The vault had been open for five years, no one had noticed

Just over 1,000 bitcoins, worth about 70 million dollars, left hardware wallets that had never been connected to the internet. The thief did not touch any device. He did not enter anyone's home. He did not send any poisoned messages. He simply guessed the keys. They had been guessable since March 2021.

This is the scenario that the bitcoin community had deemed impossible for ten years. The so-called "cold" wallet, the device that keeps your keys offline in a drawer, was supposed to be the last line of defense. It just fell without anyone touching it.

What happened, in order

On the night of July 30 to 31, 2026, someone emptied about 500 bitcoin wallets in less than an hour. In total, 594.5 bitcoins, worth approximately 38 million dollars, were moved in a flurry across a few blocks of the chain. Many of these wallets had been dormant for years, without the slightest movement.

Analysts then dug into the history. Clay Garrett, a security engineer at Block, found 695 older transactions with exactly the same signature. They represented an additional 488 bitcoins. Most likely, the same author had already struck without anyone noticing.

The most discreet theft is the one at the top. No one had spotted it. It is probably the most concerning of the two.

As of August 1, the total counted reached 1,082.65 bitcoins. Researchers warn that this figure remains provisional. The largest part of the loot, 562 bitcoins, has been consolidated into a single address. It has not moved since. Everyone can see it, all the time, but no one can touch it. This is one of the ironies of this story.

The bug comes down to a poorly chosen word

This is how a line of code can cause a loss of 70 million dollars.

A hardware wallet generates your 24 secret words from pure randomness. To achieve this, it uses a dedicated chip that produces randomness from physical phenomena. This is called a hardware random number generator. This component is essential. It is also the one that the software never called.

In March 2021, Coinkite, the manufacturer of the Coldcard, migrated its code to the Bitcoin Core cryptographic library. During this operation, the function responsible for producing randomness changed its name. The developers intended to disable the software backup generator by setting its value to zero.

But the test written in the code did not ask "is this setting zero." It asked "does this setting exist." The setting did exist, even with the value zero. The test therefore passed. The compiler quietly connected the backup generator instead of the real one, without producing the slightest alert.

This is the difference between asking someone if they have a driver's license and asking them to show it. The chip's code was indeed present in the device. It simply was never executed.

The result, in plain terms

On the left, the lock you were sold. On the right, the one that actually protected your savings.

A secret phrase of 24 words should provide 128 bits of randomness. This represents a number of combinations with 39 digits. Even with all the computers on the planet for the age of the universe, no one can try them all.

On the affected Coldcard Mk3s, there were only about 40 bits left. On newer models, there were about 72 left. Forty bits represent one trillion possibilities. The number seems huge. For an ordinary machine, however, it only represents a few hours of work and the price of a pizza in electricity. The backup generator did not really produce randomness. It started from the internal state of the chip and its clock, two values that the attacker could recalculate.

The vault was not forced. The lock only had three digits, and the attacker counted them.

What the viral thread gets wrong

The message that has been circulating everywhere since last night contains true information, but also at least three errors. It is passing through the messaging apps of people who have money at stake. It is best to correct the damage before the summary becomes more dangerous than the bug.

• “The Mk4, Mk5, and Q are safe.” This is false, and it is the most serious mistake. These models are also affected. They resist better because they mixed randomness from their secure chip. According to Coinkite, this raises the level to about 72 bits. But the attack remains possible. Taking into account the values that the attacker could guess, Galaxy Research estimates that there were about four billion combinations left to try. Coinkite has released a fixed firmware for all models, not just for the Mk3.
• “Your words came from the rhythm of your button presses.” The explanation is nice, but it is not the one from the official analysis. The generator used the state of the device and the time, including clock registers and the chip's serial number. None of these values are secret. It is more than enough to cause disaster.
• “With a passphrase, you are safe.” This is half true. Coinkite explains that a strong and unique passphrase adds independent protection. This is true, but the manufacturer still recommends migrating. A weak passphrase no longer protects anything since the seed is now public.

One point is perfectly accurate: dice rolls protect you. Coinkite confirms that 50 to 98 private rolls alone provided at least 128 bits, and that 99 rolls or more provided about 256. If you spent an evening rolling a die to create your seed, you can breathe easy. Other brands, Ledger and Trezor, are not concerned. Their devices and their code are different.

Are you affected, and what to do?

The rule is simple and brutal. What matters is not the model you own today. It is the version of the software used on the day you created your seed.

• Mk3: versions 4.0.1 to 4.1.9 affected. Fixed in 4.2.0.
• Mk4 and Mk5: affected before version 5.6.0, or 6.6.0X on the Edge branch.
• Q: affected before version 1.5.0Q, or 6.6.0QX on the Edge branch.

