A five-year-old firmware mistake in Coldcard hardware wallets has turned into one of the largest known Bitcoin seed-related thefts, with attackers stealing at least 1,596 BTC from thousands of addresses.
The losses could rise to approximately 2,055 BTC, worth close to $130 million, if investigators confirm a suspected fourth attack wave.
What makes the incident especially concerning is that attackers did not need physical access to the affected wallets. They did not steal devices, guess PINs, or exploit the Bitcoin network. Instead, a flaw in Coldcard’s random-number generation made some wallet seed phrases predictable enough to reconstruct offline.
The breach has now triggered a broader examination of Bitcoin wallet security. AI-assisted audits have reportedly uncovered 85 additional critical findings across wallet implementations and cryptographic libraries, suggesting that weak entropy handling may be a much wider industry problem.
Coldcard Attackers Stole 1,596 BTC Across Thousands of Addresses
The most serious attack began on July 30, 2026, when more than 1,082 BTC was removed from 1,196 wallet addresses in roughly 41 minutes.
Galaxy Research later confirmed three major attack waves and several smaller incidents involving approximately 7,300 addresses.
Together, the confirmed thefts reached around 1,596 BTC.
Researchers are also investigating a suspected fourth wave involving approximately 448.7 BTC from another 709 addresses.
If those losses are verified through victim reports, the total stolen amount could climb to roughly 2,055 BTC.
At the valuations cited in the report, that would place total losses close to $130 million.
Attack Did Not Require Physical Wallet Access
The Coldcard breach differs from many hardware wallet attacks because criminals did not need to possess the devices.
They also did not need victims to approve transactions or reveal passwords.
Instead, attackers were able to recreate weakened wallet seeds using information generated by vulnerable Coldcard firmware.
Once the seed phrase was reconstructed, the attacker could derive the same private keys used by the victim.
That allowed stolen funds to be transferred from anywhere without interacting with the hardware wallet itself.
The Bitcoin blockchain and cryptographic protocol remained intact.
The weakness existed entirely within the way certain Coldcard devices generated their wallet seeds.
The Flaw Was Introduced in March 2021
The vulnerability dates back to a Coldcard firmware update released during March 2021.
Coinkite, the Canadian company behind Coldcard, was integrating a cryptographic library called libngu into its firmware.
During that process, a conditional programming error caused the seed-generation function to use a software pseudo-random number generator instead of the hardware-backed source of randomness built into the device.
Coldcard devices were intended to use the STM32 hardware true random number generator when creating seed phrases.
Instead, affected firmware sometimes relied on a deterministic MicroPython generator known as Yasmarang.
That substitution dramatically weakened the randomness protecting some wallet seeds.
A Small Programming Error Created a Major Security Failure
The technical issue involved the way the firmware checked whether a random-number generator was available.
Affected Coldcard configurations defined a setting called MICROPY_HW_ENABLE_RNG with a value of zero.
The libngu code used a #ifndef check.
This type of check only determines whether the setting exists, rather than checking whether its value is actually enabled.
Because the setting existed even though it was set to zero, the software interpreted the configuration incorrectly.
As a result, the wallet seed-generation process silently connected to the weaker deterministic generator.
This type of error can be difficult to spot during normal code reviews because the intended hardware RNG was still present and working in other parts of the firmware.
Hardware RNG Continued Working Elsewhere
One reason the problem remained hidden for years is that Coldcard’s hardware random-number generator was not completely broken.
It continued operating normally in other firmware functions.
An auditor reviewing the source code could therefore see the hardware RNG being called and reasonably assume it was functioning correctly.
The critical failure affected one especially important path: wallet seed creation.
That meant a device could appear to have a working hardware entropy source while still generating vulnerable wallet seeds.
Coinkite reportedly said it did not know the MicroPython fallback was being used in this specific code path until the investigation began.
Block Independently Confirmed the Vulnerability
Block’s Bitcoin engineering and security team independently reviewed the Coldcard firmware and reached the same conclusion.
Its researchers traced the conditional compilation logic and confirmed that vulnerable firmware could call the deterministic Yasmarang generator instead of the STM32 hardware random-number generator during seed creation.
