Coldcard Firmware Flaw Let Hackers Steal $89M in Bitcoin

A major security incident has hit Coldcard, one of Bitcoin's best-known hardware wallets, after attackers exploited a long-standing firmware weakness that produced predictably weak wallet seeds. Across three attack waves, roughly 1,367 BTC—about $89 million—was stolen from thousands of addresses. The theft did not rely on phishing, exchange compromise, or physical access to devices; it targeted the wallet's internal key-generation process, enabling private keys to be reconstructed offline and funds swept on-chain. Attack timeline: three rapid waves The first drains began on July 30, 2026. In Wave 1, about 594 BTC (around $38 million) was taken from roughly 500 wallets in about 25 minutes, with the attacker prioritizing the highest-value targets. Chainalysis said more than $30 million was collected in the first 10 minutes, and one wallet lost about $1.8 million. Wave 2, later the same day, lifted losses to about 1,082 BTC (roughly $70 million) across 1,196 addresses over a 41-minute window, according to reporting tied to Galaxy Research and others. By August 2, after three waves, cumulative losses reached about 1,367 BTC (around $89 million) across 4,585 addresses. Galaxy Research later flagged roughly 600 suspected attacker addresses and shared them with investigators, compliance firms, and security teams. Researchers also noted similar operational patterns in Waves 1 and 2, while Wave 3 used different collection behavior—raising the possibility that more than one actor exploited the same weakness. What failed: seed generation entropy collapsed The core issue was insufficient randomness during seed generation in certain Coldcard firmware versions. A March 1, 2021 code change switched seed generation from ckcc.rng_bytes (fed by the STM32 hardware random-number generator) to ngu.random.bytes, a software-based PRNG. The PRNG drew from deterministic inputs such as device serial/UID, timer values, and prior RNG call history, then hashed them (SHA256d). Hashing can mix inputs, but it cannot create new entropy. Coinkite's advisory indicates that for Mk2 and Mk3 devices, seeds generated after the change had only about 40 bits of entropy—far below the 128-bit security level typically expected for Bitcoin seed generation. For Mk4, Mk5, and Q devices, added input from a secure element raised effective entropy to roughly 72 bits, still below the expected standard. The issue shipped in firmware v4.0.0 on March 17, 2021 and persisted for about five years—surviving multiple releases, reviews, and even an AI-assisted audit conducted weeks before the theft, according to coverage cited in the source materials. How the theft worked: offline reconstruction and brute force Attackers did not need to access victims' devices. With a constrained input space (for example, device identifiers and timing-related state), an attacker could reproduce potential seed streams offline, derive corresponding Bitcoin addresses, and compare them against public blockchain data. Once a candidate seed matched an address holding BTC, the attacker could generate the private key and sweep funds. With roughly 40 bits of entropy, the search space is about 2^40 (around one trillion) possibilities—large, but within reach for modern compute, especially when narrowed to likely Coldcard-generated addresses created during the vulnerable period. Block, Jack Dorsey's company, separately described aspects of the design as a "dangerous fail-open structure," noting certain boot conditions could reduce the search space to 2^32 values. There has not been confirmed at-scale exploitation of that specific weakness. Who is affected: model and firmware at seed creation matter Exposure depends on the firmware that generated the seed—not the firmware currently installed. Updating firmware does not fix a weak seed that already exists. High risk - Mk2 / Mk3 seeds generated on v4.0.0 / v4.0.1 through v4.1.9 (~40 bits entropy). These seeds have been actively exploited. Residual risk - Mk4 / Mk5 seeds generated before v5.6.0 (standard) or before v6.6.0X (Edge) (~72 bits effective entropy). - Q seeds generated before v1.5.0Q (standard) or before v6.6.0QX (Edge) (~72 bits effective entropy). Coinkite later expanded its advisory to include Mk4, Mk5, and Q as also having reduced entropy prior to patches. Important mitigations - Users who added at least 50 independent, private dice rolls during seed setup introduced genuine external entropy that compensates for the PRNG weakness; Coinkite says those users face minimal risk from this specific bug. - A strong BIP39 passphrase can make brute forcing harder, but it does not repair the underlying seed weakness; guidance still favors migration for seeds generated on affected firmware. - For multisig, risk depends on whether weak keys can meet the signing threshold. Security researchers have urged rotating any affected Coldcard-derived keys. Coinkite response and criticism Coinkite issued its first public security advisory on July 30–31, about 30 hours after the initial sweep started, and released patched firmware across product lines (including v4.2.0 for Mk3, v5.6.0 for Mk4/Mk5, and v1.5.0Q for Q). The company published technical details and a migration guide, and updated its advisory on August 1 to reflect broader impact on newer models. Criticism has focused on the five-year detection failure and the delay in public warning while the sweep continued. What affected users should do A firmware update alone is not sufficient if your seed was created on vulnerable firmware. The recommended remediation is: 1) Update to the latest patched firmware for your model, downloaded and verified from Coinkite's official site. 2) Generate a completely new seed on patched firmware (do not restore the old seed). Consider adding at least 50 private dice rolls. 3) Verify your seed backup and confirm receive addresses on-device match wallet software. 4) Move all BTC from old-seed addresses to addresses derived from the new seed (expect on-chain fees). 5) Confirm transactions on a reliable block explorer and verify old addresses are empty. 6) Securely destroy all copies of the old seed only after you have verified full access to the new wallet. Multisig users should rotate every affected key, validate the updated multisig policy, and only then migrate significant funds. Industry context The incident underscores that self-custody security depends not only on keeping keys offline, but on generating them with high-quality randomness—something ordinary users cannot easily verify. It also follows prior key-generation RNG failures in crypto, including Milk Sad (2023) and Ill Bloom (2026). Separate reporting noted the event could influence some investors toward Bitcoin ETFs, which trade personal key-management risk for reliance on custodians. Q&A (key points) - Is my Coldcard compromised? If you generated a seed on Mk2/Mk3 using v4.0.0 through v4.1.9 without sufficient dice-roll entropy, treat it as exposed. Mk4/Mk5/Q seeds created before patches carry reduced entropy risk. - Does updating firmware fix it? No. Updating only protects future seed generation; you must create a new seed and move funds. - Are Ledger/Trezor affected? No. Ledger, Trezor, and Block (Bitkey) say they use different entropy-generation methods. - How much was stolen? As of August 2, 2026: about 1,367 BTC (~$89 million) across three waves, impacting 4,585 addresses. - Who is the attacker? Unknown. Galaxy Research suggests Waves 1 and 2 may share an operator; Wave 3 behavior differed. - Do dice rolls protect me? Yes, if you used at least 50 independent, private dice rolls during seed generation. This material is informational and does not constitute financial, legal, or security advice.