Canadian hardware wallet maker Coinkite issued an urgent security advisory on July 30, 2026, warning that seeds generated on its popular Coldcard Mk3 devices running firmware version 4.0.1 or later may put user funds at risk.
The alert followed a coordinated sweep of roughly 594 Bitcoin (BTC), valued at approximately $38 million, from around 500 single-signature Bitcoin addresses in a narrow time window earlier that day. The underlying issue centers on a subtle but serious failure in the device’s random number generation that produced seed phrases with far less entropy than the industry-standard 128 bits expected for a 12-word BIP-39 mnemonic.
The flaw, described in detail by Coinkite in a blog, present across Mk3 firmware from version 4.0.1 (released in March 2021) through the final supported release 5.0.3, reduced effective randomness in many cases to roughly 40 bits. That shrinkage of the search space made offline reconstruction of private keys feasible for determined attackers.
While Coinkite has not publicly confirmed a direct causal link between the bug and the specific 594 BTC movement, independent researchers quickly connected the on-chain pattern to weak seed generation. Newer models such as the Mk4, Q, and Mk5 faced a less severe but still concerning reduction in some earlier firmware versions, though Coinkite’s initial analysis indicated they were not impacted to the same degree.
The firm said that devices using different codebases, including TAPSIGNER, OPENDIME, and SATSCARD, were unaffected.
On-Chain Activity Sparks Urgent Alerts
The drama unfolded in the early hours of July 30, 2026. Between roughly 01:31 and 01:56 UTC, 1,324 unspent transaction outputs totaling 594.48 BTC moved across 500 transactions inside a three-block window. A large portion was later consolidated.
According to multiple security researchers, many of the drained addresses held coins that had remained dormant since 2021, precisely the period when the vulnerable firmware began shipping, and all were single-signature wallets. No multi-signature or Taproot addresses appeared among the initial victims.
Kevin Loaec, CEO of Wizardsardine, posted early hypotheses pointing to a low-entropy random-number generator, possibly tied to a software library, secure element, specific device batch, or firmware version. He suggested an attacker may have used an automated script that focused primarily on BIP-84 derivation paths, which could explain the concentration on native SegWit addresses and the appearance of partial wallet drains.
AnchorWatch CEO Rob Hamilton independently analyzed the sweep and observed that the pattern looked consistent with “flawed entropy in wallet generation somewhere along the path.”
Bitcoin Core developer instagibbs later reproduced key aspects of the vulnerability on a fresh Mk3 device and confirmed that the coldcard firmware Mk2/3 are vulnerable while MK4 remains uncertain.
Coinkite itself stated it had been unaware of the bug until that day. The company’s open-source firmware had been publicly available for years, leading some observers to speculate that advanced code-review tools, including AI models, may have helped outsiders identify the issue before the manufacturer did.
Within hours of the on-chain activity and community reports, Coinkite published its formal Mk3 Security Advisory, urging affected users to treat their seeds as potentially compromised.
Root Cause: Insufficient Entropy in Firmware
Coinkite explained that at the heart of the problem was a complex series of bugs that prevented the hardware true random number generator (TRNG) from contributing meaningful randomness during seed creation. In the affected firmware, the wrong version of a function called rng_get() was pulled into the codebase. As a result, the bulk of the randomness came from a software-based pseudo-random number generator (PRNG) drawn from a MicroPython submodule rather than the carefully engineered TRNG that Coinkite had intended.
On Mk3 devices the active PRNG was seeded primarily from device state and timing information. Under current attack assumptions, researchers and Coinkite itself estimated the effective search space at about 40 bits—orders of magnitude smaller than the 128 bits required for a secure 12-word seed or the 256 bits for a 24-word seed.
With only 40 bits of entropy, the total number of possible seeds collapses to roughly 1.1 trillion combinations. While still a large number, it is small enough that a well-resourced attacker can generate and check every possibility offline against known funded addresses.
