A five-year-old build mistake in Coldcard firmware turned a trusted bitcoin hardware wallet into a very expensive lesson in why entropy matters.
- A build flag error forced weak software randomness for seed generation
- Attack waves began on July 30, 2026 and kept spreading
- Loss estimates vary by tracker, from 1, 596 BTC to a possible 2, 055 BTC
- Old seeds are still unsafe even after the emergency firmware fix
The failure was not a flashy remote hack or some phishing circus. It was worse in a way, because it was quiet and boring: firmware shipped in March 2021 contained a configuration error that caused affected Coldcard devices to fall back to a software pseudorandom number generator instead of the hardware entropy source meant to create secure wallet seeds.
That distinction is everything. A bitcoin wallet seed is the root secret that generates the private keys controlling funds. If the seed is weak, the keys are weak. If the keys are weak, the wallet can be brute-forced. “Cold storage” only works if the seed generation path is actually trustworthy.
Block’s technical analysis says the build logic checked whether the MICROPY_HW_ENABLE_RNG macro existed, not whether it was enabled. Because it was set to zero, the firmware quietly used MicroPython’s Yasmarang fallback instead of the STM32 hardware random number generator. Yasmarang is a software-based pseudorandom number generator. That can be fine for casual use. It is not fine for manufacturing the keys to a life-changing amount of bitcoin.
Coinkite’s advisory says the issue affected Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, and also earlier affected Mk4, Mk5, and Q seeds before later fixed releases. Block estimated the resulting entropy at roughly 40 bits on Mk2/Mk3 devices and about 72 bits on Mk4/Mk5/Q devices, while cautioning that the latter should not be treated as full cryptographic 72-bit security.
For non-cryptographers, “bits of entropy” is just a measure of how hard something is to guess. Fewer bits means a smaller search space. Smaller search space means brute force gets cheaper. In other words: bad randomness turns secure-seeming self-custody into a lottery ticket with the numbers already exposed.
The first public sign that someone was exploiting the flaw came on July 30, 2026. According to the reporting, the first wave hit around 2:14 a.m. UTC, sweeping 594 BTC from roughly 500 addresses in about 25 minutes. The transactions used a uniform 30 sat/vB fee rate and no change outputs, which strongly suggests automation rather than a manual scramble.
Within 48 hours, the total had climbed to 1, 082 BTC across 1, 196 addresses. A third wave pushed the confirmed total to 1, 367 BTC across 4, 585 addresses, worth about $89 million. A suspected fourth wave ran through August 4 and may have added another 449 BTC from 709 addresses, which would lift the total to about 2, 055 BTC, or close to $130 million.
Different trackers have used different cutoffs. Galaxy Research said 1, 596 BTC had been stolen across three waves. TRM Labs put the confirmed loss at 1, 816 BTC, or about $116 million. That gap is not unusual in fast-moving blockchain investigations, where attribution, timing, and address clustering can shift as new evidence comes in.
Calling this the largest hardware wallet exploit in crypto history is a reporter’s claim rather than a law of nature, but it is fair to say this is one of the most serious hardware wallet failures ever seen. The important point is not the leaderboard. It is that a single build error undermined the thing people bought hardware wallets to protect: key generation they could trust.
Emergency firmware was released on July 31, 2026, but that does not heal the damage already done. Updating the device fixes future seed generation. It does not repair an old seed created through the broken path. For affected users, the practical advice is blunt: generate a fresh seed on verified firmware and move funds to new addresses.
Coinkite says the dice-roll option can protect users, but only if it was done properly. The company says users must roll dice at least 50 times and enter the results. That works because truly independent user entropy can outweigh the device’s broken randomness. Fewer rolls, sloppy execution, or exposing the process to compromise defeats the point. No, your half-hearted “I rolled a few dice, probably fine” ritual does not magically become cryptography.
There is also an important exception: if a user added enough independent dice entropy, the broken device-generated entropy is no longer the whole story. That is why some wallets created on the vulnerable firmware may still be safe. But if you did not deliberately add enough randomness yourself, you should assume the seed is compromised.
Jonathan Goodman, a Canadian entrepreneur who said he lost 18.25 BTC, worth about C$1.6 million, captured the emotional gut punch with a line that landed hard for anyone who has ever been told to take custody seriously:
“Perhaps the hardest part about this is that I did everything right, ”
That is the ugly part of this mess. People were told to avoid custodians, hold their own keys, and take responsibility. Then a hidden build mistake in firmware wrecked the whole premise. This was not a failure of bitcoin. It was a failure of implementation, and crypto is merciless about those.
Coinkite CEO Rodolfo Novak, or NVK, suggested AI may have helped uncover the bug. He also argued that AI-assisted code review can find latent flaws faster than even seasoned experts. That may be true, but it remains a claim, not a confirmed explanation. The safer takeaway is simpler: if your firmware has ever been public, assume attackers and defenders are both reading it, because they are.
That is why open source is not a magic shield. Andrew Lazutkin, CTO at Tangem, put it plainly:
“This incident is a good example of why open-source firmware should not automatically be equated with better security.”
He is right. Open source helps auditing, but it does not guarantee that anyone audited the right thing, or that the build system did not quietly route around the secure path into a software fallback. Transparency is useful. Security still has to be engineered.
Vincent Bouzon, a Ledger cybersecurity expert, framed the core issue from the hardware side:
“Every wallet ultimately depends on a root secret generated from high-quality entropy. That generation must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.”