Block published its findings before completing every possible empirical test because active theft reports had already emerged.
The independent confirmation strengthened the evidence that the vulnerability was caused by weak seed generation rather than a separate attack method.
Older Coldcard Seeds May Have Had Only 40 Bits of Entropy
The severity of the weakness depended on the Coldcard model.
According to the technical analysis, seed phrases created on affected Mk2 and Mk3 devices may have contained only about 40 bits of effective entropy.
A properly generated Bitcoin wallet seed is intended to provide around 128 bits of security.
Forty bits represents an enormous reduction.
Instead of an unimaginably large search space, an attacker may have needed to examine roughly one trillion possibilities before applying additional information to narrow the range further.
For modern computing hardware, that difference can make an attack far more realistic.
Newer Models Still Fell Well Below Intended Security
Affected Mk4, Mk5 and Coldcard Q devices received some additional randomness from a secure element.
However, the contribution was reportedly reduced before being incorporated into the software generator.
Researchers estimated that these wallets may have achieved around 72 bits of effective entropy.
Although 72 bits is substantially stronger than 40 bits, it still falls far short of the intended 128-bit protection.
The report described the weakened setup as roughly 72 quadrillion times less secure than the expected design.
The exact practical cost of attacking each device may vary depending on additional information available to the attacker.
How Attackers Could Reconstruct Coldcard Wallet Seeds
A secure Bitcoin seed generated with 128 bits of uniform randomness is considered computationally impractical to guess.
A weakened seed drawn from a much smaller range is different.
An attacker who understands how the faulty random-number generator behaves can generate possible seed values offline.
For each possible seed, the attacker can derive Bitcoin addresses and compare those addresses with addresses already visible on the public blockchain.
When a generated address matches a real wallet, the attacker has potentially found the corresponding seed.
From there, they can recreate the private keys and authorize transactions.
The victim does not need to be online or interact with the attacker at any point.
Public Blockchain Data Helps Attackers Test Guesses
Bitcoin’s transparency becomes useful to attackers in this type of scenario.
Wallet addresses and transaction histories are publicly visible.
That means attackers can calculate addresses produced by candidate seeds and automatically compare them with known addresses containing funds.
If a match appears, the attacker knows the candidate seed is associated with a real Bitcoin wallet.
This does not represent a weakness in Bitcoin itself.
The blockchain is behaving exactly as designed.
The failure occurs because the wallet created its private keys from insufficient randomness.
Attack Cost Still Depends on Several Factors
Researchers have not published a complete end-to-end benchmark showing exactly how much computing power would be needed to compromise every affected Coldcard model.
Block noted that exploitability depends on additional variables such as:
- Microcontroller identifier information
- Device boot timing
- Random-number generator call history
- Coldcard model
- Firmware version
These factors can help attackers reduce the number of possible seeds they need to test.
The practical attack difficulty may therefore vary between devices.
Still, the confirmed thefts show that the vulnerability was serious enough to be exploited successfully.
At Least 15 Attackers May Be Involved
Galaxy Research’s blockchain analysis suggests that the Coldcard thefts were not necessarily carried out by a single criminal.
The firm identified at least 15 separate attackers across the observed activity.
Blockchain patterns can help researchers group transactions and identify behavioral differences between wallets controlled by different actors.
However, on-chain evidence alone cannot definitively prove how many people are involved.
Multiple wallets could be controlled by the same individual, or several criminals could be using similar techniques independently.
The important point is that knowledge of the vulnerability appears to have spread beyond a single attacker.
First Attack Wave Drained More Than 1,082 BTC
The first major wave occurred on July 30.
Approximately 1,082.65 BTC was removed from 1,196 addresses over a period of about 41 minutes.
The pace of the theft immediately stood out from normal Bitcoin wallet activity.
Galaxy calculated that the most aggressive period reached approximately 13.8 wallet drains per Bitcoin block.
A pre-incident baseline showed only around 0.3 comparable drains per block.
That made the attack activity roughly 45 times higher than the earlier baseline.
