The short answer: yes, Coldcard is safe to use today — but only if your device generated your seed phrase on patched firmware. Coinkite fixed the vulnerability behind the $112 million hack on July 31, 2026, and the attack skipped every multisig setup. However, any seed phrase from the flawed firmware (March 2021 through July 2026) stays permanently compromised, and a firmware update alone does not fix it. If that’s you, generate a new seed and migrate your funds today.
That’s the verdict. Now let’s look at why August 2026 became the worst month in hardware wallet history — and what it means for how you store your crypto.
What happened to Coldcard?
On July 30, attackers began draining Bitcoin from Coldcard wallets at scale — over 1,000 BTC swept from more than 1,000 addresses in the first 41 minutes alone. Total confirmed losses have passed 1,778 BTC, roughly $112 million, making this the largest hardware wallet compromise in history.
The attackers didn’t phish anyone. They didn’t steal a single device. The flaw lived inside the firmware itself: a 2021 update accidentally rerouted seed phrase generation away from the device’s dedicated hardware randomness chip to a predictable software-based random number generator. That mistake made seed phrases guessable, and attackers eventually built tooling to enumerate them at scale. Galaxy Research counted at least a dozen distinct attackers exploiting the same weakness.
The vulnerability hit the Mk2, Mk3, Mk4, Q, and Mk5 models. Coinkite published its security advisory on July 30 and shipped patched firmware within a day. CEO Rodolfo Novak issued a public apology.
We covered the full story as it unfolded in our Coldcard wallet hack breakdown — read that for the complete timeline and technical details.
So is Coldcard safe to use in 2026?
Here’s our honest take, broken down by situation:
If you buy a new Coldcard today: Safe. New devices ship with patched firmware, and the flaw behind this hack no longer exists in current versions.
If your device created your seed before August 2026: Treat it as compromised until proven otherwise. The patch fixes future seed generation — it does nothing for seeds from the vulnerable firmware. Attackers can guess those keys forever. Generate a fresh seed on patched firmware and move your funds. Don’t wait to see if your address gets swept.
If you run a multisig setup: You dodged this one entirely. The attackers failed to drain even one multisig Coldcard wallet. If you needed one more reason to upgrade to multisig, this is it.
The bigger question — can you trust any single hardware wallet? That’s the uncomfortable lesson here. Coldcard users did everything right: they bought a respected device, kept it offline, followed best practices. They still lost everything to firmware they had no way to audit. Your security only goes as deep as the things you never see.
The Trezor breach: a different kind of leak
Two weeks after the Coldcard news, Trezor disclosed that its shipping partner ShipMonk suffered a breach. The incident never touched devices, private keys, or wallets. What leaked instead sounds arguably scarier: a verified list of hardware wallet owners, complete with home delivery addresses.
The numbers: the leak exposed the full name, email, phone number, and shipping address of 11,742 customers, plus partial data on another 1,947. It covers orders from the 90 days before August 8 across the US, UK, Sweden, Colombia, Brazil, Italy, and Portugal.
Trezor emailed every exposed customer directly from help@trezor.io — no email means you’re not on the list. We break down the full incident, the phishing risks, and how to protect yourself in our Trezor data breach coverage.
Why does this matter in the same conversation as the Coldcard hack? Because a leaked list of confirmed hardware wallet owners with home addresses forms exactly the data set fueling the rise in physical coercion attacks — so-called wrench attacks totaled $124 million in the first half of 2026 alone.
What to do now: your hardware wallet security checklist
Two brutal incidents, five practical takeaways. For the complete playbook, our guide to crypto safety measures covers protection against both online and offline theft — below are the five that matter most right now:
1. Migrate if you’re affected. Did your Coldcard generate its seed between March 2021 and July 2026? New seed on patched firmware, move the funds, today.
2. Upgrade to multisig. It saved every single multisig Coldcard user in this attack. One compromised key doesn’t lose you your Bitcoin.
3. Add a passphrase. A strong passphrase on top of your seed adds a layer even a broken seed generator can’t fully break.
4. Protect your identity when you buy. Order hardware wallets with an email that carries no trace of your real name, and ship to a pickup point instead of your front door. The Trezor leak shows why: the weak point was never the device — it was the box it arrived in.
5. Never enter your seed phrase online. Expect a wave of phishing targeting both Coldcard and Trezor users in the coming months. No legitimate company will ever ask for your seed. Not once. Not ever.
Final Words
Coldcard remains safe to use in 2026 — Coinkite patched the bug, and new seeds come from proper hardware randomness. But this hack permanently changed the conversation around hardware wallets. “Cold storage” was never a magic phrase; it’s a set of habits. The users who came out of August unscathed weren’t the ones with the most expensive device. They ran multisig, used passphrases, and kept their names off the shipping label.
Stay safe out there. And if your seed predates the patch: stop reading and go migrate.
FAQ
Is Coldcard still safe to use in 2026?
Yes. Coinkite patched the firmware vulnerability behind the $112 million hack on July 31, 2026, and new devices ship with secure firmware. Seeds from patched firmware use proper hardware randomness. The only ongoing risk sits with old seeds from the vulnerable versions — you must replace those.
How do I know if the hack affected my Coldcard?
If a Mk2, Mk3, Mk4, Q, or Mk5 device running firmware from March 2021 through July 2026 generated your seed phrase, treat it as compromised. It doesn’t matter whether anyone has touched your funds yet — attackers can guess the seed itself. Check Coinkite’s official security advisory for the exact firmware versions.
Does updating my Coldcard firmware fix the problem?
No, and this ranks as the most dangerous misunderstanding about the hack. The patch only fixes how the device generates future seeds. Any seed from vulnerable firmware remains permanently guessable, even after you update. The only fix: generate a brand-new seed on patched firmware and move your funds to it.
How do I migrate my Bitcoin to a new seed safely?
Update your Coldcard to the latest firmware first, then generate a completely new seed phrase on the device. Set up the new wallet, verify you can receive to it, and send your full balance from the old wallet to a fresh address on the new seed. Never reuse the old seed for anything afterward.
Did hackers breach Trezor too?
No — Trezor suffered a data breach, not a hack. Its shipping partner ShipMonk leaked the names, home addresses, phone numbers, and emails of roughly 13,700 customers. The attackers never touched devices, seeds, or funds. The risk here means phishing and targeted attacks, not stolen crypto. Trezor emailed affected customers directly from help@trezor.io.
Should I switch from Coldcard to another hardware wallet?
Switching brands doesn’t solve the underlying problem — every hardware wallet asks you to trust firmware you can’t audit, and Trezor’s breach shows even the supply chain around a wallet can fail. A better upgrade: change your setup. Multisig across devices and a strong passphrase protect you regardless of which brand fails next.
What is a wrench attack and why does the Trezor leak matter?
A wrench attack means physical coercion — someone showing up in person to force you to hand over your crypto. These attacks totaled $124 million in the first half of 2026. The Trezor leak matters because it exposed a verified list of hardware wallet owners with home addresses, exactly the target list such attackers want.
Credit: Source link
