Coldcard hack explained: how a 5-year firmware bug made weak seeds and let attackers drain $89M in Bitcoin. See which models are at risk and how to migrate.
Author: Kritika Gupta
The Coldcard hack exposed a critical flaw in one of Bitcoin’s most trusted hardware wallets. During three attack waves, attackers exploited weak seed generation in affected firmware and drained approximately 1,367 BTC, worth around $89 million, from thousands of addresses.
Unlike a typical phishing scam or exchange breach, this attack targeted the wallet’s internal key-generation process. Specifically, a five-year-old firmware bug produced seeds with insufficient randomness, allowing attackers to reconstruct private keys offline and sweep user funds. Therefore, this article explains how the vulnerability worked, which Coldcard models face risk, and what affected users should do next.
On July 30, 2026, the Coldcard hack began when an unknown attacker started draining Bitcoin from Coldcard hardware wallets. During the first wave, 594 BTC, worth approximately $38 million, vanished from around 500 wallets in just 25 minutes. The attacker targeted the highest-value wallets first. A second wave pushed the losses to 1,082 BTC, worth roughly $70 million, across 1,196 addresses within 41 minutes. By August 2, three attack waves had drained a combined 1,367 BTC, worth approximately $89 million, from 4,585 addresses.
The attacker did not select wallets randomly. According to Chainalysis, the operator prioritized the richest targets and collected more than $30 million during the first 10 minutes. One wallet alone lost approximately $1.8 million. This pattern suggests the attacker had already identified valuable addresses and executed the theft in a deliberate sequence.
Meanwhile, the broader sweep continued for nearly 30 hours before Coinkite published its first public warning. Galaxy Research later identified approximately 600 suspected attacker addresses and reported them to investigators. The research firm also found similar operational patterns across the first two waves, while the third wave used different collection methods.
Most importantly, the Coldcard hack was not a phishing attack, an exchange breach, or a case of someone physically stealing users’ private keys. The attacker never needed direct access to the affected Coldcard devices. Instead, the wallets generated weak seeds when users initialized them, which allowed the attacker to reconstruct private keys offline.
That distinction makes the incident especially serious. Users bought Coldcard devices to isolate their Bitcoin keys from online threats. However, the hardware generated those keys with insufficient randomness. In other words, the product designed to protect users created the vulnerability itself. The security failure existed from the moment the affected wallets generated their seeds.
Coldcard Firmware Vulnerability and Bitcoin Theft Timeline
| Date | Event | Source |
|---|---|---|
| Mar 1, 2021 |
A firmware commit changes seed generation from
ckcc.rng_bytes, which used the hardware RNG,
to ngu.random.bytes, a software PRNG.
|
Coinkite advisory; Block analysis |
| Mar 17, 2021 | Firmware v4.0.0 ships with the broken code. Every Mk2 and Mk3 seed generated from this point forward has approximately 40 bits of entropy. | Coinkite advisory |
| 2021–2026 | The bug persists through five years of firmware updates, security reviews, and an AI-assisted audit. None detect it. |
crypto.news; Bitcoin Magazine |
| July 30, 2026 Approximately 12:00 UTC | Wave 1: The attacker drains 594 BTC, worth approximately $38 million, from around 500 wallets in 25 minutes. The attacker targets the highest-value wallets first, including one wallet holding $1.8 million, and collects $30 million during the first 10 minutes. |
Lookonchain; Block; Chainalysis; 24/7 Wall St |
| July 30, 2026 Same day | Wave 2: The attack expands to 1,082 BTC, worth approximately $70 million, across 1,196 addresses within a 41-minute period. |
Galaxy Research; The Hacker News |
| July 30–31, 2026 | Coinkite publishes its first security advisory, urges affected users to migrate their seeds, and releases patched firmware. |
Coinkite blog; Bitcoin Magazine |
| July 31, 2026 | Block, Jack Dorsey’s company, publishes an independent technical analysis of the random-number generator vulnerability. | Block analysis |
| Aug 1–2, 2026 | Wave 3: Cumulative losses reach 1,367 BTC, worth approximately $89 million, across 4,585 addresses. Coinkite updates its advisory to include Mk4, Mk5, and Q devices. |
PYMNTS; CyberInsider; Galaxy Research |
| Aug 2–3, 2026 | Galaxy Research reports approximately 600 suspected attacker addresses to federal investigators, compliance firms, and cybersecurity teams. |
The Hacker News; Galaxy Research |
Imagine buying a high-security lock that promises to create each combination with a true physical randomizer. Instead, the manufacturer installs a predictable formula that produces combinations from a limited set of inputs. Once someone discovers that formula, they can test every possible combination until they find yours. That is essentially how the Coldcard hack became possible.
