URGENT: Are You Affected?
If you generated a Coldcard wallet seed between March 2021 and July 2026, your seed may be compromised regardless of your current firmware version. Update firmware and migrate funds to a new seed immediately. A firmware patch does not strengthen a seed already generated with weak entropy. Do not wait.
TL;DR
▶ Beginning July 30, 2026, attackers exploited a five-year-old firmware flaw in Coinkite’s Coldcard hardware wallet, draining 1,816 BTC worth approximately $116 million from more than 5,200 addresses.
▶ The flaw: a build configuration error in firmware version 4.0.1 (March 2021) caused seed generation to fall back on a weak software random number generator instead of the device’s hardware entropy source.
▶ Effective entropy collapsed from a designed 128 bits to approximately 40 bits on Mk3 devices and 72 bits on Mk4/Mk5/Q models. 40 bits is brute-forceable on ordinary hardware.
▶ Victims did everything right. Wallets were offline. Seeds were protected. None of that matters if the key was weak from the moment it was generated.
▶ Who was NOT affected: users who generated seeds using at least 50 private dice rolls, or who applied a strong BIP-39 passphrase on top of the generated seed.
▶ The fix: update to the latest Coldcard firmware, generate a completely new seed, and migrate all funds. Updating firmware alone does not fix an already-compromised seed.
The Coldcard hardware wallet hack that began July 30, 2026 is the largest theft from self-custody Bitcoin storage in history. Attackers drained 1,816 BTC worth approximately $116 million from more than 5,200 addresses without ever touching the physical devices. They did it by exploiting a flaw that had existed silently inside Coldcard’s firmware for five years, one that made supposedly unguessable private keys mathematically predictable.
The victims in this attack did nothing wrong in the conventional sense. Their Coldcard devices never connected to the internet. Their seed phrases were stored securely offline. Their private keys were never exposed. One victim, Jonathan Goodman, who lost C$1.6 million, described it to TechCrunch: “I did everything right. My devices never touched the internet. All because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability.”
This is a different category of hardware wallet failure from anything the industry has seen before. It is not a phishing attack. It is not a supply chain compromise of a physical device. It is not a social engineering attack on a user. It is a key generation entropy failure that made every seed generated through a specific code path during a specific five-year window mathematically weaker than advertised. This article explains exactly what happened, who is affected, what the technical flaw was, and what to do about it.
What Is Entropy and Why Does It Matter for Bitcoin Security?
The dice analogy: why randomness is everything
When you generate a Bitcoin private key, you are essentially rolling a very large set of dice. The result needs to be so unpredictable that no computer on earth could guess it. A properly generated 128-bit key has 340 undecillion possible values. At a trillion guesses per second, it would take longer than the age of the universe to brute force. But if the dice are loaded, if the randomness behind the key is weak, the number of possibilities collapses. At 40 bits of effective entropy, the search space shrinks to about one trillion possibilities. Modern hardware can enumerate that in hours or days. The flaw in Coldcard’s firmware loaded the dice against its users without them knowing.
Bitcoin private keys are generated using a random number generator (RNG). The quality of that randomness, measured in bits of entropy, determines how unpredictable the key is. A properly seeded hardware RNG draws entropy from physical processes: thermal noise, electromagnetic fluctuations, timing jitter in the device’s circuits. These are genuinely unpredictable. A software pseudorandom number generator (PRNG) draws from a mathematical algorithm seeded by something deterministic, like the device’s serial number and its clock. If an attacker knows what the seed was, they can reproduce the output.
The BIP-39 standard, which governs the 12 or 24-word seed phrases used by most hardware wallets including Coldcard, is designed to encode 128 bits of entropy for a 12-word phrase and 256 bits for a 24-word phrase. At those levels, brute-forcing a seed is computationally infeasible for any attacker, including nation-states. At 40 bits of effective entropy, as TRM Labs and Block’s analysis found on affected Coldcard Mk3 devices, the search space drops to roughly one trillion candidates. A cluster of modern GPUs can search that space in hours.
The Exact Technical Flaw: What Went Wrong in March 2021
In March 2021, Coinkite released Coldcard firmware version 4.0.1 as part of a migration to a library called libngu. During this migration, the function call that handled seed generation was updated to use ngu.random.bytes(). This function was supposed to resolve to Coldcard’s hardware true random number generator (TRNG), the STM32 chip’s dedicated entropy source.
