Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep
coindesk-25-minute-sweep
https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep
- Organisation
- CoinDesk
- Evidence role
- Reporting
- Published
- 2026-07-31
- Source changes
- 0
- Detected differences
- 58
- Unreviewed
- 0
- Copies held
- 59
CoinDesk's day-one report, held because it is among the widest-read accounts and because its framing (594 BTC, a 25-minute window) is the narrower transaction set rather than the wider attributed one. Where reporting and this site's arithmetic differ, the funds-accounting page states what each figure measures rather than picking one.
Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .
Also held inside a captured conversation
This post is held twice: here, with this project's own note on why it matters, and again as part of the conversation captured at , which is polled for changes. Both copies are the same post; neither is a separate event.
Public privacy boundary
Snapshot and diff bodies for this chain monitor are held in the local evidence archive but withheld from the public site because they can contain the addresses of people who published nothing themselves. Capture times and reviewed change summaries remain available below.
Held captures
-
Recovered from the Internet Archive rather than captured by this project. The row records that third-party provenance separately from captures made by this project.
What changed from the previous capture 0 lines
Extracted text as captured
Search / News Video Prices Research Events Data & Indices More Sponsored Search / en Sign In Sign Up Tech Major bitcoin wallet flaw drains $38 million worth of BTC in 25-minute sweep A hardware wallet randomness bug turned “impossible to guess” seeds into guessable ones, and $38 million is already gone. By Shaurya Malwa Updated Jul 31, 2026, 11:13 a.m. Published Jul 31, 2026, 5:12 a.m. 2 min read Make preferred on Share Share this article Copy linkX (Twitter)LinkedInFacebookEmail Make preferred on Coldcard flaw lets attacker drain $38 million in bitcoin from old wallets. (Coinkite) Summary Show An attacker exploited a flaw in how some Coldcard hardware wallets generated keys to steal roughly 594 bitcoin, worth about $38 million, from around 500 single-signature wallets in under 30 minutes. The vulnerability, introduced in Coldcard firmware 4.0.0 in March 2021, caused devices to skip their hardware randomness generator and fall back to predictable software-based key generation seeded by nonsecret chip data. Coinkite has warned users who created seeds on Mk3 devices running firmware 4.0.1 or later, while stressing that Mk4, Q and Mk5 appear unaffected so far, and the theft has had little visible impact on bitcoin’s market price. Roughly 594 bitcoin, worth about $38 million, was swept out of around 500 separate wallets between 01:31 and 01:56 UTC on Friday in an attack traced to a flaw in how Coldcard hardware wallets generated their keys. The theft moved 1,324 chunks of bitcoin across 500 transactions inside a three-block window, with 562 BTC then consolidated into a single address that has not moved. Every drained wallet was single-signature and each held more than 0.15 BTC. Many had been dormant for years and the coins spanned 2021 to 2026, matching the flaw's age almost exactly. Coldcard is a hardware wallet built by Canadian firm Coinkite, a small standalone device that stores bitcoin keys offline, away from internet-connected computers. Mk2, Mk3, Mk4, Q and Mk5 are successive generations of that product, released over several years the way a phone maker ships numbered models. Exposure depends on the firmware the device was running at the moment the wallet was first created, not on when the hardware was bought. A wallet's seed, the secret phrase controlling the funds, is meant to be drawn at random from a pool so vast that guessing is hopeless. Coldcard's firmware was not doing that. According to a report published by Block's Bitcoin engineering and security teams, a build setting told the device to skip its own hardware randomness generator, and a check in a supporting library tested only whether that setting existed rather than whether it was switched on. Key generation quietly fell through to a basic software substitute seeded from the chip's serial number and clock registers.Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.
58 presentation-noise differences. Sidebar, ticker and other page chrome churn that our review classified as not being changes to what the source says.
- +16 -16 Only live market prices, related-story ages and translated page chrome changed.
- +6 -6 Only live market prices and related-story ages changed.
- +16 -16 Only live market prices, related-story ages and translated page chrome changed.
- +16 -16 Only live market prices, related-story ages and translated page chrome changed.
