On July 30, an attacker drained 1,196 Bitcoin addresses in just 41 minutes. At the time, the sweep totaled 1,082.65 BTC, worth roughly $70.2 million. New mapping by Galaxy Research linked the activity to a specific Coldcard hardware wallet flaw that affected how certain wallets created cryptographic seeds.
What makes this case especially concerning is the attacker’s apparent ability to reproduce likely seed outputs without needing ongoing access to a victim’s device. That shifts the threat model from “steal the wallet” to “exploit predictable randomness during seed creation.”
Below is what researchers say happened, which Coldcard models and firmware ranges were implicated, and the practical steps owners are advised to take.
What the reported Coldcard hardware wallet flaw did
According to the analysis, the root issue traces back to a firmware integration problem from March 2021. Instead of using the device’s intended STM32 hardware random number generator (RNG), an integration path routed seed generation to a deterministic software pseudorandom number generator (PRNG).
In practical terms, deterministic generation can be dangerous if attackers can constrain or learn enough inputs. The report states that an adversary who can determine—or sufficiently narrow down—elements such as the device identifier (UID), timer state, and the prior PRNG-call history may reproduce candidate outputs offline.
Once candidates are generated, the attacker can test them by deriving addresses and comparing the results against public blockchain data. If a candidate seed produces an address that matches the victim’s activity, the attacker can take over funds corresponding to those derivations.
How the theft likely worked in the real world
Galaxy Research mapped the sweep and connected it to the suspected entropy weakness. They also noted that they did not see other Bitcoin transactions in the prior 30 days with the same 30 sat/vB, no-change signature—details that help characterize the operator’s on-chain behavior.
However, Galaxy cautions that a sweeping transaction pattern can resemble a legitimate user moving coins. In other words, the pattern can indicate the actor operating the sweep, not necessarily the identity of the thief.
The speed of the drain suggests the attacker could quickly compute candidate seeds and then sweep funds once a match was found, rather than waiting for long-term compromise.
Why installing the emergency firmware may not “fix” old seeds
Coinkite shipped emergency firmware updates for every affected model and release track on July 31. But researchers and the vendor emphasize a key limitation: updating firmware alone does not repair an existing seed.
That’s because the weakness concerned how the seed was generated at creation time. If the seed already came from a compromised or constrained randomness path, later firmware cannot retroactively change the seed’s underlying words.
Coinkite’s guidance to exposed owners is to generate a new seed on the patched firmware and move the funds to the new wallet. Keeping the old seed, even after upgrading, preserves the same underlying weakness.
Why restoring the old seed keeps the problem
Some users might expect that importing the same seed into updated firmware or a different wallet would “normalize” the randomness. The report says that does not help: restoring an old seed into an updated environment carries the weakness forward.
The vulnerability is not in the firmware that later signs transactions. It’s in the entropy that produced the seed’s deterministic output stream in the first place.
Importantly, no public report in the disclosure claims that someone successfully reconstructed a victim’s exact seed and matched it to a drained address during the public investigation window.
Which Coldcard models and versions were affected
The exposure depends on the firmware that was running when the seed was created, not the current version installed. The report lists the vulnerable ranges by model.
Mk2 and Mk3
- Coinkite lists Mk3 versions 4.0.1 through 4.1.9 as fixed in 4.2.0 and does not name Mk2.
- The report places both Mk2 and Mk3 versions 4.0.0 through 4.1.9 on the vulnerable path.
Mk4 and Mk5
- Anything before 5.6.0.
Q
- Anything before 1.5.0Q.
Edge builds
- Mk4 and Mk5: before 6.6.0X
- Q: before 6.6.0QX
Because the vulnerable window is version- and model-dependent, owners are advised to check when their seed was generated relative to these ranges.
What researchers say about seed entropy
Entropy estimates help explain how feasible offline guessing might be. Coinkite estimates effective entropy at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5, and Q. For comparison, a 12-word BIP-39 seed is often treated as having 128 bits of entropy (under assumptions of uniformly random generation).