Fourth Wave Could Add Another 448.7 BTC
Galaxy head of research Alex Thorn identified activity on Aug. 3 that appeared similar to the earlier Coldcard attack waves.
The suspected fourth wave involved approximately 448.7 BTC moving from 709 addresses.
However, Galaxy has not yet fully classified those losses as confirmed Coldcard thefts.
Additional reports from affected wallet owners would help investigators connect those addresses to vulnerable devices.
If verified, the fourth wave would bring the estimated total to approximately 2,055 BTC.
That figure could still change as more victims report losses and researchers refine their address mapping.
Largest Theft Involved 1,159 BTC
The biggest individual theft identified in the investigation involved approximately 1,159 BTC spread across seven addresses.
According to the report, those funds remained unmoved as of Aug. 5.
This gives exchanges, blockchain analytics companies and law enforcement agencies an opportunity to flag the addresses before the attacker attempts to convert or launder the Bitcoin.
Unmoved stolen funds are easier to monitor than cryptocurrency being rapidly transferred through hundreds of addresses.
However, the attacker can choose to move the Bitcoin at any time.
Some Stolen Bitcoin Has Already Entered Mixing Activity
At least one smaller attacker reportedly began attempting to conceal stolen funds.
Around 64 BTC was routed toward a cryptocurrency mixer.
Approximately 10 BTC reportedly entered an initial mixing round, while the remaining amount was divided into smaller outputs of around 7 BTC.
Mixers are designed to make transaction tracing more difficult by combining or redistributing cryptocurrency from different sources.
Blockchain investigators can sometimes continue tracing funds after mixing, but the process becomes more complicated.
The longer stolen Bitcoin remains unmoved, the better the opportunity authorities have to prepare alerts for exchanges and other services.
About 90% of Stolen Bitcoin Remains Unmoved
Galaxy estimated that roughly 90% of the stolen Bitcoin had not yet moved.
This creates an important investigative window.
Exchanges can flag known attacker addresses and potentially freeze funds if they are eventually deposited into regulated accounts.
Investigators can also monitor activity involving bridges, mixers and over-the-counter services.
Galaxy reportedly distributed around 600 flagged attacker and victim addresses to exchanges and U.S. federal law enforcement agencies.
The effectiveness of these efforts will depend heavily on how and where attackers eventually move the Bitcoin.
Canadian Users Account for a Significant Share of Losses
Chainalysis analysis reportedly found that Canadian Bitcoin holders represented approximately 25% of attributable losses.
Coinkite is based in Canada, which may partly explain why Coldcard has a significant user base there.
The geographic distribution of affected users may become important as law enforcement agencies coordinate recovery efforts across multiple jurisdictions.
Crypto theft investigations can involve exchanges, courts and authorities in several countries because attackers can move funds globally within minutes.
Why the Coldcard Bug Survived for Five Years
The incident has raised serious questions about how hardware wallet security is audited.
Traditional security reviews often verify whether the expected cryptographic components are present in the source code.
They may confirm that:
- A hardware RNG exists
- The RNG can be called
- Seed-generation code references an entropy source
- Secure elements function properly
- Cryptographic libraries are implemented correctly
However, those reviews may not always verify what actually happens in every compiled firmware configuration.
Coldcard’s bug existed precisely in that gap.
The correct RNG existed in the code, but wallet generation could resolve to a different function after compilation.
Source Code Reviews May Not Be Enough
Reading source code is an important part of security auditing, but production behavior can differ depending on compilation flags, hardware configurations and conditional logic.
In the Coldcard case, the problematic behavior emerged because of how a macro was interpreted during compilation.
A reviewer examining the code manually might see the correct hardware RNG and assume seed generation was using it.
Testing the actual compiled firmware could have revealed that a different generator was being called.
The incident therefore strengthens the case for testing real production devices rather than relying only on source-level inspection.
Kraken CSO Calls for Independent RNG Testing
Kraken Chief Security Officer Nick Percoco argued that hardware wallet manufacturers should face stronger independent testing requirements.
He said production firmware should be tested to confirm that the approved randomness source is actually being used when wallets generate seed phrases.
