The scale of the incident keeps growing

Loss estimates for the Coldcard exploit have risen steadily since the attack was first flagged.

Early tallies put the damage at tens of millions of dollars. Later analysis pointed to more than 1,700 BTC taken, with figures reported in the range of roughly $110 million to $130 million depending on the methodology and the bitcoin price used.

Blockchain analytics firms have described it as the largest hardware wallet exploit recorded in 2026.

Thousands of addresses affected

The attack did not target a single large holder.

Reporting indicates that the exploit touched thousands of separate addresses, with estimates commonly cited in the range of 5,000 wallets or more than 5,200 affected addresses.

That distribution profile points to a systematic flaw being swept across a large population of devices rather than an isolated compromise.

Why this exploit unsettled self-custody advocates

Hardware wallets are marketed on a specific promise: private keys never leave an offline device.

The incident challenged several assumptions that self-custody users rely on, including:

• that air-gapped signing removes remote attack surface
• that offline key generation is inherently safe
• that firmware trust can be taken for granted
• that a device with no network connection cannot be swept at scale
• that cold storage removes the need for ongoing security maintenance

For many holders, the takeaway was that self-custody transfers risk rather than eliminating it.

Users urged to move funds

As the exploit continued, users of affected devices were urged to move their bitcoin to new wallets generated on unaffected hardware.

Migration is not trivial. It requires generating new seeds, moving funds on-chain, paying fees and updating any multisig or inheritance arrangements built around the old keys.

The operational burden fell on individual users rather than on any institution able to absorb the loss.

The custody debate reopens

The timing coincided with continued institutional inflows into regulated bitcoin products, which sharpened an old argument.

Points raised on both sides included:

• regulated custodians carry insurance and audit obligations
• exchange-traded products remove key management from the end user
• self-custody removes counterparty risk but adds operational risk
• institutional custody concentrates assets into fewer targets
• neither model eliminates the need for security diligence

There is no confirmed evidence linking the exploit to shifts in ETF flows, and analysts have cautioned against drawing that connection.

Supply chain and firmware risk moves up the agenda

The incident has pushed firmware and supply chain security higher on the industry agenda.

Areas now under closer scrutiny include reproducible builds, firmware signing practices, entropy generation on device, disclosure timelines and the responsibilities vendors carry after a device has shipped.

Wallet manufacturers across the market face pressure to demonstrate that their own processes would not permit a comparable failure.

Why this matters

This matters because self-custody has been the industry's default answer to exchange failures, and an exploit at this scale shows that the alternative carries its own systemic risk.

The question is no longer whether to trust a third party, but which failure mode a holder is best equipped to survive.

The clean takeaway

An exploit affecting Coldcard hardware wallets has drained more than 1,700 BTC, with reported losses exceeding $110 million across thousands of addresses. The incident is the largest hardware wallet compromise of 2026 and has reopened the debate over the real risk profile of self-custody.