- +11 -11 Live market quotes, relative timestamps and interface language changed; the article text did not.
- +11 -11 Live market quotes, relative timestamps and interface language changed; the article text did not.
- +6 -6 Live market quotes and relative timestamps changed; the article text did not.
- +21 -21 Live market quotes, relative timestamps and rotating homepage cards changed; the article text did not.
- +11 -11 The page changed only relative timestamps, locale formatting, and live market-price widgets.
- +7 -7 The page changed only relative timestamps, locale formatting, and live market-price widgets.
- +5 -5 The page changed only relative timestamps, locale formatting, and live market-price widgets.
- +7 -7 The page changed only relative timestamps, locale formatting, and live market-price widgets.
- +15 -15 Only rotating related-story cards, their relative times and counters changed.
- +7 -7 Only rotating related-story cards, their relative times and counters changed.
- +15 -15 Only rotating related-story cards, their relative times and counters changed.
- +15 -15 Only rotating related-story cards, their relative times and counters changed.
- +6 -6 Only relative times in latest-news cards and live market values changed. The article text did not change.
- +26 -26 The page switched from Spanish to English rendering, while live market values and latest-news cards changed. The article text did not change.
- +16 -16 The page switched from English to Spanish rendering, while live market values and relative times changed. The article text did not change.
- +28 -28 The page switched from Italian to English rendering, while live market values and latest-news cards also changed. The article text did not change.
- +26 -26 Only live news-module ordering, relative times and market prices changed. The final capture also received an Italian machine-translated presentation variant, while the article’s substance is unchanged.
- +9 -9 Only live news-module ordering, relative times and market prices changed. The final capture also received an Italian machine-translated presentation variant, while the article’s substance is unchanged.
- +23 -23 Only live news-module ordering, relative times and market prices changed. The final capture also received an Italian machine-translated presentation variant, while the article’s substance is unchanged.
- +24 -24 Only live chrome moved: the Latest Crypto News and More From Tech card lists rotated headlines, ordering and relative timestamps, and the footer crypto price ticker updated. The tracked article body is unchanged.
- +6 -6 Only live chrome moved: relative timestamps on the Latest Crypto News cards each aged by about an hour and the footer crypto price ticker updated (CD20, BTC, ETH, XRP, SOL). The tracked article body is unchanged.
- +6 -6 Only the Latest Crypto News relative timestamps ticked forward an hour and the footer crypto price ticker updated. Article body unchanged.
- +6 -6 Only the Latest Crypto News relative timestamps ticked forward (for example 58 minutes to 1 hour) and the footer crypto price ticker updated. Article body unchanged.
- +15 -15 Only site chrome moved: the Latest Crypto News card list rotated (an FBI crypto-theft arrest headline entered at the top and 'Bitcoin, ether decline as Coldcard exploit enters a fifth day' fell off), card timestamps advanced, and the footer price ticker updated. The article body was unchanged.
- +5 -5 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced by an hour, and the footer price ticker served updated quotes. The article text was unchanged.
- +7 -7 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced by an hour, and the footer price ticker served updated quotes. The article text was unchanged.
- +6 -6 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced by an hour, and the footer price ticker served updated quotes. The article text was unchanged.
- +6 -6 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced by an hour, and the footer price ticker served updated quotes. The article text was unchanged.
- +16 -16 The page flipped back from the Russian AI-translation localization to English chrome, with the usual news-card timestamp and footer ticker churn. The article text was unchanged.
- +16 -16 The byline, share buttons and news-card timestamps were served in Russian with a "Переведено ИИ" (translated by AI) marker, the recurring localization flip over an unchanged English article body, alongside the usual timestamp and footer ticker churn.
- +6 -6 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced again, and the footer price ticker served updated quotes. The article text was unchanged.
- +16 -16 The page flipped back from the Russian AI-translation localization to English chrome, with the usual news-card timestamp and footer ticker churn. The article text was unchanged.
- +16 -16 The byline, share buttons and news-card timestamps were served in Russian ("Автор", "Переведено ИИ"), an AI-translation localization layer over an unchanged English article body, alongside the usual timestamp and footer ticker churn. The article text itself was unchanged.
