# $130M Stolen Through Hardware Wallet Vulnerability Hackers exploit critical flaw in offline crypto wallets, raising questions about cold storage security. - **Source:** [cryptocurrency | TechCrunch](https://brifing.si/source/496f6f78-2249-4ebc-8a23-11bb8f4b24c9) - **Published:** 2026-08-04 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/85ebffe5-5cd7-4e0b-8f46-ce5b85a1df58 ## Large-Scale Crypto Theft Blockchain security firms detected hackers stealing significant amounts of cryptocurrency from offline hardware wallets. At least 12 different hacker groups targeting Coinkite's Coldcard wallets have stolen $130 million worth of crypto assets so far. According to Galaxy Research, multiple groups appear to be behind these attacks. Elliptic firm confirmed this estimate, marking one of the largest crypto heists in 2026. ## 2026's Biggest Cyber Heists TRM Labs data shows over 200 hack attacks targeting crypto companies in 2026, with total losses exceeding $950 million. However, the Coldcard attack stands out because offline wallets were theoretically considered the most secure storage method. This incident fundamentally challenges basic assumptions about crypto security, proving that even air-gapped devices can be vulnerable to sophisticated attacks. ## Coldcard's Critical Flaw Security researchers discovered a critical vulnerability in how Coldcard wallets generated seed phrases. Blockchain analysis firm Block revealed that hackers could predict users' seed phrases due to this flaw. The fact that keys generated by offline devices were predictable has shaken the foundation of hardware wallet security models. This development forces a redefinition of what 'cold storage' truly means in practice. ## Brute Force Attack Method After discovering the flaw, hackers used brute force methods to generate victims' seed phrases. Unlike traditional hacks, this attack required no physical access or internet connection. By understanding the key generation algorithm, hackers mass-produced valid seed phrases. This method establishes a new attack vector in crypto security, demonstrating that offline doesn't necessarily mean unhackable. ## Victims' Helplessness Users like Jonathan Goodman, who lost $1.6 million, were compromised despite all security measures. Goodman stated he never shared his seed phrase, kept devices offline, and stored keys in bank vaults. Yet a single line of vulnerable code from 2021 rendered all precautions useless. This situation raises serious questions about hardware wallet manufacturers' liability and quality assurance processes. ## Coinkite's Emergency Measures Wallet manufacturer Coinkite issued an advisory on Thursday, updated Saturday, warning users about the flaw. The company urged users to update devices and migrate to new seed phrases. However, Coinkite's silence on TechCrunch's requests for comment fuels speculation about the breach's full scope. Security experts warn similar hardware wallets might be at risk, suggesting industry-wide implications. ## Paradigm Shift in Crypto Security This incident shatters the belief in absolute security of offline wallets. Cold storage solutions, traditionally considered safer than 'hot wallets' (like exchange accounts), face their first large-scale security failure. Experts now emphasize that no storage method is 100% secure, recommending users diversify their crypto holdings across multiple solutions rather than relying solely on hardware wallets. ## Industry-Wide Implications The $130M hack necessitates reevaluation of crypto security standards. As hardware wallet market credibility suffers, insurance companies are developing new policies for crypto assets. Regulatory scrutiny over wallet manufacturers is expected to increase. This event may permanently alter risk perception in decentralized finance (DeFi), potentially accelerating institutional demand for insured custody solutions. ## Sources covering this story - https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._