Coldcard Seed Vulnerability: $100 Million Gone, and Every Model Is Affected

On Thursday night, July 30, 2026, someone swept 594 BTC from roughly 500 single-signature addresses in under 25 minutes. That was the first wave. By August 4, Galaxy Research had confirmed 1,596 BTC stolen from about 7,300 addresses across three major attack waves and 14 smaller incidents. A suspected fourth wave could push the total to 2,055 BTC, roughly 130 million dollars.

When I first wrote about this, the damage was 594 BTC and the flaw appeared limited to the Coldcard Mk3. I was wrong about the scope, and so was Coinkite's initial advisory. On August 1, Coinkite updated its security warning to include every device it sells. Mk2, Mk3, Mk4, Mk5, and Q are all affected. The Mk4, Mk5, and Q have less severe entropy loss, about 72 bits instead of the expected 128, but that is still serious. The Mk2 and Mk3 are worse, with Castle Labs co-founder Francesco telling Cointelegraph the entropy on affected Mk3 firmware may have been as low as 40 bits. A standard 12-word seed should have 128.

How the bug got in

Core Lightning developer Dustin Dettmer traced the likely origin to firmware changes made in 2021. His theory, which has become one of the leading explanations, is that code intended to interface with the hardware random number generator instead disabled it. When the secure element's true RNG was accidentally bypassed, seed generation fell back to MicroPython's Yasmarang pseudo-random number generator. That is a software PRNG, not a hardware entropy source, and it produced seeds with far less unpredictability than anyone realized.

Coinkite has not confirmed Dettmer's exact sequence but told Cointelegraph that "certain firmware versions had a fallback path in seed generation that could produce weak entropy when generated on the device firmware itself." The company says it will publish a full technical postmortem, but has not yet done so. The bug went undetected for more than five years while people trusted these devices with life-changing amounts of money.

Why nobody caught it

Ledger's director of product security, Vincent Bouzon, explained the core problem to Cointelegraph. "Weak randomness passes output tests." A broken RNG does not produce obviously broken output. It produces numbers that look random, smell random, and pass standard statistical tests. They just have a much smaller search space than they should, which means an attacker with enough compute can brute-force the keys offline without ever touching your device.

Jameson Lopp noted that RNG vulnerabilities have hit a long list of wallets and libraries over the years, from Blockchain.com's Android wallet to Trust Wallet. The 2023 Milksad vulnerability exploited a flawed RNG in the Profanity vanity address generator. The 2024 Libbitcoin bit seeder issue led to large-scale BTC theft from weak entropy. The pattern is always the same. The user trusts a black box to generate the most important secret they will ever own. Nobody can verify whether the implementation is correct because the RNG code runs inside a secure element that is closed source by design. When it fails, people lose money they cannot recover.

Firmware fixes are out for every model

Coinkite released fixed firmware for every affected device. Mk2 and Mk3 need version 4.2.0 or later. Mk4 and Mk5 need standard version 5.6.0 or later, or Edge version 6.6.0X or later. Q needs standard version 1.5.0Q or later, or Edge version 6.6.0QX or later. Standard and Edge are separate release tracks. If you run Edge, install the fixed Edge release for your model. Do not assume an older Edge 6.x release is fixed just because its version number is higher than the standard release.

Updating the firmware does not repair an existing seed. If your seed was generated on affected firmware, you need to migrate to a new wallet regardless of whether you have updated. A strong BIP-39 passphrase reduces immediate exposure because it adds independent entropy the attacker must also crack, but Coinkite's advisory now says passphrase users should also migrate as soon as practical. The passphrase does not fix the underlying seed.

If you added at least 50 independent, private dice rolls during seed creation, Coinkite does not consider your seed at risk from this RNG issue alone. The dice input contributed enough entropy to compensate. If you entered fewer than 50 rolls, or you do not remember, treat the seed as affected and migrate.