Here is the hardest information, the one you need to understand before touching anything: updating the firmware does not fix an already created seed. The firmware is the internal software of the device. Its update corrects the creation of future keys. Yours were created only once, sometimes years ago, with the wrong die. They will remain guessable forever.

The procedure published by Coinkite consists of six steps. You need to update the device, create a new seed, note the backup and verify it, check a receiving address on the device's screen, send a small test transaction, and then move the rest. You must keep the old backup until everything has been transferred.

Last urgent point: fake support accounts are rampant in private messaging. No serious manufacturer will ever ask you for your 24 words. None will send you a link to “secure” your wallet. Those who did not lose their bitcoins last night may lose them this week, due to a much more mundane scam.

Open source has not kept its promise, and it must be said

The Coldcard code is public. It always has been. The slogan in the community, “don’t trust, verify,” has been repeated like a prayer for ten years. The bug remained visible for five years. It took a thief exploiting it for someone to notice.

This is the true lesson of this affair. Open code is not necessarily reviewed code. “Thousands of eyes” is a figure of speech, not an audit. And no one, let’s be honest, wakes up on Sunday morning with a pressing desire to review the compilation options of a firmware.

One last tasty detail, at least for those who lost nothing: Coinkite believes that someone used artificial intelligence to sift through its old firmware versions. The company specifies that it itself ran “one of the best available models” on its code a few weeks earlier, without finding anything. The security community received this explanation with a raised eyebrow. The idea remains chilling: machines can patiently review twenty years of open code to find the line that no one has looked at.

So, keeping your bitcoins in a bank is safer?

This is the question everyone has been asking since yesterday. It deserves better than a supporter’s answer.

There is no perfect answer. There are two different ways to lose everything. The choice is to decide which one scares you the least.

When you buy bitcoin in a bank or broker's app, you do not hold your keys. The company keeps them for you. You own a line in its ledger and a promise. In jargon, this is called counterparty risk. If the company goes under, disappears, or gets drained, you become a creditor waiting your turn. Those who left their coins with FTX or Celsius did not lose their keys. They lost their contact.

In Europe, the situation has changed. It's no longer the Wild West. Since July 1, 2026, the end of the transition period of the European regulation on crypto-assets requires providers to have a license. It especially requires them to strictly separate clients' assets from those of the company. This is precisely what was lacking during the bankruptcies of 2022. This does not make bankruptcy impossible. It makes looting the safe by the boss much more difficult.

But there remains a trap that many people ignore: these crypto-assets are not bank deposits. The European guarantee of 100,000 euros, which protects the money in your current account, does not apply to them. Seeing a "bitcoin" line in the same app as your salary gives a false sense of protection. This protection does not exist.

What it means for a normal family

Here’s how I would present the choice to someone who doesn’t want to spend their evenings on it.

If you invest 500 or 2,000 euros to try, your bank's app or that of a regulated broker is very likely the right choice. Not because it is safer in absolute terms. But the overwhelming majority of losses among individuals come from lost backups, from words written on a misplaced piece of paper, from moves or deaths without transmission. Exotic cryptographic bugs come far behind. A forgotten password can be recovered. A lost seed can never be recovered.

If you hold an amount that would change your life, the right answer is neither one nor the other. You should not put everything in the same place. This week, those who had spread their assets between two wallet brands and a regulated account lost a third of something. Those who had put everything in the same device lost everything. This is the most boring advice in the world. It is also the only one that has worked in every disaster for the past fifteen years.

If you want to keep your keys yourself, which remains a perfectly defensible choice, the lesson is concrete: add your own randomness. In this matter, the dice were the only effective protection. Fifty throws, one evening, and you no longer depend on someone else's generator.

What I think about it

What remains for me is not the 70 million. It’s the message from a man on a forum. In a few lines, he explains that eight years of savings have just disappeared. He is 39 years old, hoped to build a cushion before 50, and no longer knows if he still believes in all this. He adds that he chose this device precisely because its code was open and verifiable by anyone. He had done his homework. It’s this detail that makes this story so hard.

The promise of bitcoin was to depend on no one. This week, we discovered that everyone depended on a compilation option written one day in March 2021. Someone had written "exists" instead of "is worth". There is no customer service to fix this, no guarantee fund, no recourse. The transaction is valid, final, and visible to everyone, forever.

This is not the end of the hardware wallet. Those who announce it usually sell something else. It is the end of a naivety: believing that an object is safe because its code is public and that someone else, necessarily, must have verified it.