Coldcard flaw sparks surge to 330,000+ new Bitcoin addresses in one week

According to The Block, wallet migrations tied to a security vulnerability affecting Coldcard devices pushed the number of newly created Bitcoin addresses from roughly 260,000 to more than 330,000 last week, snapping a decline that had persisted through most of 2026. Since July 30, users of Coinkite hardware wallets have lost at least 1,816 BTC—about $116 million—in four separate waves of attacks. The issue traces back to a 2021 firmware bug: instead of relying on the device's built-in hardware entropy, the firmware used a weak software-based random number generator to create mnemonic phrases, enabling attackers to brute-force wallets generated offline. Coinkite has urged users who created wallets between March 2021 and the release of the security patch to move funds to newly generated wallets. The episode underscores the operational risks of self-custody and is prompting some holders to re-evaluate the trade-offs versus custodial alternatives such as centralized exchanges or Bitcoin ETFs.