Coldcard Hack Explained: Affected Wallets, Firmware Fixes, and What Users Should Do

Bitcoin’s founding promise is self-sovereignty: hold your own keys, and no bank or exchange can freeze, seize, or spend your money. Hardware wallets are the tool most people use to make that real, and Coldcard has long been regarded as a gold standard for offline Bitcoin storage. So it landed hard when a flaw in Coldcard’s own firmware let attackers empty wallets their owners believed were untouchable, with no malware, no phishing, and no physical access to the device.

As of early August 2026, blockchain research firm Galaxy Research has linked roughly 1,367 Bitcoin (BTC), about $88–89 million at prevailing prices, across more than 4,500 addresses to the exploit, with the thefts unfolding in waves that began around July 30, 2026. Because the situation is still developing and estimates have been revised as new waves surfaced, the running total should be read as evolving rather than final. This guide walks through the entire episode: the concepts, the exact flaw, the attack, who is exposed, and what to do.

Incident status — Updated August 4, 2026: Galaxy Research said it had high confidence that 1,596 BTC had been stolen from roughly 7,300 addresses across three confirmed attack waves and 14 smaller incidents. That represented more than $100 million at the time of the update, with unconfirmed losses being estimated at $30 million more, taking the potential tally to over $130 million. Galaxy separately identified a suspected fourth wave that could take the total to approximately 2,055 BTC, but it had not included that wave in its confirmed figure.

The Short Version

TL;DR: A firmware bug introduced in March 2021 caused some Coldcard devices to generate recovery seeds using weak, predictable randomness instead of their hardware random number generator. That made a subset of seeds guessable, and attackers precomputed those keys and swept the funds. Updating the firmware does not fix a seed that was already created weakly. Anyone who generated a single-signature seed on an affected Coldcard, without enough dice-roll entropy or a strong passphrase, should move their Bitcoin to a new seed on fixed firmware; carefully, and soon.

What Is a Coldcard Wallet?

Coldcard is a Bitcoin-only hardware wallet made by the Canadian company Coinkite. It is designed for air-gapped, offline use: private keys are generated and stored on the device and never leave it, transactions are signed offline, and it offers security features such as PIN protection, anti-phishing words, optional dice-roll entropy, and multisignature support. Its model lineup spans the older Mk1, Mk2, and Mk3, and the newer Mk4, Mk5, and Q series. For years, many long-term holders have treated it as one of the safest ways to store Bitcoin.

Two clarifications matter up front. First, the “Coldcard hack” is not remote malware, a phishing scam, or a stolen device; it is a flaw in how some Coldcards generated the recovery seed years ago. Second, Coinkite’s other products, including TAPSIGNER, OPENDIME, and SATSCARD, run on different codebases and are not affected by this issue.

The Foundation: How Seeds and Entropy Actually Work

To understand what broke, you need two concepts that sit under every self-custodied wallet.

The recovery seed. When you set up a hardware wallet, it creates a master secret, usually represented as a 12- or 24-word recovery phrase (following a standard called BIP-39). From that phrase, the wallet mathematically derives all of your private keys and Bitcoin addresses. The critical implication is simple and absolute: whoever can reproduce your seed words can rebuild your entire wallet on any device and move your coins. The physical Coldcard, its PIN, and any companion app are conveniences layered on top. The seed is the wallet.

Entropy. For a seed to be safe, the words must be chosen with genuine randomness; what cryptographers call entropy. When a wallet generates a seed, it should draw from a pool of possibilities so vast that no one could ever guess or reproduce yours. The industry security target is 128 bits of entropy, meaning 2¹²⁸ possible seeds. That is a number with 39 digits — so large that every computer on Earth working together could not search it in the lifetime of the universe. This is why a properly generated seed is effectively impossible to brute-force.

To produce that randomness, quality hardware wallets use a dedicated hardware true random number generator (TRNG), which is a physical component that yields unpredictable values from physical noise. The entire security model of a hardware wallet rests on that randomness being real and unpredictable. Coldcard’s flaw is that, for a range of firmware versions, it quietly wasn’t.

What Exactly Went Wrong: The RNG Integration Bug

According to Coinkite’s own technical backgrounder and an independent analysis published by Block’s engineering team, the failure was a subtle software-integration error, not a hardware defect.

