Key Takeaways
- Coldcard-linked thefts drained bitcoin from hundreds of wallets on July 30.
- Coinkite says Mk3 seeds had about 40 bits of entropy instead of 128.
- Coldcard users must install fixed firmware and create new seeds before moving funds.
According to a deep analysis from Galaxy Research, the core theft unfolded in a tightly coordinated burst lasting about 25 minutes, while broader analysis later connected roughly 1,196 addresses and as much as 1,083 bitcoin, valued at nearly $70 million, to activity spanning approximately 41 minutes. The final figures could change as investigators continue tracing transactions on the public Bitcoin blockchain.
A 5-Year-Old Bug Reaches Bitcoin Wallets Worldwide
The affected wallets belonged largely to long-term holders who generated their recovery seeds using Coldcard devices running vulnerable firmware released from March 2021 onward. Coldcard is an air-gapped hardware wallet made by Canadian manufacturer Coinkite and designed to keep bitcoin (BTC) keys isolated from internet-connected devices.
Many of the emptied addresses had remained dormant for years. The attacker moved rapidly, paid elevated fixed transaction fees, and left no change outputs, meaning each address was emptied completely. That pattern suggested an automated operation using a prepared list of private keys rather than customers independently moving their funds.
The theft was not caused by phishing, malware on a user’s computer, physical device theft or a conventional remote breach. Instead, a firmware error weakened the randomness used when some Coldcard devices created wallet seeds. Those seeds looked normal but came from a far smaller range of possible combinations than users had been promised.
Coldcard’s Random Number Generator Quietly Failed
A Bitcoin wallet seed is a secret, commonly displayed as 12 or 24 words, from which the wallet generates its addresses and private keys. A properly generated 12-word seed contains 128 bits of entropy, a technical measure describing an enormous number of possible combinations that makes guessing the seed effectively impossible.
Coldcard devices were supposed to obtain that randomness from a hardware random number generator inside the device’s microcontroller. The component draws from physical electrical noise that an outside observer should not be able to predict.
During a software-library migration in 2021, however, Coinkite disclosed that two random-number functions with matching interfaces became confused. One accessed the device’s proper hardware generator. The other was a weak software fallback intended for boards without suitable hardware.
A configuration setting disabled the default MicroPython hardware path because Coinkite supplied its own hardware wrapper. The software checked only whether that setting existed, not whether it was enabled. Because the setting was present but assigned a value of zero, the build completed successfully, while seed generation silently shifted to the weaker software generator.
Factory Data and Timing Replaced True Randomness
That fallback relied heavily on predictable device information, including a chip identifier similar to a serial number and internal clock values associated with startup timing. An attacker who could narrow those inputs would face a much smaller search than the 128-bit range expected from a securely generated seed.
Coinkite estimated the effective search space for vulnerable Mk3 seeds at about 40 bits under current assumptions. That is still a large number of possibilities, but it can be searched with specialized computing equipment, especially when an attacker can compare candidate seeds against bitcoin addresses visible on the blockchain.
Later Coldcard models, including the Mk4, Q and Mk5, added some randomness from a secure element. However, only a limited portion reached the affected generator, leaving an estimated 72 bits of effective entropy on seeds created before corrected firmware was installed. That was stronger than the Mk3 path but still below the intended 128-bit standard.
The difference is similar to replacing a truly random lock combination with one derived from a lock’s serial number and the time it was first switched on. The resulting combination may look random, but someone who knows the formula and can estimate the starting information can reproduce it. Many users are migrating, not only from Mk3 devices, but from Mk4, Q, and Mk5 as well.
Coinkite Tells Users to Create Entirely New Seeds
Coinkite released security advisories and corrected firmware after becoming aware of the active threat. The company said users who generated seeds on affected firmware should create a completely new seed using a fixed version and transfer their bitcoin to addresses controlled by that seed.
Installing the update alone is not enough. A seed created under the flawed system remains weak permanently because the firmware update cannot add randomness to words that already exist.