- +7 -7 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced by an hour, and the footer price ticker served updated quotes. The article text was unchanged.
- +5 -5 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced again, and the footer price ticker served updated quotes. The article text was unchanged.
- +6 -6 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced again, and the footer price ticker served updated quotes. The article text was unchanged.
- +6 -6 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced by an hour, and the footer price ticker served updated quotes. The article text was unchanged.
- +16 -16 Only site chrome moved: the Latest Crypto News rail gained a new top headline (Trump-linked American Bitcoin president Matt Prusak departs for Giga Energy) and renumbered with advanced relative timestamps, dropping the Bithumb card, and the footer price ticker served updated quotes. The article text was unchanged.
- +6 -6 Only site chrome moved: relative timestamps on the Latest Crypto News cards advanced (26 minutes to 59 minutes ago and similar), and the footer price ticker (CD20, BTC, ETH, XRP, SOL) served updated quotes. The article text was unchanged.
- +16 -16 Only site chrome moved: the Latest Crypto News rail gained a new top headline and renumbered with advanced relative timestamps, and the footer price ticker (CD20, BTC, ETH, XRP, SOL) served updated quotes. The article text was unchanged.
- +9 -9 Only the relative timestamps on the article's own news cards advanced, from "15 minutes ago" to "44 minutes ago" and so on. No article text changed.
- +18 -18 Only site chrome changed: the Latest Crypto News card list rotated again (Circle downgrade and Bernstein market-outlook headlines entered at the top), card ordering and timestamps shifted, and the footer crypto price ticker updated. The article body was unchanged.
- +15 -15 Only site chrome changed: the Latest Crypto News card list rotated (BlackRock tokenized-cash and Bitmine ether-purchase headlines entered at the top), card ordering and timestamps shifted, and the footer crypto price ticker updated. The article body was unchanged.
- +26 -26 Only site chrome changed: the page UI flipped back to English, the Latest Crypto News card list rotated again (a Strategy bitcoin-sale headline entered at the top), and the footer price ticker updated. The article body was unchanged.
- +26 -26 Only site chrome changed: the page UI rendered in French (byline, share labels, relative timestamps, a Traduit par IA tag), the Latest Crypto News card list rotated, and the footer price ticker updated. The article body was unchanged.
- +18 -18 Only site chrome changed: the Latest Crypto News card list rotated (a solo-miner headline entered at the top), card timestamps advanced, and the footer crypto price ticker updated. The article body was unchanged.
- +20 -20 Only site chrome changed: the Latest Crypto News card list rotated headlines, ordering and timestamps, and the footer crypto price ticker updated. The article body was unchanged.
- +18 -18 Only site chrome changed: the Latest Crypto News card list rotated headlines, ordering and timestamps, and the footer price ticker updated. The article body was unchanged.
- +15 -15 Only site chrome changed: the Latest Crypto News card list rotated headlines, ordering and timestamps, and the footer price ticker updated. The article body was unchanged.
- +16 -16 Only site chrome changed: the Latest Crypto News and More From Tech card lists rotated (the newer headline 'Coldcard wallet losses may near $114 million as possible fourth sweep emerges' entered both), and the footer price ticker updated. The article body was unchanged.
- +23 -23 Only site chrome changed: the Latest Crypto News card list rotated headlines, ordering and timestamps, and the footer crypto price ticker updated. The article body was unchanged.
- +5 -5 Only relative timestamps on the Latest Crypto News cards advanced and the footer crypto price ticker updated. The article body was unchanged.
- +8 -8 Only presentation churn changed: relative timestamps on the Latest Crypto News cards advanced and the footer crypto price ticker updated. The article body was unchanged.
- +20 -20 Only site chrome changed: the Latest Crypto News and More From Tech card lists rotated headlines, ordering and timestamps, and the footer crypto price ticker updated. The article body was unchanged.
How to check this yourself
The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.
Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.
How to check this yourself
Compare the screenshot or a quotation against the original while it is available.