates, backups and personal setup choices add more points of failure.
Hardware wallet companies sell confidence that a customer can hold keys more safely than on a general purpose computer or exchange account. A serious failure in seed creation reaches the core of that promise because the recovery phrase is the ownership credential.
Multi signature arrangements can reduce dependence on one device or seed when keys are created independently and held through genuinely separate setups. They also add coordination and recovery work. A poorly designed multi signature process can create new failure points, so it should not be presented as an automatic cure.
Regulated custody creates a different tradeoff. The customer gives up direct key control but may gain institutional controls, insurance arrangements, segregation requirements and accountable operations. The development of Canadian digital asset custody shows the infrastructure required to serve exchanges, funds and financial businesses. Canada's existing crypto custody safeguards focus on many of the same risks, including key loss, cyber attacks, operational failure and the separation of customer assets. Neither model removes risk. They place it with different people, systems and legal obligations.
What Bitcoin Owners And Custody Teams Need To Recheck
Bitcoin holders need to know which device and firmware created each recovery phrase, not only which device stores it today. They also need verified firmware, tested backups and a migration process that does not expose the old or new phrase to an online computer. The same records support digital asset inheritance when another person must eventually locate and use the recovery plan.
Founders building custody products should treat randomness as a product control with its own testing, review and release record. Reproducible software and open code can help independent reviewers inspect a system, but those controls only work when releases are examined and warnings reach customers quickly.
Investors and institutional buyers need more than a security feature list. Useful diligence asks how key material is created, how firmware changes are reviewed, how vulnerabilities are disclosed, how affected users are identified and whether one compromised component can expose the entire wallet.
The incident doesn't mean self custody has failed. It shows why "you hold the keys" is only the beginning of the security question. The harder issue is how those keys were created, which systems can influence them and what happens when a trusted device gets that process wrong.
Talking Point
If a hardware wallet creates the key that controls the asset, what independent checks should users and institutions require before trusting that key with meaningful value?
Company At A Glance
EstablishedCompany sources use both 2011 and 2012
HeadquartersToronto, Canada
FoundersRodolfo Novak and Peter D. Gray
OwnershipPrivate and self funded, according to Coinkite
Company StageEstablished Product Company / Incident Response
Core BusinessBitcoin security hardware and self custody tools
Key ProductsCOLDCARD, OPENDIME, BLOCKCLOCK, TAPSIGNER, SATSCARD, SATSCHIP, SEEDPLATE and arca
DistributionDirect online sales to more than 100 countries plus international resellers, according to the company
ManufacturingCustom electronics built in Toronto, according to the company
RevenueCoinkite describes itself as profitable; exact revenue is not disclosed
CustomersBitcoin holders and security focused users; exact customer and unit totals are not disclosed
Current TriggerReported Coldcard seed generation flaw, customer migration and technical disclosure
Milestones
Select a milestone to follow how Coinkite moved from online Bitcoin services into specialized self custody hardware
1Early Services2011 to 2013
2Hardware Refocus2016
3Physical Bitcoin2016 to 2017
4Product System2022 to 2026
5Incident ResponseJul to Aug 2026
Milestone 1
Coinkite Builds Early Bitcoin Services (2011 to 2013)
Rodolfo Novak and Peter D. Gray began working on Bitcoin products during the market's early years. Coinkite developed a blockchain explorer, payment terminals, hosted wallet services and infrastructure for other Bitcoin businesses.
Company
CoinkiteAn early Canadian Bitcoin product company
Stage
FormationSeveral products test where Bitcoin demand is forming
Capital
Self FundedThe company says it developed without venture funding
Markets
Canada And OnlineBitcoin services reach users beyond Toronto
Customers
Users And MerchantsHosted wallets, payments and software infrastructure
Competition
Early Bitcoin ServicesTrust and usability are still being established
Additional Company Data
- The company homepage says Coinkite was founded in 2012
- A company careers listing describes it as established in 2011
NCFA Perspective
Coinkite began by testing several parts of the Bitcoin experience. That operating range helped the founders identify the work they wanted to keep and the centralized services they eventually chose to leave.
Milestone 2
Coinkite Leaves Hosted Wallets For Hardware (2016)
Coinkite closed its hosted wallet and payment services after years of distributed denial of service attacks, legal demands and support costs. The company concentrated its resources on products that let customers control Bitcoin without relying on Coinkite to hold funds.
Company
Hardware FocusCoinkite exits its centralized wallet role
Stage
Business RefocusResources concentrate on physical products
Capital
Internally FinancedA smaller operating model replaces hosted services
Markets
Global Bitcoin UsersHardware can be sold without holding customer assets
Customers
Self Custody UsersBuyers take responsibility for their own keys
Competition
Custody AlternativesDirect ownership competes with hosted wallets and exchanges
Additional Company Data
- The former hosted service had processed substantial Bitcoin transaction volume
- Closing the service removed Coinkite from direct control of customer balances
NCFA Perspective
The 2016 decision created the company Coinkite is today. It exchanged recurring online service work for a hardware business built around direct ownership and product trust.
Milestone 3
OPENDIME And COLDCARD Establish The Product Base (2016 to 2017)
OPENDIME introduced a physical Bitcoin bearer device in 2016. Coinkite announced COLDCARD in December 2017 as a Bitcoin signing device that could operate offline and work without a proprietary desktop application.
