Many people have been talking about the Coldcard incident, but it’s not that cold wallets are no longer secure—simply put: Coldcard devices themselves were never directly hacked, and Bitcoin itself has no vulnerability. The issue lies in how the recovery phrases were generated. Due to a software bug dating back to 2021, some Coldcard wallets generated recovery phrases that lacked sufficient randomness. This allowed attackers to remotely guess the wallet keys by testing countless possibilities—without ever needing physical access to the device (45–50 bits of entropy instead of 180 bits). As of August 2, 2026, approximately 1,367 BTC—equivalent to nearly $89 million—has been withdrawn from over 4,500 related addresses. The key lesson here is clear: cold wallets can be extremely secure, but if the “key” is weakly generated from the start, funds can still be stolen remotely.