Block’s analysis does not provide one simple, practical figure. Instead, it reports conditional ceilings—values that help reason about worst-case feasibility. It also warns that higher-level bit counts in analysis are not necessarily equivalent to cryptographic security guarantees at face value.
The disclosure also notes that no brute-force benchmark was published. That matters because “bits of entropy” alone does not always translate neatly into real-world runtime costs.
Why the attacker’s cost could vary
Even with a weakened randomness path, the attacker’s workload depends on the constraints they can obtain. The report says practical cost depends on factors including:
- How much information is available about the UID
- How accurately boot timing and device state can be constrained
- The known or inferred history of prior RNG calls
- The cost of address derivation for each candidate seed
Richer constraints reduce the candidate space. Conversely, uncertainty can make searching more expensive.
How Coinkite explained the engineering cause
Block traces the issue to a production configuration. The report states that a macro defining MICROPY_HW_ENABLE_RNG was set to zero in the build because Coinkite supplies its own hardware-RNG wrapper.
However, a library check appears to have validated the presence of the macro rather than whether it was enabled. That behavior bound the build to MicroPython’s Yasmarang fallback.
The fallback then relied on entropy sources initialized from the chip’s unique identifier and timer registers, and it did not collect fresh entropy after initialization—creating the deterministic path relevant to seed generation.
What Coinkite recommended to users
Coinkite states that a seed created using at least 50 fair, independent, private dice rolls is not at risk from this bug alone. If the number or privacy of those rolls is uncertain, Coinkite recommends migrating.
In addition, the company notes that using a strong, unique BIP-39 passphrase creates a separate wallet that the seed words alone cannot reach. Even so, the guidance still emphasizes replacing the seed when exposure is suspected.
Finally, the disclosure highlights that multisig helps only in specific circumstances: it helps when the quorum is not built entirely from affected devices.
Why other related devices were not affected
The report also clarifies scope. Devices with different codebases—such as TAPSIGNER, OPENDIME, and SATSCARD—are described as unaffected by this specific bug.
That distinction matters for users who operate multiple hardware products or who manage keys across different ecosystems.
Update: additional waves increase the suspected losses
After the initial findings, Galaxy Research identified two additional suspected waves of Coldcard-linked sweeps. This raised its observed estimate to 1,367.05 BTC, worth about $88.6 million, spanning 4,585 addresses.
Galaxy suggests Waves 1 and 2 may share the same operator based on transaction patterns. At the same time, it warns that Wave 3 should not automatically be assumed to involve the same attacker.
Galaxy also cautions that its results are based on on-chain analysis, and it has not computationally confirmed that every identified address was generated with weak Coldcard entropy.
The firm says the activity appears to remain ongoing and reports that it has provided roughly 600 suspected attacker-controlled addresses to federal investigators, compliance firms, and cybersecurity investigators.
Separate context: earlier weak PRNG research
The disclosure follows earlier research by Coinspect in early July. That work, referred to as “Ill Bloom,” described a separate weak-PRNG flaw in older software wallets tied to more than $5 million drained across multiple networks including Bitcoin, Ethereum, Tron, Rootstock, and Polygon since May.
While that earlier incident is separate, it reinforces a broader theme: randomness failures—especially during key or seed generation—can cascade into large-scale theft.
Bottom line for owners: focus on when your seed was created
The key takeaway from this Coldcard hardware wallet flaw is simple: patched firmware doesn’t retroactively fix vulnerable seeds. What matters is the firmware that was running at the moment your seed was created.
If you fall into an affected model/version range—or if you’re unsure—review Coinkite’s migration guidance. Create a new seed on the patched firmware, move funds, and avoid assuming that restoring the old seed eliminates the risk.
As Galaxy’s follow-up analysis indicates, attackers may have been able to exploit the weakness at speed. Taking action now can reduce the chance that your funds remain within reachable derivation paths.
Source: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html
