Crypto security at risk: $110 million Bitcoin theft

Bitcoin was created to allow people to send and store money without relying on a bank or other central authority. Instead of keeping funds in an account controlled by a financial institution, Bitcoin owners control their assets using a unique cryptographic key that functions much like an unbreakable password. Whoever possesses that key can access and transfer the cryptocurrency. Lose it, and the Bitcoin is effectively gone forever.

Protecting those keys has therefore become one of cryptocurrency's defining challenges. Millions of investors have turned to “hardware” wallets–small offline devices that generate and store private keys without remaining connected to the internet. Unlike cryptocurrency exchanges, which hold assets on behalf of customers, hardware wallets allow individuals to maintain direct control over their Bitcoin and have long been regarded as the gold standard for digital asset security.

This week, that confidence suffered one of its biggest tests yet.Hackers stole more than 1,755 Bitcoin worth over $110 million after exploiting a flaw in one of the cryptocurrency industry's most trusted hardware wallets. The theft ranks among the largest cryptocurrency heists on record, not because attackers broke Bitcoin's encryption or manipulated the blockchain itself, but because they compromised one of the tools designed to protect it. As banks, investment funds and other financial institutions expand their involvement in digital assets, weaknesses in cryptocurrency infrastructure have become more consequential. The attack has renewed an uncomfortable question. If the safest way to store Bitcoin can fail, what does secure digital asset ownership look like?

A flaw hidden inside the wallet

The attack did not begin with the internet.

At the center of the breach was Coldcard, one of the cryptocurrency industry's best-known hardware wallets. Manufactured by Canadian company Coinkite, the small offline device is designed to generate and store the private keys that give owners control over their Bitcoin while keeping them disconnected from the internet.

When a user first sets up the wallet, it creates a recovery phrase, a sequence of 12 or 24 randomly generated words that serves as a master backup. If the device is ever lost, damaged or stolen, those words can be entered into another wallet to restore access to the Bitcoin.

Investigators found that the software responsible for generating those words contained a flaw. According to Bloomberg, attackers were able to predict some recovery phrases, recreate victims' wallets and transfer the Bitcoin without ever needing physical access to the devices.

That distinction is important. Bitcoin's underlying cryptography remained secure throughout the attack, and the blockchain itself continued to function exactly as intended. Instead, the weakness lay in one of the security tools surrounding the network. The software responsible for creating the digital keys failed before users had even begun storing their assets.

Coinkite later acknowledged the vulnerability and released firmware updates designed to prevent similar attacks.

Crypto crime is entering a new phase

Chainalysis, a blockchain analytics company whose software is used by governments and financial institutions to trace cryptocurrency transactions, argues in its March 2026 Crypto Crime Report that attackers are increasingly targeting the infrastructure supporting digital assets rather than exchanges alone.

TRM Labs, a blockchain intelligence company that investigates cryptocurrency-related crime, reaches a similar conclusion in its H1 2026 Crypto Crime Report. The firm recorded 207 cryptocurrency hacks during the first half of 2026, the highest number ever observed during the first six months of a year. Total losses reached $972 million, down from $2.3 billion during the same period in 2025, suggesting attacks are becoming more frequent even as the average amount stolen per incident declines.

Researchers say criminals are increasingly exploiting weaknesses in hardware, software and cryptographic key generation.

The case for keeping your own keys

The attack has also reopened one of cryptocurrency's oldest debates.

Since Bitcoin's creation in 2009, advocates have encouraged users to control their own assets rather than leave them on exchanges, a practice known as self-custody. Hardware wallets became the preferred solution because they kept private keys offline and out of reach of internet-based attacks.

The Coldcard incident does not invalidate that approach. Hardware wallets remain one of the safest ways to store cryptocurrency. Instead, the attack demonstrates that even offline security depends on the reliability of the technology behind it.

The vulnerability existed before many users had even transferred Bitcoin into their wallets. It originated during the creation of the recovery phrase itself, the foundation of the wallet's security.

Previous cryptocurrency hacks reinforced the industry's advice to move assets off exchanges. This incident challenges another assumption, namely that the device generating the keys can always be trusted.

Why it matters beyond Bitcoin

The implications extend well beyond cryptocurrency enthusiasts.

Digital assets have become more closely connected to mainstream finance. Large investment firms now offer regulated investment funds that allow people to gain exposure to Bitcoin through traditional stock markets without buying the cryptocurrency directly. At the same time, banks, asset managers and payment companies have expanded their involvement in digital assets.

The International Monetary Fund's April 2026 Global Financial Stability Report argues that weaknesses within crypto infrastructure deserve closer attention as digital assets become more integrated with conventional financial markets.

The Coldcard breach illustrates why. Bitcoin itself continued to operate normally throughout the attack. The failure occurred in the technology people relied on to access it safely.

As cryptocurrency becomes more established within the global financial system, confidence will depend not only on Bitcoin's underlying cryptography but also on the security of the infrastructure surrounding it.