The bug: a build configuration macro called MICROPY_HW_ENABLE_RNG was set to zero in Coinkite’s production build configuration, because Coinkite supplies its own hardware RNG wrapper. The libngu library checked whether this macro existed, not whether it was enabled. Since the macro existed (set to zero), the check passed. The library then resolved ngu.random.bytes() to MicroPython’s Yasmarang PRNG, a software pseudorandom number generator, instead of the hardware entropy source.
Yasmarang is a deterministic algorithm. It produces the same output given the same input. On Coldcard hardware, it was initialised from the chip’s unique ID and timer registers and collected no fresh entropy after initialisation. Every seed phrase generated through this code path was therefore the output of predictable software math rather than unpredictable hardware noise. The effective entropy on Mk3 devices collapsed to approximately 40 bits. On Mk4, Mk5, and Q devices the reseed mechanism raised this to approximately 72 bits, still far below the intended 128 bits.
Coldcard Effective Entropy by Device Model: Design vs Reality
Sources: Coinkite advisory, Block technical analysis, TRM Labs | @cryptonewsbytes
| Device Model | Designed Entropy | Actual Entropy (Affected) | Brute Force Difficulty |
|---|---|---|---|
| Coldcard Mk3 | 128 bits | ~40 bits | ~1 trillion candidates. Feasible in hours with modern GPU cluster. |
| Coldcard Mk4, Mk5, Q | 128 bits | ~72 bits | ~4 billion candidates. Searchable. Cost depends on UID info availability. |
| Any Coldcard (dice rolls) | 128+ bits | 128+ bits | Not affected. External entropy bypasses the flawed PRNG entirely. |
Note: Block’s analysis sets conditional ceilings and warns that 72 bits is not equivalent to 72-bit cryptographic security due to UID information availability. Sources: Coinkite advisory, Block technical report, TRM Labs July 2026 | @cryptonewsbytes
The Three Attack Waves: How $116 Million Was Drained
Galaxy Research mapped the on-chain activity and identified three confirmed attack waves beginning July 30, 2026, with a suspected fourth wave under investigation.
Wave 1 was the most precise and fastest. On July 30, an attacker drained 1,082 BTC from 1,196 addresses in 41 minutes, representing approximately $70.2 million. The speed and precision of Wave 1, 1,196 addresses swept in 41 minutes, suggests pre-computed targets. The attacker had already identified which addresses were generated with weak entropy, computed their private keys offline, and executed the sweep in a single coordinated operation.
Wave 2 followed with additional addresses drained over subsequent days. Galaxy Research noted that Waves 1 and 2 may share an operator based on transaction patterns but cautioned against assuming certainty. Wave 3 showed different transaction characteristics and should not be assumed to involve the same attacker as Waves 1 and 2. TRM Labs’ confirmed total across all waves is 1,816 BTC worth approximately $116 million from more than 5,200 addresses. Galaxy Research’s confirmed figure is 1,596 BTC with a suspected fourth wave that could raise the total to approximately 2,055 BTC or $130 million.
A notable characteristic of the stolen funds as of mid-August 2026: minimal laundering. Stolen Bitcoin is pooling in a small number of attacker-controlled addresses with no significant layering or mixing activity. TRM Labs has flagged approximately 600 suspected attacker-controlled addresses to federal investigators, compliance firms, and cybersecurity investigators. The lack of immediate laundering may reflect attacker confidence that the funds cannot easily be traced back to identifiable individuals, or a deliberate holding strategy ahead of eventual conversion.
Coldcard Hack: Attack Timeline and Loss Progression
Sources: Galaxy Research, TRM Labs, Block technical report | @cryptonewsbytes
Sources: TRM Labs blog July-August 2026 (primary), Galaxy Research on-chain analysis, Block technical report | @cryptonewsbytes. Not financial advice.
Who Was Affected and Who Was Not
The affected population is specific. You are at risk if all three of the following are true: you own a Coldcard Mk3, Mk4, Mk5, or Q device; you generated your wallet seed between March 2021 and the firmware patch in July 2026; and you did not use a minimum of 50 private dice rolls or a strong BIP-39 passphrase when generating the seed.