The proposal would shift security verification from simply checking whether the correct code exists to testing what the finished product really does.
Percoco referenced standards including NIST SP 800-90B and Germany’s BSI AIS-31.
Both frameworks are designed to evaluate the quality and operation of random-number generation in cryptographic systems.
Hardware Wallets Lack Comparable Certification Standards
Other financial and cryptographic devices often undergo independent testing before being approved for sensitive use.
PIN-entry devices used in payment systems, for example, can face formal laboratory testing.
U.S. government cryptographic modules can also undergo FIPS validation, including reviews of entropy sources.
The hardware wallet industry does not currently have an equivalent universal certification process specifically verifying end-to-end seed generation.
That means buyers frequently rely on manufacturer claims, open-source code, community review and third-party audits.
The Coldcard incident has intensified calls for stronger and more standardized testing.
AI Audits Find 85 More Critical Security Issues
The Coldcard disclosure prompted researchers to examine other Bitcoin wallet codebases using AI-assisted analysis.
According to the report, the broader review identified 85 critical-severity findings across multiple wallet implementations and supporting cryptographic libraries.
The issues are not necessarily identical to the Coldcard bug.
However, many reportedly involve similar problems related to entropy generation and random-number handling.
These findings suggest that the industry may have underestimated the number of ways wallet randomness can be weakened.
AI Can Trace Paths Human Reviewers May Miss
AI-assisted static analysis can examine software differently from a traditional manual code review.
Instead of simply checking whether a secure random-number generator is referenced somewhere in the code, automated systems can trace how a function behaves under different compilation settings.
For example, a security tool can test:
- Conditional compilation paths
- Random-number fallback mechanisms
- Reseeding behavior
- Library bindings
- Device-specific configuration
- Key-generation functions
This can reveal situations where a secure entropy source is present in the source code but replaced during compilation or runtime.
That is precisely the type of issue that allowed the Coldcard vulnerability to survive for years.
Some Findings Involve Weak Reseeding
The 85 reported findings include more than incorrect random-number generator bindings.
Researchers also identified situations where secure hardware entropy was added to a weaker software generator but did not fully replace its vulnerable internal state.
This can create a false sense of security.
A developer may believe that adding some hardware randomness makes the generator safe.
However, if only a small portion of the internal state is refreshed, attackers may still be able to reduce the search space significantly.
These subtle weaknesses can be difficult to identify through normal testing.
Not All 85 Bugs Have Been Disclosed
The full list of affected wallets and libraries has not been made public.
Researchers are reportedly using coordinated disclosure procedures so vendors have time to patch the vulnerabilities before technical details become widely available.
This is a common security practice.
Publishing complete exploit information before fixes exist could put additional users at risk.
As vendors release updates, more information about the affected implementations may become public.
Until then, the 85 findings should be understood as reported critical issues rather than a list of 85 publicly exploitable wallet products.
Coinkite Releases Corrected Firmware
Coinkite has released updated firmware for affected Coldcard models.
The corrected versions cited in the report include:
- Mk2 and Mk3: version 4.2.0
- Mk4 and Mk5: version 5.6.0
- Coldcard Q: version 1.5.0Q
- Mk4 Edge: version 6.6.0X
- Q Edge: version 6.6.0QX
The updates correct the random-number generation issue for newly created wallets.
However, simply updating firmware does not repair an existing vulnerable seed.
This is the most important point for affected users.
Existing Seeds Remain Vulnerable After Updating
The weakness is embedded in the original seed phrase.
Once a wallet seed has been created with insufficient entropy, installing secure firmware afterward cannot make that seed more random.
The same private keys continue to exist.
An attacker who can reconstruct the old seed can still access the wallet even if the device now runs corrected software.
Affected users therefore need to create an entirely new wallet using secure firmware and transfer their assets to new addresses.
Updating without migrating funds leaves the original vulnerability in place.
Wallet Migration Is Critical
A proper migration means generating a completely new seed phrase after installing corrected firmware.
Users should then create receiving addresses from the new wallet and transfer funds from the old wallet.