Later models introduced additional entropy from secure elements, raising the estimated effective entropy to around 72 bits in some cases. That improvement made brute-force attacks more difficult but did not restore the full intended security margin. Coinkite has since released firmware updates (version 5.6.0 and later for Mk4 and Mk5, and 1.5.0Q for the Q) that correct the generation process for new seeds. Existing weak seeds, however, remain permanently compromised; firmware updates cannot retroactively strengthen them.
Importantly, the bug affected only the device-generated portion of entropy. Users who added a sufficient number of independent dice rolls during seed creation, generally 50 or more fair rolls, supplied enough external randomness that their seeds are considered safe from this particular issue. The same protection applies to those who used a strong, unique BIP-39 passphrase, which effectively creates an entirely separate wallet derivation path.
Illustrating the Invisible Risk: Terence Michael’s Seed Phrase Comparison
One of the clearest public explanations of why the flaw is so dangerous came from Bitcoin educator and author Terence Michael. In a widely shared X post on July 31, he placed two 12-word BIP-39 seed phrases side by side to demonstrate how impossible it is for an ordinary user to detect the problem simply by looking at the words.
He put two example seed phrases as examples which appeared equally random. Both follow the BIP-39 word list. Both could be written on paper, stamped into steel plates, and stored offline with complete confidence. Yet, as Michael explained, SEED A was generated with the full 128 bits of high-quality entropy that a proper hardware wallet should produce, yielding an astronomical number of possible combinations, approximately 340 undecillion, that no current or foreseeable computing power can brute-force. SEED B, by contrast, was generated with only 40 bits of entropy, reducing the search space to about 1.1 trillion possibilities.
“You can’t tell the two phrases apart if you use the device to give you your words,” Michael wrote. “You get them. You write them down. Stamp them in steel. Done.” The user has no visual or procedural clue that the underlying randomness is deficient. Once the weak seed is in circulation and funds are deposited, an attacker who understands the firmware defect can systematically generate the limited set of possible mnemonics, derive the corresponding addresses, and sweep any balances that match.
Michael emphasized that the only reliable defenses are generating one’s own entropy through dice rolls, adding a strong passphrase, keeping the seed completely offline, and—most robustly—moving to multi-signature setups that require multiple independent keys. His illustration captured the essence of the crisis: the danger is invisible until the funds are gone.
Coinkite’s Response and Critical Steps for Users
Coinkite’s advisory stressed calm, deliberate action rather than panic. For users whose seeds were generated on an affected Mk3 without adequate dice rolls or a passphrase, the company recommended creating a strong, unique BIP-39 passphrase on the existing device as an immediate interim measure and moving funds to the resulting new wallet.
The preferred long-term solution is to generate an entirely new seed on an unaffected device, preferably a later-model Coldcard running the latest corrected firmware, or another reputable hardware wallet, verify the backup thoroughly, send a small test transaction, and only then transfer the bulk of the funds.
Users who already incorporated at least 50 independent private dice rolls or a strong passphrase face minimal risk from this specific flaw. Multi-signature wallets that combine keys from different manufacturers or include independent entropy sources provide additional resilience even if one key was generated under the vulnerable conditions.
The incident has renewed broader conversations within the Bitcoin community about the limits of single-signature self-custody, the importance of verifiable entropy, and the value of open-source review. While Coinkite’s firmware has long been public, the subtlety of the regression—introduced during a major codebase overhaul in early 2021—escaped detection for more than five years. Both attackers and defenders now have access to powerful analysis tools, underscoring the ongoing arms race in hardware wallet security.
As of July 31, 2026, investigations continue. Coinkite has promised a more detailed technical review, and independent researchers are examining residual risks on later hardware generations. For holders of Coldcard-generated seeds, the practical message remains clear: verify how and when the seed was created, strengthen it with a passphrase if possible, and migrate carefully to a configuration that no longer relies on the compromised randomness.
In Bitcoin self-custody, entropy is not an abstract concept—it is the foundation of ownership. When that foundation is weakened, even the most carefully stored steel backup can fail.
Also read: South Korea Seeks Interpol Help in Alleged $8.5M XRP Scam Probe
