Coldcard did not break Bitcoin. A bad randomness path in its firmware did.
- Seed generation failed, not the Bitcoin network
- Offline storage still mattered, but only up to a point
- Weak entropy is still one of crypto’s dumbest recurring failures
That is the ugly lesson here. A hardware wallet can stay offline, sit in a safety deposit box, and still fail catastrophically if the seed phrase was generated with weak entropy. The break happened before the wallet ever became a wallet in any meaningful security sense.
On the evening of July 29, Jonathan Goodman discovered his Bitcoin wallets had been emptied. His coins had been stored on a device that was never connected to the internet. The loss was reported at 18.25245043 BTC, roughly $1.6 million Canadian.
The problem traces back to Coldcard Firmware Update Advisory for Mk2, Mk3, Mk4, Mk5 released in March 2021. According to Coinkite’s advisory, a build-flag check in the cryptography code tested whether a setting existed rather than whether it was actually enabled. That mistake pushed seed generation onto a fallback software randomness path seeded from the chip’s serial number and timer state.
In plain English, the wallet stopped using the good source of randomness and fell back to a weaker one. Serial numbers and timer state are not the kind of raw entropy you want protecting serious money. They are too predictable, too constrained, and too easy to reduce into a brute-forceable search space if an attacker knows what went wrong.
Coinkite says the issue affected several Coldcard firmware lines. For Mk2 and Mk3, the vulnerable range was 4.0.1 through 4.1.9 inclusive. For Mk4 and Mk5, it applied to firmware before standard 5.6.0 or Edge 6.6.0X. For Q, it applied before standard 1.5.0Q or Edge 6.6.0QX.
That matters because this was not a single-model embarrassment. It was a firmware assurance failure that reached across product lines. The brand name changed, but the underlying lesson did not.
Coinkite’s backgrounder also makes an important distinction: user-supplied dice rolls were not stripped out of the process. In other words, if a user added enough independent, private entropy, that could still protect the seed. Coinkite says 50 to 98 private rolls provided at least 128 bits of entropy, and 99 or more rolls provided about 256 bits.
That is the difference between a fatal shortcut and a survivable setup. A seed phrase is not just a backup phrase. It is the root from which all wallet keys are derived. If the randomness used to create it is weak, the keys can be guessed or reconstructed later, even if the wallet never touches the internet.
Block’s engineering team published a line-by-line technical analysis of how the fallback was reached. Galaxy Research documented 1, 367.05 BTC transferred from a cluster of addresses, worth about $88.6 million at the time. The exact address breakdown matters less than the point itself. Real money moved on-chain after a weakness in seed generation was exploited.
Coinkite moved quickly, published an advisory, and shipped a fix within days. Rodolfo Novak said the company takes responsibility, and he was blunt about the limit of the patch: the update removes the faulty path, but it cannot repair a seed already born from it.
That is the part people want to skip past. Firmware can be updated. A compromised seed cannot be un-created. If the random source was bad when the seed was made, the damage is already baked in.
So no, this was not a failure of cold storage itself. Cold storage worked. Air-gapping worked. The critical failure point was seed generation, which happened before the device ever needed to face the outside world. Offline is good. Offline with garbage entropy is just a more elegant way to lose funds.
The practical advice is straightforward, and it should be taken seriously. According to Coinkite, if your seed came from an affected Mk3 running firmware 4.0.1 through 4.1.9 without dice rolls or a strong passphrase, treat it as compromised. If you are unsure whether enough independent entropy was added, assume migration is necessary.
Do not restore a suspect recovery phrase onto another wallet and assume that solves the problem. It does not. If the seed itself is the issue, moving it somewhere else is just rearranging the furniture while the house is on fire.
The safer path is to update the device, generate a fresh seed, verify the backup, send a small test transaction, and then move the balance. That sequence matters. A test transaction is cheap insurance. Guessing wrong with a full balance is a very expensive hobby.
