$1.6M Bitcoin Gone in Seven Minutes Despite Being Stored Offline in Safes and Safety Deposit Boxes

A Canadian entrepreneur has suffered a devastating loss after hackers drained more than $1.6 million CAD ($1.2M US) in Bitcoin from his offline wallet in just seven minutes. Jonathan Goodman believed his funds were entirely secure. He stored his private keys on a Coldcard hardware wallet kept inside a bank safety deposit box. The device had never touched the internet. His setup was textbook practice for cold storage asset protection.

Yet physical vaults proved useless against a flaw embedded in the device code years earlier.

A Quiet Theft at 9:36 PM

The breach occurred on July 29, 2026. Mr Goodman was relaxing at his family cottage when news of a potential hardware wallet issue began circulating online. Assured that his isolated setup was immune, he logged into his Wasabi wallet software to check his balances. What he saw was terrifying.

Between 9:36 p.m. and 9:43 p.m., lines of red withdrawal transactions swept across his screen. In seven minutes, his entire crypto holding vanished. The hackers drained 18.25245043 BTC from his addresses. 'From 9:36pm - 9:43pm on July 29th, every wallet I had had been emptied. 18.25245043 btc gone. That's just over $1.6 million dollars CAD,' Mr Goodman shared after discovering the loss.

The victim had never shared his seed phrase. He had maintained multiple physical safes. None of it mattered.

The Flaw Inside the Safe

The security failure was not caused by physical theft or online phishing. It traced back to a critical vulnerability introduced in 2021 within older Coldcard hardware wallet firmware.

When hardware wallets create a new wallet, they generate a 12 or 24-word seed phrase. This phrase relies on complex internal entropy to ensure the key is entirely random and unpredictable. However, a specific programming flaw in the firmware caused the hardware entropy generator to fail silently.

Instead of generating true cryptographic randomness, affected devices generated weak, predictable key combinations. Attackers discovered this pattern. Using advanced computational power and artificial intelligence models, hackers brute-forced guessable seed combinations remotely.

They did not need physical access to Mr Goodman's device. They simply recreated his private keys from afar using mathematics and software algorithms.

The Cold Reality of Self-Custody

For crypto investors, the incident highlights a troubling reality. Offline cold storage is widely considered the safest way to store digital assets. Yet physical isolation cannot protect funds if the original key generation process was flawed from day one. Mr Goodman has reported the theft to local law enforcement. He has also filed formal reports with the Ontario Securities Commission. Despite these steps, blockchain transactions are irreversible, making recovery virtually impossible.

Speaking in the aftermath of the event, Mr Goodman expressed his determination to move forward.

'A part of me is trying to make sense of what just happened. Or try to figure out a lesson in it. I'm struggling. $1.6 million is a staggering amount of money to have stolen. I guess all that I can think about right now is that I'm so damn happy that I'm an entrepreneur and that my earning potential is under my control. Mark my damn words. I'll recover.'

The attack serves as a stark warning to self-custody holders worldwide. Security requires not just locking devices in physical vaults, but verifying the integrity of the code that builds them.