On March 1, 2021, a single code commit changed the function responsible for generating wallet seeds. Originally, ckcc.rng_bytes collected genuine randomness from the hardware random-number generator built into the device’s STM32 chip. However, developers replaced it with ngu.random.bytes, a software-based pseudo-random number generator that relied on deterministic inputs.
Specifically, the software PRNG used the device’s serial number, internal timer values, and the history of previous RNG calls. The firmware then processed those inputs with SHA256d cryptographic hashing. Although hashing can scramble existing data, it cannot create new randomness. Therefore, if the system starts with only 2^40 possible inputs, it can still produce only 2^40 possible outputs.
As a result, affected Mk3 devices generated seeds with approximately 40 bits of entropy. Meanwhile, Mk4, Mk5, and Q devices received additional input from a secure element, which raised their effective entropy to roughly 72 bits. Nevertheless, both figures remained below the 128-bit security level expected from Bitcoin seed generation.
Foundation Devices CEO Zach Herbert said the bug entered during a major March 2021 firmware rewrite that replaced remaining GPL code with new cryptographic libraries. In other words, the change formed part of a licensing overhaul rather than a deliberate security decision.
Even so, the faulty code remained active for five years. Coinkite conducted an AI-assisted firmware audit only weeks before the attack, but the review failed to identify the problem. Furthermore, multiple firmware updates, including security-focused releases, also missed it.
Ultimately, the wallet should have used a physical source of randomness to generate unpredictable keys. Instead, it used a limited and predictable formula. Once the attacker understood that formula, they could begin reconstructing users’ seeds and carrying out the Coldcard hack.
The attacker behind the Coldcard hack did not need to steal a device or connect to it remotely. Instead, the attacker could estimate key variables such as the device UID, timer state, and sequence of previous RNG calls. With those constraints, the attacker could reproduce possible seed output streams entirely offline.
Next, the attacker converted each candidate seed into Bitcoin addresses and compared them with public blockchain data. This process works like testing combinations on a lock. With approximately 40 bits of entropy, the affected seeds came from a pool of roughly one trillion possibilities. Although that number appears large, modern computing hardware can search such a space within a practical timeframe, especially when the attacker narrows the target set.
The attacker likely focused on addresses associated with Coldcard seeds created during the vulnerable period from 2021 to 2026. From there, the attacker generated candidate seeds, derived their corresponding addresses, and searched for matches on the blockchain. Once a candidate seed produced an address holding Bitcoin, the attacker gained control of the matching private key and swept the funds. Therefore, this brute-force process formed the core of the Coldcard hack.
Meanwhile, Galaxy Research found that Waves 1 and 2 may share the same operator. However, Wave 3 showed different on-chain behavior. As a result, another attacker may have independently discovered and exploited the vulnerability.
Mk4, Mk5, and Q devices had stronger entropy of approximately 72 bits. Nevertheless, they still fell below the expected 128-bit standard. Block described the design as a “dangerous fail-open structure” because certain boot conditions could reduce the search to only 2^32 possible values. Attackers have not exploited that weakness at scale so far. Even so, the remaining structure shows that the affected devices failed to provide the level of randomness users expected from a hardware wallet.
The Coldcard hack affects each model differently depending on which firmware version generated the wallet seed. Mk2 and Mk3 devices face the highest risk because the affected firmware produced seeds with only about 40 bits of entropy. Meanwhile, Mk4, Mk5, and Q devices received additional entropy from a secure element, which raised their effective security to roughly 72 bits. However, that level still remained below the 128-bit standard expected for Bitcoin seed generation.
Affected Coldcard models, vulnerable firmware, entropy, and risk
Crucially, the firmware version installed when the device created the seed determines whether a user faces exposure from the Coldcard hack. The current firmware version does not change the security of an existing seed. For example, a user who generated a seed on vulnerable firmware and later updated the device still holds a weak seed. The weakness exists inside the number the device already generated. Therefore, a firmware update only protects future seed generation. It cannot repair old seeds or make their associated addresses safe.
However, users who entered at least 50 independent and private dice rolls during seed setup added an external source of genuine entropy. That additional randomness overrides the weakness in the device’s software RNG. As a result, those users face minimal risk from this specific vulnerability. A strong BIP-39 passphrase also makes brute-force attacks more difficult, but it does not strengthen or repair the underlying seed. Consequently, Coinkite still recommends migrating funds generated from affected firmware.
Finally, the Coldcard hack does not affect every hardware wallet. Trezor, Ledger, and Block, which produces Bitkey, have confirmed that their products use different entropy-generation systems. Therefore, this specific firmware failure does not affect seeds created by those devices.