Coldcard’s software is built on MicroPython, and Coinkite supplies its own hardware-RNG wrapper for the device’s STM32 chip. To avoid conflicts, Coinkite deliberately disabled MicroPython’s built-in RNG path by setting a configuration flag, MICROPY_HW_ENABLE_RNG, to zero. The problem: the underlying library checked only whether that flag was defined, not whether it was enabled (set to a non-zero value). Because a flag set to zero is still “defined,” the build silently compiled against the wrong code, and seed generation fell back to a deterministic software pseudo-random number generator called Yasmarang.

That fallback generator was seeded mainly from the chip’s fixed unique ID (UID) and timer registers, values that are neither secret nor cryptographically random. The STM32’s UID is a factory-set manufacturing identifier, readable from memory and even partly reflected in the device’s USB serial number; it is meant to distinguish chips, not to serve as a secret. Worse, by the analyses, only the first 32-bit word of that UID actually fed the generator, and different devices can even share that low word.

Several compounding details made things worse rather than better. The library combined the Yasmarang output with a second Yasmarang instance started from public, hardcoded constants, and combining two predictable streams still yields a predictable result. A built-in “health check” meant to catch bad randomness only rejected obviously broken patterns (like repeated values) and was trivially passed by this not-obviously-broken but still predictable generator. Finally, the seed bytes were run through a cryptographic hash (SHA256d), but hashing cannot manufacture randomness that was never there. If there are only about a trillion possible inputs, there are only about a trillion possible outputs.

Researchers traced the exact moment the bug entered the product: a single code commit on March 1, 2021 changed the seed-generation call from one that correctly reached the STM32 hardware generator to one that routed through the broken path. Coinkite’s founder described the underlying mistake candidly, explaining that he had set the configuration flag to zero believing neither RNG version was needed, “but that’s not what it does.” (Coinkite has also noted that the upstream fallback code is older than the bug’s impact; the flawed path only entered Coldcard seed generation with that March 2021 change, so the affected window is roughly 2021 onward, not the full age of the upstream code.)

The practical effect on entropy varied by model:

• Mk2 and Mk3, on affected firmware versions 4.0.1 through 4.1.9: effective entropy collapsed to around 40 bits or lower, against the 128-bit target.
• Mk4, Mk5, and Q, before fixed firmware: additional randomness from the devices’ secure elements (SE1 and SE2) was mixed in, but reseeding was limited, leaving roughly 72 bits of effective entropy by Coinkite’s assessment, better, but still well short of the target.

Because the weakness was baked into the seed itself, an attacker could enumerate the shrunken set of possible seeds entirely offline, derive the matching private keys and Bitcoin addresses, and then sweep any of those addresses that turned out to hold funds. At no point did the attacker need to touch, see, or communicate with the victim’s physical Coldcard.

Also read: Bitcoin’s Invisible Risk: Coldcard Mk3 Firmware Bug Leaves BTC Wallet Seeds Exposed, $38M Drained 

Why the Entropy Gap Is Everything

The difference between 40 bits and 128 bits sounds abstract, but it is the line between “impossible to guess” and “guessable by a determined attacker.” The table below shows why:

Effective Entropy	Approx. Number of Possible Seeds	Practical Security
128 bits (industry target)	~3.4 × 10³⁸	Cannot be searched; effectively unbreakable
~72 bits (Mk4 / Mk5 / Q before fix)	~4.7 × 10²¹	Below the safe threshold; reachable by well-resourced attackers over time
~40 bits (Mk2 / Mk3 affected)	~1.1 × 10¹² (about one trillion)	Searchable in a practical timeframe with ordinary hardware

A trillion possibilities sounds enormous to a human, but a computer can work through that space methodically, and an attacker who has precomputed the candidate keys can then simply watch the blockchain for any that hold Bitcoin. That is exactly the pattern researchers observed. 

The ~72-bit case on newer models is vastly larger and far harder to exhaust, but it still sits inside the range security engineers consider inadequate for a system guarding real money, which is why Coinkite advised users of those models to migrate as well.

Did AI Discover the Flaw?

One of the more striking details comes from Coinkite itself. Because Coldcard’s source code has always been open and publicly available, the company said in its advisory that it has to “assume that someone used AI to review previous versions” of the firmware and stumbled onto the flaw. That is Coinkite’s own speculation rather than an established fact, and it should be read that way.

Still, it lands squarely within a broader 2026 debate about AI’s growing role in offensive security. The same period saw AI labs disclose that their models had reached and accessed real systems during cybersecurity tests, and a prominent custody executive publicly dared an AI model to steal a bitcoin bounty. Whether or not machine review surfaced this specific bug, the episode has become a reference point for a real concern: that AI systems capable of reading large codebases could accelerate the discovery of long-dormant vulnerabilities in open-source software, a double-edged development that can aid defenders and attackers alike.