That is the heart of the matter. Self-custody is not just about keeping keys offline. It is about making sure those keys were born correctly in the first place.
The market, for once, did not panic as hard as the headlines. Bitcoin traded near $64, 300 through the attack waves and did not break below $63, 800 after the exploit became public. That suggests traders treated this as a hardware wallet disaster, not a bitcoin protocol problem.
But user behavior did shift. On-chain data showed bitcoin flowing back to exchanges after July 31, reversing a trend that had followed the FTX collapse. OKX said it saw record exchange inflows, and its chief compliance officer, Jonathan Brockmeier, said customer behavior changed noticeably. Some people apparently decided that an exchange IOU looked a lot less annoying than managing their own keys after this debacle. Convenient? Yes. Sovereign? Not even close.
That tension is why the ETF crowd immediately had a field day. On August 5, bitcoin ETF inflows hit $211.5 million, led by BlackRock’s IBIT and Fidelity’s FBTC. Bloomberg’s Eric Balchunas summed up the custodial pitch with the kind of line that lands because it is simple:
“An ETF fixes this, ”
It fixes one thing: the operational headache and key-management risk of self-custody. It does not fix ownership. An ETF is still an IOU wrapper. If you want sovereignty, you need self-custody. If you want convenience, you hand over trust. Pick your poison and do not pretend the tradeoff does not exist.
The attack also shows why multisignature setups deserve far more attention than they get from retail holders. Multisig requires multiple independent keys to move funds, so one broken device or one bad seed does not automatically empty the vault. It is more complex, sure. But complexity is sometimes the price of not getting wrecked by a single point of failure.
The trail is not exactly clean. According to the reporting, roughly 90% of the stolen bitcoin remained unmoved at attacker-controlled addresses. Galaxy Research also shared about 600 suspected attacker-controlled addresses with federal investigators, compliance firms, and cybersecurity teams.
Confirmed laundering so far has been limited. The reporting says 64.9 BTC was deposited to Wasabi Wallet’s coinjoin service, and 200 ETH was deposited to Tornado Cash. That second detail may look odd in a Coldcard bitcoin theft, but it just means some of the stolen value was likely swapped or routed through other assets as part of laundering. The point is simple: the attacker is trying to blur the trail, not sprint out in the open like a cartoon villain.
This is not the only weak-randomness mess to hit crypto lately. The separate “Ill Bloom” findings from the Coinspect research group drained more than $5 million from addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon in early July 2026. Different chains, same ugly lesson: bad entropy is a universal problem, not a Coldcard-specific one.
And if anyone wants to wave this away as a niche hardware wallet headache, the broader crypto history offers a grim reminder of what real trust failures look like. FTX lost $8 billion. Mt. Gox lost 850, 000 BTC. Celsius, Voyager, and BlockFi collectively burned billions more. Those were custodial failures, not entropy bugs, but they all point to the same uncomfortable truth: trust is expensive, and sometimes catastrophically so.
Coldcard’s failure is different, but the lesson rhymes. Self-custody is only as good as the hardware, firmware, and process behind it. A slogan is not security. A trusted brand is not security. And a five-year-old build flag hiding in the shadows is definitely not security.
Key questions and takeaways
-
What actually went wrong?
A firmware build error caused affected Coldcard devices to use a weak software RNG for seed generation instead of the intended hardware entropy source. -
Why does this matter so much?
The wallet seed creates the private keys. If the seed is weak, the wallet can be brute-forced even if the device itself was never stolen. -
Can a firmware update fix an old seed?
No. Updating the device fixes future seed generation, but any seed created on the vulnerable path remains unsafe and should be replaced. -
How much was stolen?
Galaxy Research said 1, 596 BTC was stolen across three waves. TRM Labs put the confirmed total at 1, 816 BTC. If a suspected fourth wave is verified, losses could reach 2, 055 BTC. -
Are all Coldcard users affected?
No. The risk depends on the firmware range and whether independent dice entropy was added properly. Coinkite says at least 50 fair, private dice rolls can provide enough user entropy to avoid this RNG failure. -
What should affected users do now?
Install the fixed firmware, generate a new seed on verified software, and move funds to fresh addresses. If you are unsure whether your setup was protected by enough independent entropy, treat it as compromised. -
Does this mean self-custody is broken?
No, but it does mean most people are not ready to manage single-key self-custody safely without backups, verification, and redundancy. Multisig is often the smarter default. -
Is open source enough to make a wallet secure?
No. Open source helps auditing, but it does not stop a bad build configuration, and it certainly does not guarantee secure entropy generation.
Bitcoin does not forgive sloppy randomness, and neither do thieves. If you want the upside of self-custody, you need more than vibes and a shiny metal box. You need verified firmware, real entropy, and a setup that can survive one bad build flag without turning into an expensive obituary.
Further reading
A few relevant technical and background pieces on the entropy failure and its fallout:
- How a five-year-old build flag drained $116 million from Coldcard wallets
- On the Software Fallback RNG: UID and Timer Characteristics
- Firmware Update Advisory for Coldcard Mk2, Mk3, Mk4, Mk5
- How a five-year-old build flag drained $116 million from Coldcard wallets
- How do hardware wallets derive their randomness when it matters most?
- Coldcard Hardware Wallet Flaw Linked to $70 Million Theft
- Bitcoin Faces $512M $70K Bid Wall as Coldcard MK5 Pushes Self-Custody
- Coldcard MK5 Launches as Bitcoin-Only Hardware Wallet with Better Usability and Security
