Coinkite promises post-mortem after Coldcard wallets hack

Coinkite, the company behind the Coldcard Bitcoin hardware wallet, says it will publish a comprehensive research report on the security incident that lasted several days. For now, the company is making no statements about the extent of the damage to affected users. External research estimates total losses at approximately $130 million.

Bitcoin is available at OKX and Bybit.

In short:

• Coinkite is working on a post-mortem after a hack on the Coldcard Bitcoin hardware wallet via a software bug.
• The company is helping affected users but is not estimating losses itself for now.
• External research points to total damage of around $130 million.

Hack via software bug affects Coldcard users

The Coldcard is a popular hardware wallet specifically designed for storing Bitcoin. Coinkite reports via Bloomberg that a software bug caused the security incident, during which attackers had access for several days. The company says in a written statement that it is fully focused on supporting affected users.

The company does not want to speculate on exactly how much was stolen. That is for a technical reason: the privacy-focused design of the Coldcard makes it impossible for Coinkite itself to check or confirm external estimates from outside. As a result, the company cannot verify the amounts cited by researchers.

Estimated damage reaches $130 million

Although Coinkite itself does not cite figures, external researchers estimate damage of around $130 million. That is a substantial amount, especially in the context of a market where physical and digital attacks on crypto holders already caused major losses earlier in 2026. Bitcoin is trading at $65K at the time of writing, up 0.5% over the past 24 hours.

Coinkite says the post-mortem will only be published once the full internal investigation has been completed. Until then, the company does not want to draw half-baked conclusions about the exact sequence of events. It is not yet known when that report is expected. Users who believe they have been affected are encouraged to contact the company.