POTENTIALLY AFFECTED
Generated a Coldcard seed between March 2021 and July 2026
Used the device default seed generation (no dice rolls)
Did not apply a BIP-39 passphrase on top of the generated seed
Wallet has not moved in years but seed was generated in the affected window
NOT AFFECTED
Used at least 50 private dice rolls to generate the seed
Applied a strong BIP-39 passphrase on top of the device-generated seed
Generated seed before March 2021 (pre-flaw firmware)
Generated seed after the July 2026 firmware patch on updated hardware
Used a different hardware wallet (Ledger, Trezor, BitBox)
The dice roll exception: why it matters
Coldcard allows users to supplement device entropy with physical dice rolls before seed generation. If a user rolled dice at least 50 times and entered the results during seed creation, the external entropy from the dice rolls overrides the flawed software PRNG entirely. The resulting seed has full 128-bit entropy regardless of the firmware flaw. Almost nobody does this by default because the device presents standard seed generation as sufficient. Users who knew to do it, typically security researchers or Bitcoin maximalists familiar with entropy fundamentals, were protected. Everyone else was not.
What to Do Right Now If You Own a Coldcard
Step 1: Check Your Firmware Version and Generation Date
Coinkite has published guidance on how to check whether your device’s current session log shows a seed was generated during the affected firmware period. If you are unsure when you generated your seed, treat it as potentially affected.
Tip: Log into Coinkite’s support resources at coldcard.com to access the official advisory and check your device.
Step 2: Update to the Latest Firmware
Update your Coldcard to the latest firmware version immediately. The patch corrects the entropy source for all future seed generation. Updating does not fix an already-generated compromised seed, but it ensures any new seed you generate will be secure.
Tip: Download firmware only from the official Coldcard website at coldcard.com. Verify the firmware signature before installation.
Step 3: Generate a Completely New Seed on Updated Hardware
After updating firmware, generate a completely new seed phrase. Ideally use 50 or more dice rolls to supplement device entropy during generation. Write down the new seed phrase offline. Do not photograph it or store it digitally.
Tip: This new seed will be generated using the corrected entropy source and will have full 128-bit security.
Step 4: Verify the New Wallet Before Migrating
Before transferring any funds, verify your new wallet by checking the wallet fingerprint and a receive address. Send a small test transaction first and confirm it arrives before moving the full balance.
Tip: This step confirms the new seed and wallet are working correctly before you expose your full balance to a migration.
Step 5: Migrate All Funds From the Old Wallet
Transfer all Bitcoin from your old wallet to your new wallet address. Once confirmed on-chain, the old seed is empty and can be retired. Do not use the old seed for any future transactions.
Tip: If your old wallet shows a zero balance but you have not yet generated a new seed, generate one now anyway. Attacker enumeration may continue on wallets they have not yet reached.
What This Means for Hardware Wallet Security: The Bigger Picture
Ledger Security VP Vincent Bouzon was quoted in Forbes’ coverage: “Every wallet ultimately depends on a root secret generated from high-quality entropy.” That sentence is the clearest summary of the lesson the Coldcard hack teaches. The security model of self-custody Bitcoin storage rests on one assumption above all others: the key generation process was trustworthy. If that assumption fails, every subsequent security measure, offline storage, seed phrase protection, hardware device physical security, is built on a compromised foundation.
The Coldcard hack is also a lesson in how software engineering errors propagate in security-critical systems. A single line in a build configuration file, a macro set to zero rather than absent or enabled, caused a supporting library to silently fall back to an insecure code path. The error was present for five years across multiple firmware releases. It survived code reviews, security audits, and user testing. Coldcard CEO Rodolfo Novak suggested AI might be finding such bugs more efficiently than human reviewers, though security researchers attributed the flaw to human engineering error in library migration.
The Hacken Q2 2026 Security Report CNB covered identified that 88% of crypto losses in Q2 2026 came from operational failures rather than smart contract exploits. The Coldcard hack fits squarely in that category: not a protocol vulnerability, not a user error, but a failure in the infrastructure layer that users trusted implicitly. The LinkedIn post that prompted this article made the point precisely: this applies beyond crypto to API keys, machine identities, certificates, and encryption keys across the entire digital security landscape. Key provenance is a security primitive, not a secondary concern.
