On August 3, 2026, the cryptocurrency community is grappling with the worst hardware wallet security breach in Bitcoin history. Coldcard, manufactured by Canadian company Coinkite and long considered one of the most secure Bitcoin-only hardware wallets, has been found to contain a firmware vulnerability that silently weakened seed generation for over five years — resulting in the confirmed theft of approximately 1,815 BTC (roughly $114 million) from more than 5,294 addresses.
No phishing was involved. No malware infected users' computers. No one physically stole any devices. The attack exploited a single misconfigured preprocessor macro in the firmware code — and it went undetected from March 2021 until July 30, 2026.
Here's the full technical breakdown of what happened, why it matters, and what every hardware wallet user should learn from this catastrophe.
The Root Cause: A One-Line Configuration Error That Cost $114 Million
The vulnerability lives in Coldcard's libngu cryptographic library. During a firmware update shipped as version 4.0.0 in March 2021, Coinkite migrated to integrate Bitcoin Core's libsecp256k1 library. As part of this migration, a board configuration macro was set to 0 to disable MicroPython's built-in RNG — the intention was to route all randomness through Coldcard's hardware True Random Number Generator (TRNG).
Here's the critical mistake: the libngu guard checked whether the macro was defined, not whether it was enabled. Since the macro existed with a value of zero, the check passed. The build compiled successfully. But the hardware RNG call was silently removed, and seed generation fell back to Yasmarang — a software-based Pseudorandom Number Generator (PRNG).
# Simplified representation of the logic error:
# The code checked: "Is HARDWARE_RNG defined?" → YES (value = 0)
# But it should have checked: "Is HARDWARE_RNG enabled (non-zero)?" → NO
# Result: Hardware RNG bypassed, software fallback silently activated
The software PRNG relied on predictable device data — a chip identifier (similar to a serial number) and internal clock values at startup. Instead of the expected 128 bits of entropy for a standard BIP-39 12-word seed phrase, Mk3 devices generated seeds with approximately 40 bits of effective entropy.
To put that in perspective: 128 bits means 2^128 possible combinations — more than the number of atoms in the observable universe. 40 bits means 2^40 combinations — roughly 1 trillion. With specialized hardware, that's a brute-force search that can be completed in hours.
The Attack: Four Waves of Coordinated Theft
The exploit unfolded in multiple coordinated waves:
Wave 1 (July 30, 2026): The attacker drained approximately 594 BTC from nearly 500 single-signature wallets in just 25 minutes. The speed and precision suggested an automated operation using a pre-computed list of private keys derived from the weakened seed space.
Wave 2 (July 31 – August 1): An additional ~488 BTC were identified from approximately 695 transactions with matching signature patterns, bringing the running total above 1,082 BTC.
Wave 3 (August 2): Galaxy Research tracked a third wave adding 207.7 BTC from additional victim addresses, pushing total confirmed losses past 1,367 BTC across 4,585 addresses.
Wave 4 (August 3): A fourth wave hit over the weekend, moving 448.7 BTC from 709 suspected victim addresses. Galaxy Research head Alex Thorn flagged that some transactions were still sitting unconfirmed in Bitcoin's mempool, with the attacker signaling Replace-by-Fee (RBF) opt-in — giving victims a narrow window to attempt fee-bumping their own transactions to safety.
Across all four waves: approximately 1,815 BTC stolen from 5,294 addresses — roughly $114 million at current prices.
Affected Devices: What's at Risk
| Model | Firmware Versions Affected | Entropy Level | Fixed Version |
|---|---|---|---|
| Mk3 | v4.0.0 – v4.1.x | ~40 bits | v4.2.0+ |
| Mk4 | Before v5.6.0 | ~72 bits | v5.6.0+ |
| Mk5 | Before v5.6.0 | ~72 bits | v5.6.0+ |
| Q | Before v1.5.0Q | ~72 bits | v1.5.0Q+ |
Not affected: TAPSIGNER, OPENDIME, and SATSCARD — they use entirely different codebases.
Later models (Mk4, Mk5, Q) partially mitigated the issue by incorporating some randomness from a secure element, achieving ~72 bits of entropy. While significantly better than Mk3's 40 bits, this still falls far short of the expected 128-bit standard — and is potentially within brute-force range for well-resourced attackers.
Who Was Protected: The Security Layers That Actually Worked
Not everyone who used Coldcard during the vulnerable period lost funds. Three categories of users were largely protected:
Dice-roll seeds: Users who generated seeds with at least 50 private dice rolls added sufficient independent entropy to overwhelm the weak PRNG output. Their seeds were effectively unpredictable regardless of the firmware bug.
BIP-39 passphrase protection: A strong passphrase creates an entirely separate wallet derived from the seed words plus the passphrase. Since the passphrase is not stored on the device and isn't part of the seed phrase, attackers couldn't reconstruct the wallet even if they brute-forced the seed.