A cautious migration may involve:
- Installing verified official firmware
- Creating a new seed
- Backing up the new seed securely
- Verifying the receiving address on the hardware device
- Sending a small test transaction
- Confirming the test transfer
- Moving the remaining Bitcoin
- Avoiding reuse of the compromised seed
The old seed should not simply be imported into another wallet.
Moving it to a different device does not fix the entropy weakness.
Exported Coldcard Seeds Remain At Risk
Some users may have generated their original seed on Coldcard and later imported it into another hardware or software wallet.
That does not remove the risk.
The vulnerability is tied to how the seed was originally created.
If an affected Coldcard generated a weak seed, that seed remains weak regardless of which wallet software currently stores it.
This is why the migration must involve generating a completely new seed rather than simply changing devices.
Dice-Generated Seeds May Be an Exception
Coinkite said users who added at least 50 fair, private and independent dice rolls during original seed generation may not be vulnerable to this specific RNG flaw.
Coldcard provides an option that allows users to contribute physical dice randomness when creating a wallet.
When enough truly random rolls are added correctly, the seed can gain independent entropy that does not rely entirely on the device’s flawed generator.
However, users should be certain that the required procedure was followed correctly before assuming their wallet is safe.
When in doubt, generating a new seed on corrected firmware remains the safer approach.
A BIP-39 Passphrase Does Not Repair the Seed
A strong BIP-39 passphrase can make an attack more difficult.
However, it does not transform a weak seed into a properly randomized one.
The underlying recovery phrase remains vulnerable.
An attacker who reconstructs the seed would still face the additional passphrase, but depending on its strength, that layer may eventually be attacked as well.
Coinkite therefore recommends migrating vulnerable seeds even when a passphrase is being used.
Coinkite Destroyed Affected Inventory
Coinkite reportedly stopped shipments after confirming the problem and destroyed devices in its possession that contained vulnerable firmware.
The company also advised affected users not to destroy their old hardware.
Original devices may become relevant evidence if law enforcement succeeds in recovering stolen Bitcoin or if legal claims arise.
Coinkite’s legal team is reportedly working with investigators across several jurisdictions.
The final financial and legal consequences for the company remain unclear.
Coldcard Hack Reopens the Self-Custody Debate
Hardware wallets have long been promoted as one of the safest ways to store cryptocurrency.
The basic principle is simple: users keep control of their own private keys instead of trusting a cryptocurrency exchange.
The collapse of FTX in 2022 strengthened this argument.
Many investors moved Bitcoin off centralized exchanges and into personal wallets because they wanted to reduce counterparty risk.
The Coldcard incident highlights the opposite risk.
When users manage their own private keys, they also depend on the security of the hardware and software used to generate them.
OKX Reports Record Inflows After the Coldcard Attack
OKX Chief Compliance Officer Jonathan Brockmeier said the exchange experienced record inflows following the Coldcard incidents.
He described the trend as the opposite of what happened after FTX.
FTX pushed investors toward self-custody.
The Coldcard vulnerability appears to have encouraged some users to move assets back toward professionally managed custody.
OKX said it prevented approximately $26.3 million in scam-related losses during the first half of 2026 and protected more than $1.1 billion in customer assets.
The company attributed part of its security strategy to AI-assisted monitoring.
Centralized Custody Has Risks Too
The Coldcard exploit does not prove that centralized exchanges are safer in every situation.
Exchanges introduce their own risks, including:
- Hacks
- Insolvency
- Internal fraud
- Account freezes
- Regulatory action
- Withdrawal suspensions
Self-custody removes many of these counterparty risks.
However, it introduces responsibility for seed security, wallet backups, device integrity and transaction accuracy.
The better choice depends on the user’s knowledge, risk tolerance and security practices.
Neither approach is completely risk-free.
Bitcoin On-Chain Activity Jumped During the Incident
K33 Research reportedly found that almost 890,000 BTC moved on-chain during the seven days following the initial Coldcard attacks.
That represented the highest seven-day active supply figure recorded during 2026.
Some of this movement likely came from users transferring funds from potentially vulnerable wallets into new addresses.
