For years, the Coldcard has worn a crown that few other hardware wallets can claim: the reputation of being the most paranoid, most security-obsessed Bitcoin device you can buy. It is the wallet reviewers call "air-gapped by design," the one that ships with a camera for QR-only signing and a deliberately hostile stance toward USB connections. So when the first reports of drained wallets surfaced in late July 2026, the natural assumption was a remote exploit, a poisoned supply chain, or a malicious companion app. The reality turned out to be far more uncomfortable: a five-year-old firmware bug had quietly reduced the randomness of wallet seed phrases to a level attackers could brute-force offline — without ever touching a single victim's device.
Coinkite, the Canadian manufacturer behind Coldcard, disclosed the flaw on July 30, 2026, shipped emergency firmware for every affected model within a day, and its CEO publicly apologized and accepted full responsibility. But the incident is already being called one of the most consequential failures in the history of self-custody — not because the attack was exotic, but because it was brutally simple once the entropy collapsed.
What Happened: Four Waves of Theft in 72 Hours
Blockchain intelligence firm Galaxy Research tracked at least four distinct waves of theft beginning on July 30, sweeping funds from more than 5,200 individual Bitcoin addresses. By the time the dust settled, roughly 1,816 BTC — worth around $116 million — had been moved off affected wallets. Earlier estimates from the research team at Block, which first identified the flaw, put the figure closer to 1,367 BTC (~$88.6 million) across about 4,585 addresses; the higher number reflects additional sweeps that continued as victims realized what had happened.
The attackers never accessed the devices. They never guessed PINs. They never intercepted a single transaction. Instead, they reconstructed the mathematical space in which the victims' seeds lived — and then simply walked through it.
The Root Cause: A 2021 Build Error That Broke the RNG
The story begins in March 2021, when Coinkite shipped firmware version 4.0.1. During a firmware rewrite, a build/integration error silently rerouted seed generation away from the STM32 hardware true random number generator (TRNG) — the carefully engineered physical entropy source the device was designed around — toward a software pseudo-random number generator (PRNG) called Yasmarang, pulled in from a MicroPython submodule inside the libngu library.
That fallback generator was seeded with predictable material: the microcontroller's unique identifier and system timing values. Those are not cryptographically secure sources of randomness, and critically, they can be observed or reconstructed. The intended design was 128 bits of true entropy for a 12-word seed phrase. What shipped was dramatically less:
- Mk2 / Mk3: effective entropy collapsed to roughly 40 bits — a space so small it is mathematically doomed.
- Mk4 / Mk5 / Q: reduced to roughly 72 bits — still far below the 128-bit security floor, and still within reach of a well-resourced attacker.
Why 40 Bits Is a Death Sentence for a Bitcoin Wallet
To understand why this matters, it helps to remember how Bitcoin wallets actually work. A wallet generates a seed phrase (typically 12 or 24 words from the BIP-39 wordlist), and every private key the wallet ever derives — every address, every balance — flows from that seed through the BIP-32 hierarchical derivation scheme. The seed is the root of an entire tree of keys.
At the designed 128 bits, brute-forcing a seed is computationally absurd: there are roughly 2128 possibilities, a number larger than the atoms in the observable universe. At 40 bits, the space shrinks to about a trillion candidates — a workload that is entirely feasible for a determined adversary with GPU clusters or rented cloud compute, executed offline, with no interaction with the victim whatsoever. The attacker's job was even easier because Yasmarang's output was deterministic once its weak seed was known: regenerate the same candidate seeds on your own hardware, derive the addresses, and check them against the blockchain until the balances appear.
The Attack: Guessing Seeds Without Ever Touching a Device
This is the detail that makes the Coldcard incident uniquely chilling. The attackers did not need physical access, malware, or phishing. They needed only the knowledge that a victim's seed was generated on vulnerable firmware, and the computational resources to enumerate the weakened key space. For each candidate seed, they derived the associated addresses and compared them against on-chain data. When a match lit up with a balance, the funds were swept — often within minutes.