Multi-signature setups: In a 2-of-3 or 3-of-5 multisig configuration, the Coldcard seed represents only one of several required keys. Compromising a single seed is insufficient to move funds — the attacker would need to compromise all co-signers simultaneously.
This is a powerful case study in defense in depth: any one of these measures would have been sufficient to protect funds, yet most users relied on none of them.
The Historical Pattern: Entropy Failures Keep Recurring
The Coldcard incident is not an isolated failure. It follows a well-documented pattern of entropy catastrophes in cryptocurrency:
-
2013 – Android SecureRandom: A flaw in Android's
SecureRandomclass caused repeated nonces in ECDSA signatures, exposing private keys across multiple Bitcoin wallets on the platform. - 2022 – Profanity vanity address generator: Used only 32 bits of entropy for key generation, enabling an attacker to drain $160 million from Wintermute.
-
2023 – Milk Sad / Libbitcoin Explorer: The
bx seedcommand used a Mersenne Twister PRNG seeded by system time, collapsing 256 bits of expected entropy to roughly 32 — exposing over 120,000 wallets. - 2026 – Coldcard: A misconfigured macro silently replaced hardware randomness with a predictable software fallback for five years.
Different codebases. Different chains. Different years. The same structural failure: a randomness source assumed to be strong was not.
Coinkite's Response: Swift but Too Late for Existing Seeds
Coinkite CEO Rodolfo Novak (NVK) issued a public apology on July 31, accepting full responsibility:
"I'm sorry and I'm devastated. Our team is heartbroken about yesterday's news."
The company has:
- Halted all device shipments and destroyed unsold inventory carrying the flawed firmware
- Released fixed firmware for all affected models with proper hardware TRNG enforcement and build-time checks
- Cooperated with law enforcement in multiple countries
- Preserved old devices for forensic analysis rather than asking users to discard them
Critically, Coinkite's advisory is explicit: updating firmware does not repair existing weak seeds. A seed generated under the flawed system remains permanently vulnerable. Users must generate an entirely new seed on patched firmware and migrate all funds.
What Every Hardware Wallet User Should Do Now
Regardless of whether you own a Coldcard, this incident reveals universal lessons:
1. Verify Your Firmware Version
Check your device's firmware version immediately against the manufacturer's security advisories. If you're running a vulnerable version, plan your migration.
2. Never Trust a Single Layer of Security
The users who lost everything relied solely on the hardware wallet's default seed generation. Defense in depth — passphrases, dice rolls, multisig — is not paranoia. It's the minimum standard for significant holdings.
3. Audit Your Seed Generation Process
How was your seed generated? On what device? What firmware version? If you can't answer these questions with certainty, treat the seed as potentially compromised.
4. Demand Independent RNG Verification
Kraken's Chief Security Officer Nick Percoco highlighted a critical industry gap: hardware wallets lack independent testing standards for verifying which random number generator is actually running in production. Unlike other cryptographic devices, there's no certification process confirming that a wallet's entropy source meets its claims.
5. Consider Multi-Vendor Multisig
For treasury-level holdings, use devices from at least two different hardware vendors in a multisig configuration. This eliminates single-vendor firmware failures as an attack vector.
The Broader Implications for Self-Custody
The Coldcard catastrophe arrives during a period of record-setting crypto theft. H1 2026 saw 207 hack events and $972 million stolen globally — the highest semi-annual total ever recorded. According to TRM Labs, infrastructure and key compromises represented only 15% of incidents but accounted for 76% of total dollar losses.
Self-custody transfers risk rather than eliminating it. When you hold your own keys, the security of your entire position depends on the integrity of your key generation process — a process that most users have never audited, tested, or even thought about.
The Bitcoin protocol itself remains mathematically secure. No private keys were exposed on-chain. No transaction malleability issues were discovered. The failure was entirely in the implementation layer — the firmware running on a specific brand of hardware wallet.
But for the thousands of users watching their life savings disappear in coordinated transaction waves, that distinction offers little comfort.
Final Thoughts
The Coldcard incident will likely reshape hardware wallet security standards for years to come. Expect mandatory independent RNG certification, stricter firmware audit requirements, and a significant shift toward multisig as the default recommendation for non-trivial holdings.
The industry has been warned before — by Android's SecureRandom, by Profanity, by Milk Sad. Each time, the community acknowledged the lesson and moved on. Each time, the next entropy failure found a new way to exploit the same fundamental oversight: assuming that randomness is strong without verifying it.
In cryptography, assumption is the enemy. Verification is the only defense.
ChainSentinel provides on-chain security intelligence and forensic analysis for DeFi protocols, exchanges, and institutional custodians. Our monitoring infrastructure tracks exploit patterns, fund flows, and emerging threat vectors across major blockchains — helping defenders stay ahead of attackers.
Top comments (0)