A strong, unique BIP-39 passphrase can also add another barrier. For readers who do not live and breathe wallet jargon, that is an extra secret layered on top of the recovery phrase. It does not fix a bad seed, but it can make a thief’s life harder if the passphrase is truly strong and kept private.
Coinkite also said that TAPSIGNER, OPENDIME, and SATSCARD were not affected, because they use different codebases. That distinction matters. Not every Coldcard-branded device shared the same failure mode, and not every product in the lineup was part of the blast radius.
Stefan Lauer, head of infrastructure at SimpleSwap, put the larger problem in plain terms:
“Randomness is the least glamorous line in any crypto product, and it is the only one that cannot be fixed later. The industry pours its attention into the parts users can see. The parts they never see are where the money actually lives.”
That is exactly right. Users look at the metal case, the screen, the UX, the “secure” label. Attackers look at the hidden stuff: entropy, fallback logic, key generation, supply-chain assumptions, and whatever lazy little shortcut some engineer hoped nobody would notice. The visible parts are marketing. The invisible parts are security.
Kraken security chief Nick Percoco pointed to another uncomfortable truth: certification can show that an approved component is present, but it does not necessarily prove that the approved entropy path is the one actually running. That is a huge gap. Compliance is not the same thing as live operational verification, and pretending otherwise is how people get wrecked.
This is also why recovery scammers move in fast after incidents like this. Let’s make this absolutely clear: no legitimate party will ever ask for your recovery phrase. If someone does, they are not support. They are a thief with a help-desk script.
The Coldcard failure is not even the first time weak randomness has drained bitcoin. The broader pattern is depressingly familiar. In 2013, a flaw in Android’s random number generator helped drain bitcoin from mobile wallets. Between 2011 and 2015, a widely reused JavaScript library relied on browser randomness that was never meant for key generation. In 2022, a browser extension generated recovery phrases from a 32-bit seed. A command-line tool later made nearly the same mistake.
Different tools. Same basic failure mode. Randomness gets treated like an afterthought until someone loses a stack and everyone suddenly discovers how central entropy was all along.
That is why “hold your own keys” is necessary but not sufficient. Self-custody is not a slogan you repeat once and then stroll away with a victory cigar. It is a discipline: trustworthy entropy, sound firmware, verified backups, a sensible passphrase if you use one, and a migration plan when something goes wrong.
Physical isolation is valuable. Cold storage reduces attack surface. But none of that matters if the seed was born broken. A wallet is only as strong as the randomness that created it, and that is one of the least glamorous truths in Bitcoin security.
- Was Bitcoin itself hacked?
No. The Bitcoin network was untouched. The failure was in Coldcard’s seed generation, not in Bitcoin’s cryptography. - Did air-gapped storage fail?
No. The device could stay offline and still generate a weak seed. The critical failure point was earlier, during seed creation. - Can a firmware update fix an old compromised seed?
No. It can remove the bad code path going forward, but it cannot repair a seed that was already generated badly. - What should affected users do?
Per Coinkite, update the device, generate a fresh seed, verify the backup, test with a small transaction, and then move the balance. If you are unsure about the original entropy, assume migration is needed. - What is the real takeaway for self-custody?
Offline storage helps, but seed generation, entropy quality, and firmware integrity matter just as much. “Hold your own keys” is the first step, not the last.
The plumbing underneath self-custody is where the money lives. When that plumbing gets sloppy, the market eventually sends a bill.
Further reading
A few additional sources that help map the security failure and the fallout around it.
- What the Coldcard Incident Actually Broke, and What It Left
- Consent Page
- Mk3 Security Advisory
- How do hardware wallets derive their randomness when it
- Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep
- Coldcard flaw tops $100M as David Schwartz warns
- Coldcard firmware bug may have exposed Bitcoin holders to
- Bitcoin Faces $512M $70K Bid Wall as Coldcard MK5 Pushes
