Hardware wallet hacks in 2026 revealed firmware randomness flaws and supply-chain implants that drained over $250 million from Bitcoin users, prompting a shift toward multisignature self-custody.
Coldcard firmware builds from March 2021 onward contained a randomness weakness that allowed attackers to predict seed phrases. In late July and early August 2026, attackers drained an estimated 1,800 BTC—worth between $100 million and $150 million—from thousands of Coldcard wallets. The flaw lived in the key-generation process, not in the device’s storage, meaning that even wallets kept in safes were vulnerable.
The second breach involved Ledger Nano X and Nano S Plus units sold by the authorized reseller CryptoBilis. Hidden implants in the firmware compromised seed phrases, leading to losses estimated at $90 million to $100 million by mid-October. The implants were limited to specific batches; no compromise of Ledger’s core infrastructure was detected.
Both incidents were confined to firmware or device batches, not to the vendors’ supply chains or internal systems. The attacks did not trigger Bitcoin price volatility, indicating that market participants absorbed the losses without a broader panic.
Firmware Randomness Weakness in Coldcard
Coldcard’s firmware used a pseudo-random number generator (PRNG) that failed to incorporate sufficient entropy. The weakness allowed attackers to reconstruct seed phrases from known outputs. Because the flaw existed in the generation step, users could not mitigate the risk by simply securing the device physically.
Galaxy Research reported that funds drained from Coldcard wallets remained largely unmoved in collector addresses as of mid-October. The persistence of the stolen coins in these addresses suggests that attackers are consolidating assets before moving them further.
Supply-Chain Implant in Ledger Devices
Ledger’s supply-chain attack targeted units sold through CryptoBilis. The implants were embedded during manufacturing and activated when the device was initialized. Seed phrases entered during setup were intercepted and transmitted to an external server controlled by the attackers.
The attack was limited to specific batches; devices from other resellers or directly from Ledger did not exhibit the same behavior. No evidence of a broader compromise of Ledger’s production facilities was found.
Operational Consequences for Users
Users who relied on single-vendor hardware wallets faced exposure to both firmware and supply-chain vulnerabilities. The incidents prompted a reassessment of self-custody practices. Multisignature (multisig) wallets, which require signatures from multiple independent devices, emerged as a preferred mitigation. A multisig setup that pulls keys from different manufacturers would render a single compromised device insufficient to drain funds.
Seed-phrase generation with user-supplied entropy—such as dice rolls—reduces dependence on device-generated randomness. However, this practice requires users to manage additional steps and is not universally adopted.
Market and Regulatory Implications
With more than $240 million lost to hardware vulnerabilities, some market participants are turning toward regulated custody services and investment vehicles that bundle security into the product. Analysts note a growing concern over hardware solutions relative to institutional custodians and exchange-traded funds, potentially influencing investor behavior.
Regulators may scrutinize hardware-wallet vendors more closely, especially regarding firmware audit processes and supply-chain integrity. The incidents underscore the need for transparent security practices and third-party verification.
What to Watch Next
- Whether the Coldcard thieves begin moving the coins tracked by Galaxy Research.
- Whether additional tampered Ledger units surface beyond the CryptoBilis batch.
- How custodial service providers adjust their security offerings in response to the breaches.
The available evidence does not show a coordinated attack across vendors, but the simultaneous emergence of two distinct vulnerabilities suggests that hardware-wallet security remains a critical risk factor for Bitcoin self-custody.
Related coverage
- USDC Samsung Wallet: Coinbase Powers Stablecoin on 82 Million U.S. Devices
- New York Attorney General Sues Polymarket for Illegal Gambling
- BingX MiCAR license Secures Regulated Crypto Services Across 29 EEA States