Coinkite advised users to update their device, create a new seed, verify the backup and wallet fingerprint, confirm the receiving address, send a small test transaction, and then move the remaining balance. Users should retain the old backup until the transfer is confirmed, but should no longer treat the old seed as secure.
The company identified fixed releases including Mk3 version 4.2.0 or later, Mk4 and Mk5 version 5.6.0 or later, and Q version 1.5.0Q or later, along with corresponding Edge versions. Tapsigner, Opendime, and Satscard products use different code and were reportedly not affected.
Added Security Protected Some Coldcard Owners
Users who added enough independent dice rolls when generating a seed were substantially protected because their own randomness overwhelmed the defective software input. Coinkite said at least 50 private rolls of a fair die provided adequate protection from this issue, though additional rolls can provide a wider safety margin.
A strong BIP-39 passphrase also creates a separate wallet that cannot be reconstructed from the seed words alone. Multi-signature wallets, which require keys from multiple devices or locations before bitcoin can move, were largely or fully protected when the vulnerable Coldcard seed represented only one part of the signing arrangement.
Those safeguards were optional, however. Many victims appear to have followed the standard security advice available at the time: Buy a respected hardware wallet, generate the seed offline, protect the backup, and never enter it into an internet-connected device.
Coinkite Accepts Blame as Debate Turns to AI
Coinkite CEO Rodolfo Novak, widely known as NVK, apologized publicly on July 31 and said the company accepted full responsibility for the firmware failure. “I’m sorry and I’m devastated. Our team is heartbroken about yesterday’s news,” Novak wrote. He acknowledged that the hotfix secures newly created seeds but cannot repair seeds generated under vulnerable software.
Novak explained that Coinkite would publish a full technical account after verifying the details and assist affected users seeking police reports, insurance claims or independent investigations. He also warned developers that artificial intelligence (AI) tools can now scan old public code for hidden weaknesses faster than traditional review processes may detect them.
Coinkite stressed it must assume an attacker used AI to inspect its open-source firmware, though no evidence has established how the flaw was discovered. The company also acknowledged that a recent review performed with a leading AI model failed to identify the problem. Several competitor hardware wallet manufacturers have taken to social media to note that their products are not affected.
“Ledger is not affected by the recently published Coldcard Mk3 advisory,” the company told X users after the Coldcard incident. “Ledger devices use a certified True Random Number Generator (TRNG) built directly into our Secure Element chip, generating full 256 bits of entropy for every 24-word Secret Recovery Phrase.”
“Trezor users: your funds are safe,” the hardware wallet maker Trezor explained on Friday. “The recent Coldcard issue is limited to their own custom firmware and how some of their devices generated randomness. Trezor does not share that code.”
The Trezor X account added:
“We have always mixed multiple independent sources of randomness together (device hardware + host + secure elements on newer models). We are truly sorry for everyone who has lost bitcoin.”
What Coldcard Users Should Watch Next
The attacker’s identity remains unknown, and the stolen bitcoin could move from its consolidation addresses at any time. Investigators are still working to determine how many vulnerable seeds were actually generated, how much bitcoin remains exposed, and whether additional high-value wallets have already been identified by the attacker. However, Coinkite may not have much info on owners from long ago.
“Fun double-edged sword: Coinkite purges all their customer records after 120 days to protect against data breaches,” the co-founder of Casa, Jameson Lopp, reported on X. “Which means they are unable to reach out to customers who bought vulnerable coldcards over the past 5 years to warn them of this vulnerability.”
The incident will also test whether Coinkite can restore confidence in Coldcard and whether hardware-wallet makers adopt stronger independent reviews of seed generation. For users, the immediate priority is simpler: Anyone who created a seed on affected firmware without strong independent dice entropy, a passphrase, or multisignature protection should treat it as compromised and move funds carefully to a newly generated wallet.
Beyond the devastating theft, bitcoiners across the community are sounding the alarm and pushing others to spread the word before more vulnerable wallets are emptied.