Following the Coldcard hack, Coinkite published its first security advisory on July 30 and July 31, approximately 30 hours after the initial sweep began. The company then released patched firmware for every affected model, including v4.2.0 for the Mk3, v5.6.0 for the Mk4 and Mk5, and v1.5.0Q for the Q. In addition, Coinkite published a technical analysis of the vulnerability and provided a migration guide to help users move funds away from weak seeds.
Furthermore, Coinkite updated its advisory on August 1 to acknowledge that Mk4, Mk5, and Q devices also faced reduced entropy. Although attackers primarily targeted Mk2 and Mk3 seeds during the Coldcard hack, the later models still fell below the expected 128-bit security standard. By disclosing the wider scope and releasing fixes across all affected product lines, Coinkite gave users a clearer path toward securing their Bitcoin.
However, the response has also drawn legitimate criticism. The bug remained in production for five years despite internal reviews, security-focused firmware releases, and an AI-assisted audit conducted shortly before the attack. More importantly, the sweep continued for nearly 30 hours before Coinkite issued its first public warning. As a result, affected users had no official information that could have helped them migrate their Bitcoin before the attacker reached their wallets.
Meanwhile, the circumstances surrounding the original code change have raised further questions. Foundation Devices CEO Zach Herbert argues that the bug entered during a licensing overhaul rather than a security-focused redesign. Therefore, the incident has prompted scrutiny over how Coinkite managed security risks during the 2021 rewrite. Similarly, Wizardsardine security researcher Kevin Loaec says users should consider multisig setups containing affected Coldcard keys exposed, an issue Coinkite’s advisory does not fully address.
Ultimately, Coinkite released working patches, technical details, and migration instructions after the Coldcard hack became public. Nevertheless, those actions do not erase the five-year detection failure or the delayed warning that prevented some users from protecting their funds in time.
Updating your Coldcard firmware alone will not secure an existing wallet. The vulnerable firmware already generated a weak seed, and that weakness remains embedded in the seed itself. Therefore, affected users must create a new seed and transfer their Bitcoin to addresses derived from it. Coinkite’s advisory and Shinobi’s Bitcoin Magazine guide recommend the following migration process.
Do not update the firmware and assume the existing wallet has become safe. The update fixes future seed generation, but it cannot strengthen a seed that the device previously created. In addition, each migration requires an on-chain Bitcoin transaction, so users should account for network fees and avoid choosing an unnecessarily low fee during an urgent transfer.
Multisig users face an additional complication. Every key derived from an affected Coldcard seed must be rotated. Users should review the wallet’s signing threshold, replace each vulnerable key, and verify the new multisig configuration before moving significant funds.
Self-custody depends on two separate security requirements. First, users must control their private keys. Second, wallets must generate those keys with genuine, high-quality randomness. Hardware wallet companies have traditionally emphasized the first requirement because it supports the familiar principle of “not your keys, not your coins.” However, they have discussed the second requirement far less often. As the Coldcard exploit shows, users can fully control their keys and still lose funds if the device generated those keys from predictable inputs.
Moreover, this incident marks the third major pseudo-random number generator failure in crypto in recent years, following Milk Sad in 2023 and Ill Bloom in 2026. In each case, the failure occurred during key generation, a process that ordinary users could not independently verify. A wallet interface can display a valid seed phrase and produce working addresses while still relying on dangerously weak entropy underneath. Consequently, users may not discover the problem until an attacker reconstructs the seed and moves the funds.
At the same time, the incident complicates the debate around open-source and closed-source hardware wallets. Coldcard makes its firmware source code publicly available, although it does not release the software under a fully open-source permissive licence. Developers could inspect the vulnerable code, yet the bug remained undetected for five years. Therefore, public code does not guarantee secure code. Nevertheless, source availability remains necessary for meaningful community auditing because researchers cannot inspect software they cannot access.
Meanwhile, CoinDesk has reported that the exploit could push some investors toward Bitcoin ETFs. ETFs remove the operational risks of generating, storing, and protecting private keys. However, investors replace those risks with dependence on a regulated custodian and financial institution. In other words, the trade-off does not eliminate custody risk. Instead, it transfers responsibility from the individual holder to an institutional provider.
Finally, Blockaid found that compromised keys and operational security failures caused most crypto losses during the first half of 2026, rather than smart contract exploits. In this context, the Coldcard incident fits the broader pattern because the attacker targeted the key-generation process instead of exploiting Bitcoin itself. Cold storage is still the right choice for most long-term Bitcoin holders. But “cold” does not mean “infallible.” Trust the principle. Verify the implementation.
This article is for informational and educational purposes only and does not constitute financial, investment, legal, or security advice. Always conduct your own research before making crypto-related decisions.
