A firmware bug in a popular hardware wallet became this year’s largest cold-storage exploit

MakeCryippreferred on

• A firmware flaw in the Coldcard hardware wallet was exploited to drain roughly $116 million in bitcoin.
• The exploit is described as the largest hardware wallet-specific theft recorded in 2026.
• The incident undercuts the common assumption that offline, air-gapped storage is immune to remote compromise.

Hardware wallets exist on the premise that keeping private keys on a dedicated, offline device makes them fundamentally harder to steal than keys stored on an internet-connected computer or phone. That premise took a serious hit this year when a firmware flaw in Coinkite’s Coldcard wallet, one of the more widely used devices among bitcoin holders who prioritize self-custody, was exploited to drain approximately $116 million in bitcoin, the largest hardware wallet-specific theft blockchain intelligence firm TRM Labs has tracked in 2026.

What makes the Coldcard case worth studying is precisely that it broke the assumption most holders make about air-gapped devices: that a wallet with no network connection cannot be remotely compromised. A firmware-level flaw changes that calculus entirely, because firmware is the software running directly on the device itself, controlling how it signs transactions and interacts with the keys it stores. A bug at that layer does not need a live network connection to be dangerous; it only needs a path, whether through a malicious update, a crafted transaction, or some other vector the device processes, to trigger unintended behavior in code that has direct authority over the wallet’s private keys.

Analysis of the exploit points to the danger of concentrating this much authority in a single piece of firmware without enough independent verification of what that firmware actually does before it executes. Hardware wallets are often marketed on the strength of their isolation from the internet, but that isolation only protects users if the firmware itself is free of exploitable flaws, since the device’s entire security model rests on the assumption that the code running on it behaves exactly as intended. Once a flaw exists at that layer, the offline nature of the device stops being a meaningful defense against it.

The scale of the theft, and the fact that it targeted a device category specifically chosen by security-conscious holders, has pushed hardware wallet firmware auditing back into focus across the industry. Manufacturers that rely heavily on the reputation of physical isolation as their core security pitch face a harder question after an incident like this: whether their firmware review and update processes are rigorous enough to catch a flaw of this severity before it reaches devices already in customers’ hands, rather than after a nine-figure theft forces the issue.

For holders, the practical lesson is not that hardware wallets are unsafe, but that no storage method is a substitute for staying current on firmware updates and manufacturer security disclosures. A device bought for its offline security guarantees is only as strong as the firmware it is currently running, and a flaw discovered after purchase does not retroactively protect funds already exposed to it. The Coldcard incident is a reminder that self-custody shifts responsibility for security onto the holder, and that responsibility now explicitly includes keeping track of firmware-level risk, not just physically securing the device itself.