From Coldcard's $70 Million Offline Heist: How Institutional-Grade Assets Use HSM to Fortify Security

At the end of July 2026, a hacking incident erupted in the crypto industry that shattered the public's conventional understanding of security: Coldcard, a well-known Bitcoin hardware wallet touting "physical isolation and private keys that never leave the device," was swept by hackers in a large-scale attack.

Within just 41 minutes, attackers directly moved over 1,080 BTC from 1,196 Coldcard wallet addresses, resulting in losses of between $70 million and $88.6 million. What is staggering is that the attackers never physically touched a single device throughout the entire operation, and many of the stolen wallets had even been stored offline in safes for years.

Offline does not mean absolutely secure.

This painful case proves once again that the underlying defense line for digital asset security has never depended on whether a device is connected to the network, but rather on whether the physical randomness (entropy) at the moment of private key generation is robust enough, and whether the key storage and approval processes feature financial-grade hardware isolation.

1. Incident Review: The "41-Minute Offline Brute-Force" Triggered by a Firmware Configuration Oversight

Many investors blindly believe that "as long as private keys are stored in offline hardware devices, assets are completely safe." However, the root cause of the Coldcard heist lies in the fact that the fate of the private keys was sealed at the very moment of their generation.

According to an in-depth review by Block's engineering team and on-chain security firms, the vulnerability stemmed from a build configuration logic oversight [1] in a Coldcard firmware update from March 2021:

1. Random Number Generator (RNG) Downgrade: The underlying logic for hardware wallets to generate private keys is to extract physical noise and produce true random numbers (TRNG) with high entropy. However, when generating the root seed, the flawed Coldcard firmware accidentally skipped the hardware random number generator and fell back to a software-based pseudorandom number generator (PRNG) computed from firmware code.
2. Entropy Collapse: The pseudorandom algorithm relied solely on the device's fixed serial number and initialization time registers, causing the private key generation space—which should have been 2^256 (an astronomical, sand-grain-like number impossible to enumerate)—to collapse to only about 2^32 (roughly 4 billion possibilities).
3. Offline Brute-Force and Network-Wide Computation: For hackers, the solution space went from "finding a needle in a haystack" to "a few billion simple enumerations." Attackers only needed to quickly run through all 4 billion mnemonic combinations offline on their own computing power, derive the corresponding public addresses, and compare them against the blockchain ledger. Once a match was found, they could directly broadcast transactions on-chain and sweep the assets from offline wallets in one go.

Just like the Profanity vanity address vulnerability that caused $160 million in losses [2], and the historical event where the Lubian mining pool was cracked due to weak randomness, resulting in the theft of 127,000 BTC (approximately $15 billion) [3]—the scarcity of algorithmic entropy is the most insidious and deadly poison in the crypto world.

2. The Birthplace of Private Keys: From True Random Numbers to Source-Level Security

In cryptography, randomness is the cornerstone of all security rules. Blockchain private keys are derived from mnemonic phrases, which in turn depend entirely on the entropy of the initially generated random numbers.

Ordinary software pseudorandom algorithms (PRNG) are computed based on deterministic mathematical formulas. As long as the initial seed or variables are known, the subsequent "random sequence" can be fully predicted. In contrast, true security must rely on True Random Number Generators (TRNG), which extract pure "physical entropy" by capturing unpredictable physical phenomena such as quantum-scale microscopic noise, circuit thermal noise, or atomic decay.

The Private Key Generation Paradigm of HSM

To eliminate the risk of entropy collapse caused by any logical calculation flaws at the physical source, Cactus Custody refuses to use any software-based pseudorandom models.

In Cactus Custody's architecture, private keys and seeds are generated directly inside Hardware Security Modules (HSM) certified at the highest security levels. The HSM integrates an industrial-grade physical entropy source generator (TRNG), which produces irregular and unpredictable true random numbers through thermal noise at the physical layer. This ensures that the private key generation space possesses full cryptographic strength, mathematically sealing off any possibility of offline brute-forcing or reverse engineering.