The multisig lesson
For significant Bitcoin holdings, one hardware wallet should not represent the entire trust model. A 2-of-3 multisig arrangement using independently generated keys from independently manufactured devices means that a flaw in one device’s key generation does not compromise the entire holding. To spend the Bitcoin, an attacker would need to compromise keys from at least two independent sources. The Coldcard hack would have been far less severe for multisig holders because even a perfectly brute-forced Coldcard key would represent only one of the required signatures. Multisig is not overcomplicated for high-value holdings. It is proportionate.
Frequently Asked Questions
What is the Coldcard hack and what happened?
Beginning July 30, 2026, attackers exploited a five-year-old firmware flaw in Coinkite’s Coldcard hardware wallet to drain 1,816 BTC worth approximately $116 million from more than 5,200 addresses. The flaw was a build configuration error in firmware version 4.0.1 (March 2021) that caused seed generation to use a weak software random number generator instead of the device’s hardware entropy source, reducing key strength to a level that could be brute-forced.
How did the Coldcard entropy flaw work?
A build configuration macro called MICROPY_HW_ENABLE_RNG was set to zero in Coinkite’s production build. A supporting library checked whether this macro existed (it did, set to zero) rather than whether it was enabled, and resolved the seed generation function to MicroPython’s Yasmarang software PRNG instead of the hardware RNG. Yasmarang is deterministic and was seeded from predictable data (chip serial number and timer registers), giving effective entropy of approximately 40 bits on Mk3 devices rather than the intended 128 bits.
Is my Coldcard wallet affected?
You may be affected if you generated a wallet seed on a Coldcard Mk3, Mk4, Mk5, or Q device between March 2021 and the July 2026 firmware patch, and you did not use at least 50 private dice rolls or apply a strong BIP-39 passphrase during seed generation. If you are unsure, treat your seed as potentially compromised and migrate to a new wallet generated on updated firmware.
Does updating Coldcard firmware fix the problem?
No. Updating firmware corrects the entropy source for future seed generation but does not change the entropy of a seed already generated. If your seed was generated during the affected window with weak entropy, that seed remains weak regardless of your current firmware version. You must generate a completely new seed on updated firmware and migrate all funds to the new wallet.
Who was NOT affected by the Coldcard hack?
Users who generated seeds before March 2021 (pre-flaw firmware), after the July 2026 patch on updated hardware, or who used at least 50 private dice rolls during seed generation were not affected. Users who applied a strong BIP-39 passphrase on top of their device-generated seed significantly increased the effective security even if the underlying seed had weak entropy. Users of other hardware wallets (Ledger, Trezor, BitBox) were not affected.
What should I do right now if I own a Coldcard?
Update to the latest Coldcard firmware immediately. Generate a completely new seed on the updated device, ideally with 50 or more dice rolls to supplement device entropy. Verify the new wallet by checking the address and sending a small test transaction. Then migrate all funds from your old wallet to the new one. Do not use the old seed for any future transactions once the migration is complete.
Further Reading
The Hacken Q2 2026 Security Report identified operational key failures as the dominant attack surface. The Coldcard entropy flaw is precisely the infrastructure-layer failure Hacken’s framework describes.
Another July 2026 attack where trusted infrastructure failed: the Wanchain bridge encoding flaw that drained NIGHT tokens. Two incidents in one month where the failure was in the trusted layer, not user behaviour.
A third July 2026 infrastructure failure: a key leaked through GitHub configuration rather than compromised in transit. Key provenance and storage are both part of the security boundary.
Sources: TRM Labs blog August 2026: The Largest Hardware Wallet Exploit of 2026 (trmlabs.com, primary), Block technical report: Coldcard entropy flaw analysis (block.xyz, primary), Galaxy Research on-chain analysis July-August 2026 (galaxy.com, primary), Coinkite official advisory coldcard.com, The Hacker News August 4 2026, Forbes August 4 2026 (Boaz Sobrado), Fortune August 3 2026, spotedcrypto.com August 20 2026 (confirmed totals) | Published August 26, 2026 | CryptoNewsBytes.com | Not financial or legal advice.
