Key takeaways
- Cold wallets can lose cryptocurrency without connecting online
- Coldcard's faulty seed generation exposed millions in Bitcoin
- Tampered Ledger devices secretly captured owners' recovery phrases
A hardware wallet locked inside a bank vault, never connected to the internet, should be among the safest places to protect Bitcoin. Yet in July 2026, attackers stole cryptocurrency from Coldcard owners without touching their devices, while another operation targeted genuine Ledger wallets modified before reaching customers.
The incidents challenged one of cryptocurrency's most familiar security assumptions: keeping private keys offline is enough to keep funds safe.
In reality, cold wallets protect private keys from many online attacks, but their security still depends on how those keys are generated, how devices are manufactured and what users approve.
How Hackers Stole Bitcoin From Coldcard Wallets That Never Went Online
On July 30, attackers began draining Bitcoin from addresses associated with Coldcard hardware wallets, exploiting a vulnerability introduced years before the thefts occurred.
According to Galaxy Research's investigation, a firmware error dating to March 2021 caused affected devices to generate recovery phrases using insufficient randomness.
Instead of relying properly on dedicated hardware entropy, the software used predictable device and timing information.
Attackers could recreate possible recovery phrases on their own computers, derive corresponding Bitcoin addresses and identify vulnerable wallets through public blockchain records.
By August 4, investigators had linked more than $100 million in losses to the vulnerability, with estimates reaching approximately $130 million when suspected additional attacks were included.
One victim reported losing 18.25 BTC in seven minutes despite keeping the device inside a bank safe-deposit box.
The Coldcard investigation revealed that physical isolation offered no protection once the seed itself became predictable.
Ledger Owners Faced a Different Hardware Attack
In October 2026, Ledger disclosed another threat involving genuine hardware wallets that had been physically modified before resale.
According to Ledger's official incident response, criminals purchased authentic devices, installed concealed components designed to capture recovery phrases during setup and returned them to distribution channels in Southeast Asia.
Once activated, the compromised devices could expose recovery information to attackers.
Ledger maintained that its secure chips, operating system and servers were not compromised. The attack targeted the distribution process rather than exploiting a universal software vulnerability.
Coinpaper previously covered the regional sales suspension, which followed estimates that more than $86 million in cryptocurrency could have been stolen.
Ledger had also experienced a separate Connect Kit compromise in December 2023, when malicious software tricked users of connected decentralized applications into signing transactions.
That earlier incident did not compromise Ledger hardware itself.
How Can Cold Wallet Owners Protect Their Cryptocurrency?
The central lesson is that offline storage protects against particular threats, not every method of private-key theft.
Coldcard has released corrected firmware, but its security guidance emphasizes that updating a device cannot repair a recovery phrase created with vulnerable software.
Affected owners must generate new recovery information under secure conditions and transfer their funds to new addresses.
Ledger's incident reinforces the importance of purchasing hardware directly from manufacturers or trusted distributors and checking for unusual setup behavior.
Users should also verify transaction details on the hardware screen and never disclose recovery phrases, including in response to fake security notices or support messages.
ENRICH your inbox with our best stories
Don’t miss out and join our newsletter to get the latest,
well-curated news from the crypto world!
Adrian Cole
Adrian Cole has spent more than 6 years covering financial markets, with a focus on crypto, equities, and macroeconomic trends. He follows Bitcoin, major altcoins, U.S. stocks, interest rates, commodities, and the data points that move markets. Over the years, he has written hundreds of market updates and analysis pieces, with an emphasis on price action, investor sentiment, and the link between traditional finance and digital assets.
https://coinpaper.com/38810/can-cold-wallets-be-hacked-how-ledger-and-coldcard-owners-lost-crypto-without-going-on