Company
Coinkite HardwarePhysical Bitcoin becomes the main product category
Stage
Product LaunchTwo distinct hardware formats reach the market
Capital
Product RevenueHardware sales support continued development
Markets
Bitcoin OnlyThe company narrows its focus instead of adding other assets
Customers
Direct HoldersUsers who want physical control of bitcoin
Competition
Hardware WalletsOffline signing and Bitcoin only design differentiate COLDCARD
Additional Company Data
- OPENDIME reached its tenth anniversary in June 2026
- COLDCARD became the core security product around which later models were built
NCFA Perspective
OPENDIME and COLDCARD turned Coinkite's self custody position into products people could buy. The company no longer needed to hold the asset to earn revenue from Bitcoin ownership.
Milestone 4
Coinkite Expands Around The Bitcoin Key (2022 to 2026)
Coinkite added TAPSIGNER, SATSCARD, newer COLDCARD models, spending controls and additional backup products. The Mk5 launched in March 2026, while arca reservations opened in July for a separate device designed to protect sensitive personal data.
Company
Product PortfolioSeveral devices serve related security jobs
Stage
Established ProductsNew models extend the original hardware base
Capital
Profitable And Self FundedCompany description; exact financial results are private
Markets
More Than 100 CountriesDirect online sales supported by resellers
Customers
Security Focused BuyersIndividuals and teams using Bitcoin custody tools
Competition
Specialist SecurityBitcoin only design, offline workflows and product depth
Additional Company Data
- Coinkite says its custom electronics are built in Toronto
- Exact customer, unit sales, revenue and market share figures are not disclosed
NCFA Perspective
Coinkite built more than one wallet. Its products cover signing, physical transfer, backups, displays and access tools, giving the company several ways to serve the same security conscious customer base.
Milestone 5
A Reported Firmware Failure Tests Product Trust (Jul to Aug 2026)
Researchers linked a large series of Bitcoin transfers to weak recovery phrase generation in some Coldcard firmware. Reporting says Coinkite issued updated software and told affected users to create new recovery phrases and transfer their funds.
Company
Coinkite And COLDCARDThe incident reaches the company's core product
Stage
Incident ResponseCustomer protection and technical disclosure take priority
Capital
Financial Effect UndisclosedClaims, support and remediation costs are not public
Markets
Global Installed BaseAffected customers may be spread across several countries
Customers
Seed MigrationSome users may need new recovery phrases and wallets
Competition
Trust Under ReviewResponse quality becomes part of the product comparison
Additional Company Data
- Final affected wallet, firmware and loss totals remain under investigation
- A complete Coinkite technical account was not available when this snapshot was updated
NCFA Perspective
Coinkite spent a decade selling direct control as an alternative to institutional custody. Its response now has to show that direct ownership can be supported by fast warnings, precise remediation and a full technical account when a core control fails.
Continue through the custody, operational and investor protection questions raised by the Coldcard incident.
Frequently Asked Questions About Coldcard And Coinkite
Was the Bitcoin network hacked?
No. Current reporting links the thefts to weak recovery phrase generation in some Coldcard firmware. The reported failure occurred in wallet software, not the Bitcoin protocol.
What caused the reported Coldcard wallet thefts?
Current reporting links the thefts to weak randomness when some Coldcard firmware generated recovery phrases. A recovery phrase can recreate a wallet and control its funds, so an attacker who correctly predicts it may be able to transfer the bitcoin without touching the device.
Does updated firmware make an existing Coldcard wallet safe?
Updated firmware can correct the generation of new recovery phrases, but it cannot strengthen a phrase created with affected software. Current reporting says affected users need a newly generated phrase and must transfer their funds to the new wallet.
Which Coldcard models and firmware versions were affected?
A definitive list was not available when this article was verified on August 3, 2026. Users should rely on Coinkite's current security instructions and final technical disclosure rather than assume that every Coldcard device or version was affected.
How much bitcoin was stolen?
Reporting citing Galaxy Research estimates that more than 1,000 bitcoin left 1,196 wallets in 41 minutes on July 30, followed by two suspected waves that brought estimated losses close to US$89 million. Researchers have not confirmed that every wallet in those totals was created with affected Coldcard software.
Does the incident mean self custody is unsafe?
The incident does not establish that all self custody or hardware wallets are unsafe. It shows that direct ownership still depends on secure hardware, firmware, recovery phrase generation, updates, backups and user processes.
Who is Coinkite?
Coinkite is a private Toronto Bitcoin hardware company founded by Rodolfo Novak and Peter D. Gray. It makes COLDCARD, OPENDIME, TAPSIGNER, SATSCARD, BLOCKCLOCK and other self custody products.
Is Coinkite publicly traded?
No public listing was identified. Coinkite describes itself as privately held, self funded and profitable, but it does not publish detailed financial results.
Incident totals, affected firmware, losses and remediation guidance may change as Coinkite and security researchers complete their investigations. Product and company claims are attributed to their stated sources. This content is provided for informational purposes only and does not constitute investment, financial, cybersecurity or legal advice.
Leave a Reply