According to CoinMeta, a flaw in a single line of firmware code in the Coldcard hardware wallet led to the theft of 1,816 BTC (approximately $11.6 million). Attackers successfully cracked the weak random seed within 41 minutes, affecting over 5,200 addresses. This incident represents the largest hardware wallet vulnerability in the history of cryptocurrency, forcing the self-custody model for Bitcoin to face scrutiny of its security code. The private keys generated by the Coldcard were compromised due to the firmware flaw; attackers did not need physical access to the devices but only had to generate candidate seeds and compare them with the blockchain addresses. This vulnerability persisted since the release of firmware version 4.0.1 in March 2021 until a emergency fix was implemented on July 31, 2026. As a result of this incident, Bitcoin funds flowed back into exchanges, and there is now a call for independent audits of hardware wallet manufacturers.