TRM Labs, a blockchain intelligence firm used by law enforcement and exchanges, disclosed a USD 116 million exploit involving Coldcard hardware wallets, labeling the incident "The Largest Hardware Wallet Exploit of 2026" in a published report.

The figure, if confirmed, would represent the most significant documented theft tied to a hardware wallet manufacturer or its supply chain in the current year. TRM Labs positioned the write-up as an inside look at the attack, though the public headline did not specify the date of the exploit, the attacker's identity, or whether the funds remained under adversary control at the time of publication.

What does a Coldcard compromise change for the segment?

Coldcard is a Bitcoin-only hardware wallet marketed for air-gapped operation and a security-first design. The product has historically appealed to institutional and high-net-worth self-custody users. A breach of this scale tied to the vendor itself, rather than to individual end users, would shift the threat model for the entire hardware wallet category.

TRM Labs' framing — placing the incident above prior documented hardware-wallet losses — carries signaling weight. The firm historically combines on-chain forensics with attribution work for state actors, mixing services, and exchange compromises. Its headline choice signals that vendor-level exposure now outranks individual device losses.

How is TRM Labs categorizing the incident?

Hardware-wallet compromises have historically fallen into three buckets: seed-phrase extraction through supply-chain tampering, firmware backdoors, and physical attacks on the silicon. A loss measured in eight figures suggests compromise at the vendor, distribution, or integration layer rather than at end-user recovery seeds. TRM Labs did not specify in the public summary whether the USD 116 million figure represents funds taken directly from the manufacturer, from downstream users, or from a partner integration.

The disclosure lands as institutional self-custody expands. Spot Bitcoin exchange-traded funds, launched in early 2024, have driven demand for cold-storage infrastructure, and custody providers have leaned on hardware wallet segregation. Vendors competing on security guarantees now face sharper procurement scrutiny.

Where do the operational consequences fall?

Custody operators using Coldcard devices will need to verify firmware versions, audit signing certificates, and reassess the integrity of any devices acquired through secondary channels. Multisignature configurations that isolate Coldcard keys from hot-wallet infrastructure may limit blast radius, but a vendor-level compromise can undermine the trust anchor itself.

Competitors marketing supply-chain audits, reproducible builds, and open-source firmware may pick up institutional demand. Ledger, Trezor, and Foundation Devices have each promoted varying degrees of transparency; the Coldcard disclosure is likely to sharpen those procurement criteria.

Regulators are unlikely to stay silent. The U.S. Treasury's Office of Foreign Assets Control and FinCEN have increased scrutiny on digital-asset custody in 2025 and 2026, particularly around sanctions-exposed counterparties. A breach of this scale invites inquiry into whether hardware-wallet vendors meet operational-resilience standards applied to custodial infrastructure providers.

What comes next?

The disclosed figure puts 2026 on track to exceed prior years' documented hardware-wallet losses. Watch for the manufacturer's formal incident response, any law-enforcement referral from TRM Labs, and on-chain tracing of the stolen funds as the next data points that will determine the operational fallout for the segment.