How the Theft Unfolded

The exploitation was fast and deliberate. Blockchain analytics firm Chainalysis found that the attacker did not sweep wallets at random but appeared to work from precomputed key lists and target the largest balances first, taking an estimated $30 million within the first 10 minutes and clearing roughly 594 BTC from about 500 single-signature wallets, many dormant for years, in around 25 minutes. On-chain analysts observed the funds moving in a tight burst of transactions and being consolidated into attacker-controlled addresses.

In the hours that followed, Galaxy Research tracked the total climbing across successive waves, from roughly $38 million, to about $75 million, to around $88.6 million across more than 4,500 addresses, with later waves reaching smaller balances. Galaxy noted two points worth remembering: the stolen funds have so far remained unspent in the attacker’s addresses, which is somewhat unusual for a theft of this scale, and the later wave’s differences could indicate either the same attacker adapting or a separate actor exploiting the now-public flaw.

One important note on precision: while researchers and the wider industry broadly link the on-chain sweeps to this firmware flaw, and the technical connection is widely accepted, Coinkite published its advisory without formally declaring the theft and the bug to be definitively the same event. That formal confirmation is a distinct step, and this remains a developing story.

Timeline of Events

• March 1, 2021: A firmware commit routes Coldcard seed generation through the broken RNG path; the entropy weakness begins affecting new seeds (firmware 4.0.1 onward on Mk2/Mk3).
• 2021–2026: The flaw sits undiscovered as users generate seeds on affected firmware across multiple models.
• Around July 30, 2026: Coordinated on-chain sweeps begin, draining single-signature wallets tied to affected devices.
• Late July 2026: Coinkite discloses the firmware flaw; blockchain researchers (Chainalysis, Galaxy Research, and others) link the sweeps to it and begin tracking losses.
• July 31 – August 03, 2026: Coinkite publishes a security advisory and technical backgrounder, releases fixed firmware for all affected models, and updates guidance; researchers identify additional waves, pushing the tracked total toward roughly $88.6 million.
• Galaxy update on August 04: 1,596 BTC from roughly 7,300 addresses in a high-confidence estimate, including suspected fourth wave. Other on-chain data suggests approximately 2,055 BTC or $130 million, but not fully confirmed.

Also read: Coldcard Hack Hits $75M After Alleged Second Attack Wave: Galaxy Research

Are You at Risk?

Per Coinkite’s advisory, your funds may be at risk if a seed was generated on affected firmware without either sufficient dice-roll entropy or a strong, unique passphrase. Broken down:

• Highest risk: Mk2/Mk3 seeds generated on firmware 4.0.1–4.1.9 without adequate dice rolls.
• Also affected (serious, if lower): Seeds generated on Mk4, Mk5, and Q devices before the fixed firmware releases.
• Not affected, or much lower risk: Seeds created with enough fair, private dice rolls; wallets protected by a strong, unique BIP-39 passphrase; multisignature setups where most keys come from non-vulnerable devices; Mk1 devices; and the TAPSIGNER, OPENDIME, and SATSCARD products.

On dice rolls. Coinkite explains that on affected firmware, the device hashed any dice rolls you entered into the final seed. By its assessment, 50 to 98 independent, private rolls contributed at least 128 bits of entropy on their own, and 99 or more contributed roughly 256 bits, enough that it does not consider such a seed at risk from this RNG issue alone. Fewer than 50 rolls, or any uncertainty about how many you used or whether they stayed private, means you should migrate. Crucially, your dice-roll sequence is itself secret key material: if it was written down, photographed, or otherwise exposed, that protection is undermined.

On passphrases. A BIP-39 passphrase (sometimes called a “25th word”) is an optional secret you add on top of your seed. Because it is processed separately from the device’s internal entropy and never lives in the seed generation that failed, a strong, unique passphrase adds an independent barrier even if the underlying seed was weak.

The single most important rule: updating the firmware does not repair an already-generated weak seed. The randomness that created your seed is fixed in the past; no patch can retroactively add it. A firmware update protects future seeds, not existing ones.

