Toronto-based firm loses US$140 million of customer cash to scammers — and they're not getting it back. Protect your portfolio now

In the span of a few days, hackers targeting a vulnerability in Coldcard, a bitcoin-only hardware wallet made by Coinkite, made off with 1,596 bitcoin from around 7,300 addresses, worth about US$140 million (C$195 million) in total.

Based in Toronto, Coinkite’s worst-hit customers were Canadians, who bore about 25% of losses.

But the remarkable part of this story is how little of the stolen bitcoin has moved since the attack. Much of it is still sitting in the same four addresses.

Hackers could move the spoils, but they have only transferred about 30 bitcoin as of August 13.

Everything is sitting in plain sight — and there’s nothing anyone can do about it.

A shortcut to randomness

Coinkit’s popular hardware wallet Coldcard aims to “secure your bitcoin,” according to the company’s website. One of the major features it boasts is that each device can store bitcoin offline, meaning that it wouldn’t be exposed to online attacks.

This differs from “hot” wallets, which are always online and intended for daily use. The Coldcard was marketed as physical “cold” storage for long-term ownership, and that offline feature was supposed to protect users from hackers.

But a critical flaw — dating back to a firmware update from 2021 — changed that.

The root of that vulnerability was a change in how certain versions of Coldcard devices generated “seed phrases” — sequences of random words that store the data necessary to access cryptocurrency. Well, in theory, they are meant to be random.

Instead of using the device’s own random-number generator, the firmware error used a software-based generator, which is far less random. In some cases, seed phrases were generated using predictable values, including the serial number of some devices.

That shortcut allowed the hackers to reconstruct private keys and wallet addresses offline, without ever having to touch a device.

The ‘fallacy’ of offline crypto

Once the attacks started, it only took 25 minutes for hackers to steal US$38 million (C$53 million) in bitcoin. In less than an hour, they had nearly doubled that number. Over several more days, the hackers kept at it until the estimated losses grew to as much as US$111 million (C$154.7 million).

And then, just as quickly as they appeared, they were gone. But the fallout is still ongoing.

Despite releasing a patch to fix affected devices, Coinkite is already facing public scrutiny and a potential lawsuit from victims of the hack. The company still won't estimate how much was actually lost in the attacks.

“I’m sorry and I’m devastated,” Coinkite CEO Rodolfo Novak wrote on X. “Our team is heartbroken about yesterday’s news.”

Experts were quick to point out the bigger lesson of the hack.

“It exposes the fallacy of your crypto being offline,” Aneirin Flynn, CEO of cybersecurity firm Failsafe, said to Bloomberg.

“The device is just responsible for generating your passwords,” she added. “If the underlying math is broken, then your passwords can be reverse-engineered.”

What’s worse, crypto has become an increasingly popular investment vehicle. This means some people may have lost not only their money, but part of their future, too.

Take charge of your investing

If you’re looking to take charge of tomorrow, investing smartly and securely is the best course for most Canadians. Legendary investor Warren Buffett has famously encouraged retail investors to stick to a fund tracking the S&P 500, and remained cold on crypto as an asset.

But his logic for the S&P is simple: By spreading out your risk among some of the best and brightest, you reduce your overall risk. And, although there can be yearly swings, over time the S&P has continued to climb.

To get started, you can open a self-directed investing account with Questrade.

With commission-free trades on stocks and ETFs listed in Canada or the U.S., Questrade is one of Canada’s leading discount brokerages for self-directed investors who want to build their portfolios without being burdened by fees.

Open a self-directed investing account today with as little as $250 and get $50 cash back.

And, if you really do want to keep on with crypto, you can even buy crypto ETFs, which combine the upside of investing in crypto while minimizing its risks through working with a reputable party.

Canadians have many brokerages to choose from in 2026. Here’s a comparison of the seven best Canadian brokerage firms.

Keep yourself informed

Once you’ve started trading on your own, you’ll also want to keep informed. Understanding your corner of the market — whether crypto or otherwise — can be one of the best ways to build your portfolio as safely as possible, although all investing inherently carries risk.

For those who want stock tips at a moment’s notice, there are online stock analysis platforms like Motley Fool’s Stock Advisor, which offers expert insight to help make smart investing decisions.

With Stock Advisor Canada, you get a long-term investing view that encourages investors to buy stocks that perform well over the long term. You also receive their monthly stock recommendations and “Best Buys Now” picks.

Plus, if Stock Advisor Canada isn’t for you, cancel within 30 days and get your membership fee back. No questions asked.

Not sure if Stock Advisor Canada is worth it? Check out this review.

The benefits of a managed portfolio

For some people, doing the math on their finances alone is hard, let alone weighing the risk associated with an investment such as crypto. If you know you should be investing but don’t want the guesswork of doing it alone, Wealthsimple Portfolios offers an easy, hands-off way to grow your money.

Their pre-built portfolios are tailored to your retirement goals, risk tolerance and investment horizon, so whether you’re saving for retirement, a home or building long-term wealth, there’s a portfolio that’s right for every investor.

Expert-managed and designed to weather market ups and downs, Wealthsimple takes care of the heavy lifting: automatic contributions, dividend reinvesting and smart rebalancing keep your investments on track.

You can invest through RRSPs, TFSAs or non-registered accounts, all from an intuitive online dashboard or their easy-to-use mobile app.

Trusted by more than three million Canadians, Wealthsimple manages over $100 billion in assets and provides $1 million in eligible coverage through the CDIC for chequing accounts and CIPF for investments. Plus, as licensed fiduciaries, Wealthsimple's advisors must put your financial interests first.

As a Money.ca reader, get a $25 bonus when you open your first account and fund at least $1 within 30 days.