Because the flaw affected only the device-generated portion of entropy, seeds created with independent randomness remained safe. Specifically, seeds that used at least 50 fair, independent, private dice rolls — or that were protected by a strong BIP-39 passphrase — were not exposed by this bug.
Affected Models and Firmware Versions
Exposure depends on the firmware that was running when the seed was created, not the version installed today. Installing the latest update does not retroactively repair an already-created seed.
| Model | Affected seed-generation firmware | Fixed firmware | Effective entropy |
|---|---|---|---|
| Mk2 / Mk3 | 4.0.1 – 4.1.9 | 4.2.0 (July 31, 2026) | ~40 bits |
| Mk4 / Mk5 (standard) | Before 5.6.0 | 5.6.0 | ~72 bits |
| Q (standard) | Before 1.5.0Q | 1.5.0Q | ~72 bits |
| Mk4 / Mk5 (Edge) | Before 6.6.0X | 6.6.0X | ~72 bits |
| Q (Edge) | Before 6.6.0QX | 6.6.0QX | ~72 bits |
Coinkite's other products — TAPSIGNER, OPENDIME, and SATSCARD — run on different codebases and are not affected. Notably, no CVE identifier was assigned to this incident: it is a firmware-level design failure rather than a classic vulnerability a scanner could flag, which made it invisible to conventional patch management for over five years.
The Patch That Cannot Rewind Time
Coinkite shipped emergency firmware on July 31, 2026: v4.2.0 for Mk2/Mk3, v5.6.0 for standard Mk4/Mk5, v1.5.0Q for standard Q, and matching Edge builds. The update corrects seed generation going forward, and Coinkite's advisory is unambiguous about what it does not do: it cannot repair a seed that was already generated on vulnerable firmware. The damage is baked into the existing seed's insufficient entropy.
How to Check and Migrate Safely
If you own a Coldcard and any of your wallets were created on affected firmware, treat the funds as compromised regardless of whether they have been touched yet. The recommended migration path:
- Update the firmware to the fixed version for your model before doing anything else.
- Generate a brand-new seed on the patched device — ideally with independent dice entropy added for defense in depth.
- Write down the new seed and verify it by re-entering it on the device before funding.
- Send a small test transaction to the new wallet and confirm it arrives.
- Move all funds from the old addresses to the new wallet, then never reuse the old seed — even an emptied vulnerable seed is a liability if any future balance appears.
- If your seed was created with independent dice rolls or a strong BIP-39 passphrase, it is not exposed by this bug — but documenting that provenance is now part of responsible self-custody.
What This Means for Self-Custody
The Coldcard incident is a masterclass in how trust in hardware can fail. The device's reputation was built on its air-gapped design and its hostile posture toward connectivity — and none of that mattered, because the failure happened one layer deeper, inside the entropy source itself. Security reviewers and users alike audit for side channels, exfiltration paths, and supply chain tampering; almost nobody audits the statistical quality of the randomness their seed was minted from.
The lessons extend far beyond Coldcard owners. Any hardware wallet — indeed, any system that generates keys — is only as strong as its entropy source. A TRNG that is designed, specified, and then silently bypassed by a build error is a failure mode that no EAL certification or firmware signature can catch. The industry will now look back at every device that has ever shipped a software PRNG fallback with the same unease that followed the Debian OpenSSL PRNG disaster of 2008.
For Bitcoiners, the practical takeaway is straightforward: assume your hardware's entropy is untrustworthy until proven otherwise, favor seeds built from independent physical randomness, and treat firmware updates as a migration event rather than a patch event. The Coldcard's crown is dented, but the lesson it just taught the industry is worth more than the $116 million it cost to learn.
Technical sources: Coinkite security advisory (July 30, 2026), Block research disclosure, Galaxy Research on-chain analysis, Fortune, The Hacker News, and BleepingComputer.