What to Do Right Now

If you may be affected, do not panic — rushed migrations cause new and sometimes worse mistakes — but do act deliberately. Coinkite has released fixed firmware for all affected models:

• Mk2/Mk3: version 4.2.0 or later
• Mk4/Mk5 (Standard): version 5.6.0 or later
• Q (Standard): version 1.5.0Q or later
• Corresponding Edge releases for those tracks

Then follow the migration path carefully:

1. Install the fixed firmware for your specific model from the official source, and do not generate any new seed until it is installed.
2. Generate an entirely new seed on the updated device.
3. Verify the new backup, confirm the wallet fingerprint, and check a fresh receive address on the device screen.
4. Send a small test transaction to the new wallet and confirm it arrives before doing anything else.
5. Move the remaining funds from the old wallet to the new one once the test succeeds.
6. Keep the old backup until the migration is fully confirmed, then retire it and never reuse it.
7. Consider hardening the new setup with a strong, unique BIP-39 passphrase stored separately, and, for larger holdings, a multisignature configuration using independent devices.

If you own only one device, follow Coinkite’s careful seed-switching procedure rather than improvising. And never enter a seed or passphrase on an untrusted or internet-connected device. Because this is an evolving situation, always verify the latest steps against Coinkite’s official advisory before acting.

How to Harden Self-Custody Going Forward

Beyond the immediate fix, the incident validates a set of durable best practices that reduce single points of failure:

• Add external entropy or a passphrase. Dice rolls (done privately and in sufficient number) or a strong, unique passphrase both add randomness the device alone cannot undermine.
• Use multisignature for meaningful sums. A multisig wallet requires several independent keys, ideally on devices from different manufacturers, in different locations, so no single device flaw can drain your funds. This is the model professional custodians rely on.
• Diversify hardware. Spreading large holdings across devices from different vendors limits the blast radius of any one vendor’s bug.
• Prefer transparent, open-source, audited devices, while recognizing, as this case shows, that open source is necessary but not sufficient; independent review and periodic migration still matter.
• Verify receive addresses on the device screen, buy hardware only from official channels, and back up seeds offline and securely.
• Treat security as an ongoing process. Set-and-forget is precisely the mindset this episode exposed; monitor advisories for devices you rely on.

The Coldcard failure also fits a broader 2026 pattern that security firms have flagged: most crypto losses this year have come not from smart-contract exploits but from compromised keys and operational-security failures, the category into which a key-generation flaw squarely falls.

Self-Custody vs. Custodians: The Trade-Off

The hack has reopened a long-running debate, and it is worth understanding both sides rather than assuming either is obviously right.

Some observers argue an entropy failure in a device marketed specifically as the secure alternative to software wallets could push nervous holders toward regulated custodians and spot Bitcoin ETFs, where a dedicated professional team manages security, trading away some sovereignty for convenience and expertise. Self-custody advocates counter that surrendering custody reintroduces exactly the third-party trust Bitcoin was designed to remove, and that the correct response is better self-custody tooling, multisig, passphrases, and diversification, not giving up your keys. There is no universally correct answer; the right choice depends on how much value you hold, how much operational responsibility you are willing to carry, and your own risk tolerance.

Key Takeaways From This Incident

• The flaw was a randomness (entropy) bug: a March 2021 firmware change made some Coldcards generate predictable seeds with a software PRNG instead of the hardware TRNG.
• It hit Mk2/Mk3 firmware 4.0.1–4.1.9 hardest (~40-bit entropy) and Mk4/Mk5/Q before fixes (~72-bit) less severely; Mk1 and non-Coldcard Coinkite products are unaffected.
• Attackers precomputed keys and swept the largest single-signature wallets first; tracked losses reached over $100 million per Galaxy Research, evolving across waves.
• A firmware update does not fix an already-weak seed; affected users must generate a new seed on fixed firmware and migrate funds.
• 50+ private dice rolls or a strong, unique passphrase provide meaningful protection; longer term, multisig and hardware diversification harden self-custody.

Conclusion

The Coldcard hack is a hard, concrete lesson delivered at scale: the security of self-custody is only ever as strong as the randomness behind your seed, and a single quiet line of code can undo years of careful cold storage in minutes. But it is a solvable problem. Understanding how seeds and entropy work, checking whether you are exposed, and layering defenses like passphrases and multisig turn self-custody from a leap of faith into a manageable discipline. 

This remains a developing story, so verify details against Coinkite’s primary advisory before acting, and hold on to the timeless takeaway that the episode makes unavoidable: security is a process, not a product. Verify, layer your defenses, and never assume any single device or firmware version is permanently immune.

Frequently Asked Questions (FAQs)

Also Read: The Ultimate Guide to Cryptocurrency Security