The AI angle

Dragonfly managing partner Haseeb Qureshi said roughly two dollars of AI hardening could have prevented the exploit. He was citing social media reports that some AI models rediscovered the vulnerability in under 20 minutes after it became public. The open-source GLM 5.2 model reportedly found it in 20 minutes with web access turned off. Claude was claimed to do it in eight minutes, though Tokenomist's data lead Tatsapat Saerejittima pushed back on that. The claim came from a pseudonymous Reddit user who scanned the code after the vulnerability was already public. There was no blind test and no documented methodology.

The AI rediscovery angle is interesting but somewhat beside the point. The root cause was trust in a black box, not a lack of compute. The entropy generation path was closed and unauditable for five years. AI tools will make it cheaper to find vulnerabilities faster, and that only increases the value of open verification.

What every Coldcard owner should do now

If you generated a seed on any Coldcard device using the default New Wallet flow on affected firmware, and you did not use dice rolls or a strong BIP-39 passphrase, move your funds. The attack is ongoing. Galaxy Research head Alex Thorn warned that unconfirmed transactions in the mempool may give some users a narrow window to broadcast a conflicting transaction with a higher fee before the attacker's transaction confirms. If you see suspicious outgoing transactions you did not authorize, this may be your last chance to move funds yourself.

Step one is to install the fixed firmware for your model. Step two is to generate a completely new seed on the updated device. Step three is to verify a receive address on the device screen, send a small test transaction, confirm it arrives, then move the rest. Keep the old backup until the migration is fully confirmed. Coinkite's advisory warns that rushing a wallet migration can create more immediate risk than the issue you are trying to address.

If you want to keep using an Mk2 or Mk3, firmware 4.2.0 now generates seeds correctly with the normal New Wallet flow. You can also use the dice-roll import path for verifiable entropy. Select Import Existing, then Dice Rolls, on an empty device. Enter at least 99 rolls, and the device hashes them directly without touching the RNG. This is the only way to generate a seed that does not depend on trusting the device's internal entropy at all.

The real lesson

The 1,596 BTC sweep targeted single-signature wallets exclusively. No multisig wallets were swept in the observed incidents. That is not a coincidence. Multisig spreads key generation across multiple devices. If one device has a weak RNG, the other keys compensate. A 2-of-3 setup with keys generated on different hardware brands means a single vendor's RNG failure cannot drain your funds.

Michael Tanguma, head of product at Onramp Bitcoin, told Cointelegraph that "the whole model rests on trust that the vendor got it right" and that "almost no individual can audit the hardware, the firmware and the entropy generation underneath their device." His recommendation is architectural. "You want multisig and independently generated entropy. Setups where no single device, vendor or institution being wrong can lose the funds."

Foundation Devices CEO Zach Herbert made the point that the bug itself was specific to Coldcard, but the larger warning is that it went unnoticed for more than five years while people trusted the product with life-changing amounts of money. Foundation's Passport wallet combines randomness from separate hardware components and publishes firmware as open source with reproducible builds, so independent researchers can verify the code running on the device matches what was published. Trezor combines device-generated randomness with host computer entropy and includes entropy checks to confirm the device actually contributed unpredictable randomness. Ledger relies on a certified secure element under AIS-31 PTG.2 standard with Common Criteria certification.

I wrote about the Coldcard Q and its hardware advantages earlier this year. The Q is still a well-designed device physically. But the entropy bug has changed the calculus. If you are buying a hardware wallet right now, the question is not just about features and build quality. It is about whether you can verify how the device generates the most important secret you will ever own.

Coinkite's full advisory and firmware links are on their blog. Galaxy Research's tracking of stolen funds is ongoing, with 90 percent of the stolen Bitcoin still unmoved as of August 4. Galaxy has shared attacker and victim addresses with US federal law enforcement, crypto exchanges, and cyber-investigation companies.

In self-custody, the most dangerous vulnerability is the code you will never get to read. Five years of trust, 130 million dollars, and the fix was already inside the device. Nobody could see it was turned off.