594 BTC Gone in 25 Minutes: The Coldcard Flaw That Made Seed Phrases Guessable

Hardware wallets are supposed to remove a single category of risk: the possibility that someone who is not you can compute your private key. Early this morning, roughly 500 Bitcoin holders discovered that their devices had failed at exactly that job, and had been failing quietly since March 2021.The loss came to about 594 $BTC, roughly $38 million, and it took 25 minutes.Bitcoin Wallet Hack: What exactly happened?Between 01:31 and 01:56 UTC on Friday 31 July 2026, an attacker swept funds out of around 500 separate Bitcoin wallets. The mechanics were industrial. More than 1,300 individual UTXOs were moved across 500 transactions inside a three-block window, then 562 BTC was consolidated into a single address. At the time of writing, that address has not moved.The victim profile is unusually consistent:Every drained wallet was single-signature.Every one held more than 0.15 BTC.Most had been dormant for years.Wallet creation dates spanned 2021 to 2026, closely matching the window during which the flaw was live.That last point is the tell. The attacker was not picking targets by observing the network. The targets were determined by when each wallet was created.How did the attacker gues...