3. Key Custody Paradigms: Consumer-Grade Cold Wallets vs. Institutional-Grade HSM Hardware Foundations

Beyond the entropy issue in the generation phase, there is also an essential generational gap between consumer-grade hardware wallets and institutional-grade custody in terms of storage mechanisms.

Inherent Limitations of Consumer-Grade Hardware Wallets

The primary function of ordinary consumer-grade hardware wallets (such as Ledger, Trezor, or Coldcard) is to prevent private keys from being directly stolen by trojans or viruses on internet-connected computers. However, to facilitate backup and migration for average users, the private keys and 12/24 mnemonic words in these devices can essentially be exported or backed up on paper media. Once mnemonic phrases are written down and leaked, photographed, or physically accessed, hackers can replicate the private key on any device.

Financial-Grade HSM Physical Protection

As a professional institutional-grade digital asset custody service provider, Cactus Custody employs the Thales Hardware Security Module (HSM), commonly used by the world's top financial institutions and central banks, as its underlying defense line.

[Consumer-Grade Cold Wallet]

Private Key Generation ──► Stored in Consumer-Grade Chip ──► Mnemonics Exportable/Backup-able ──► Exposed to Physical Contact Leakage/Brute-Force Risks

[Cactus Custody Institutional-Grade HSM Architecture]

TRNG Physical True Random Generation ──► Locked Inside Thales HSM ──► Strongly Marked as "Non-Exportable" ──► Physical Tamper-Proof with Self-Destruct

1. Non-Exportable: In Cactus Custody's Thales HSM, private keys are generated inside the chip and forcibly marked as non-exportable. From birth to use, private keys are physically never able to leave the HSM's security boundary.
2. Sealed Signing Within the Chip: All transaction signing is completed within the HSM's internal secure enclave. Only the legitimate signature results are broadcast outward. Whether through remote networks or firmware extraction, attackers cannot access the private keys themselves.
3. Physical Tamper-Proofing and Self-Destruct Mechanism: The Thales HSM features a military-grade physical protective shell system. Any attempt to attack the HSM through physical disassembly, micro-probe scanning, or environmental anomaly detection instantly triggers the physical protection circuitry, automatically wiping and physically destroying all keys stored within the chip—eliminating any possibility of key theft at the physical level.
4. Multi-Signature Architecture: A multi-signature governance architecture is adopted, ensuring that no single private key can independently move cold storage funds. This eliminates single-point decision-making and significantly reduces the risks of single points of failure and insider malfeasance.
5. Random Private Key Generation: Each address's private key is independently generated by the hardware TRNG embedded in the HSM chip, compliant with FIPS 140-2/3 and NIST SP 800-90 standards. It does not adopt a master-seed derivation architecture (such as BIP32/44 HD Wallet). Keys have no mathematical correlation with one another, eliminating the batch risk of "one breach, total compromise" and eradicating single points of failure at the source.

Conclusion

As renowned cryptography expert Bruce Schneier once said: "Security is a process, not a product." For digital asset custody, no single wallet or technology is a panacea. Defense in depth, multi-signature, and risk diversification are the true endgame of security.

From blind signing attacks (such as the Bybit $1.5 billion incident) to the Coldcard entropy collapse event, the facts have repeatedly proven that as attackers' methods evolve toward offline computational brute-forcing, supply chain poisoning, and sophisticated social engineering, relying on retail-grade consumer cold wallets for managing large assets can no longer cope with the security challenges of today.

Digital asset governance is accelerating toward an era of institutionalization. Cactus Custody will continue to build upon physical HSM hardware as its foundation, combined with a compliant trust framework and SOC/ISO dual audit systems, to provide unshakable, top-tier asset protection barriers for global Web3 institutions, funds, and high-net-worth clients.

References:

[1] Block: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware

[2] 1inch: https://1inch.com/blog/post/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool

[3] Arkham: https://info.arkm.com/research/us-government-btc-seizure-lubian-chen-zhi-pig-butchering