Interestingly, the spike occurred while Bitcoin’s market price remained relatively calm.
According to the report, realized volatility had fallen below that of the Nasdaq 100 during the same period.
This suggests that the Coldcard event had a major effect on wallet activity without causing an equally dramatic market-price reaction.
Wallet Security Has Become an Industry-Level Issue
The Coldcard incident is no longer just a story about one hardware wallet manufacturer.
The wider concern is whether the industry’s testing standards are capable of detecting entropy-related problems before products reach customers.
Hardware wallets protect cryptocurrency only when the private keys they create are genuinely unpredictable.
A secure element, offline storage and strong PIN protection cannot compensate for a seed that was weak at creation.
That makes random-number generation one of the most important components in the entire wallet security model.
Independent Entropy Testing Could Become Standard
The incident may push hardware wallet manufacturers toward independent RNG certification.
Future testing could involve verifying the actual behavior of production firmware rather than simply examining source code.
Auditors could generate large numbers of seeds under controlled conditions and verify that:
- Approved hardware entropy is used
- No software fallback weakens randomness
- Build configurations behave consistently
- Reseeding provides sufficient entropy
- Device models produce expected security levels
Such testing would create additional cost for manufacturers but could significantly improve consumer confidence.
AI Security Auditing May Also Expand
The discovery of dozens of additional critical findings could accelerate the use of AI in wallet security research.
Automated systems can examine large codebases and many build configurations more quickly than human auditors.
They may be particularly useful for identifying unusual interactions between libraries, compiler settings and device-specific code.
However, AI analysis should not be treated as a replacement for expert security researchers.
Automated tools can produce false positives or fail to understand real-world exploitability.
The strongest approach may combine AI-assisted scanning with manual verification and physical device testing.
Investigators Still Have a Window to Recover Funds
The fact that roughly 90% of the stolen Bitcoin remains unmoved provides investigators with some opportunity.
Once attackers begin moving large amounts through mixers, decentralized exchanges or cross-chain systems, recovery becomes more difficult.
If stolen Bitcoin reaches a regulated exchange, authorities may be able to freeze it.
This requires fast coordination between:
- Blockchain analytics companies
- Crypto exchanges
- Law enforcement
- Wallet providers
- Victims
The outcome will depend largely on how attackers attempt to convert or move the stolen funds.
More Attack Waves Remain Possible
Researchers have warned that additional attacks could occur while vulnerable wallets remain funded.
Anyone with enough technical information about the flaw may be able to search for additional weak seeds.
This creates a race between wallet owners migrating funds and attackers attempting to reconstruct more wallets.
Even users who have not seen suspicious activity should not assume that an affected seed is safe simply because funds have not yet moved.
The vulnerability may remain exploitable indefinitely as long as the same seed continues controlling Bitcoin.
What to Watch Next
Several developments will determine the wider impact of the Coldcard incident.
The first is whether investigators confirm the suspected fourth attack wave. Verification would push estimated losses toward 2,055 BTC.
The second is whether the large unmoved clusters begin entering mixers or exchanges.
Another important development will be hardware wallet certification reform. Security experts are calling for stronger independent testing of entropy generation in production devices.
Finally, the industry will be watching the coordinated disclosure of the 85 AI-identified critical findings.
Each new disclosure could reveal whether similar entropy problems exist in other widely used wallets.
Coldcard Incident Exposes a Bigger Bitcoin Custody Problem
The Coldcard exploit shows that hardware wallet security depends on far more than keeping private keys offline.
The wallet must generate those keys securely in the first place.
A single programming mistake introduced in 2021 was enough to weaken seed generation for years while avoiding detection through traditional reviews.
Attackers eventually exploited that mistake without needing access to the victim’s hardware, PIN, computer or Bitcoin protocol.
Now, AI-assisted security analysis suggests Coldcard may not be an isolated example.
The discovery of 85 additional critical findings across wallet software and supporting libraries raises a much larger question about how thoroughly cryptocurrency custody technology is being tested.
For hardware wallet users, the lesson is clear: firmware security, entropy generation and independent testing matter just as much as offline storage.
For the industry, the incident may become the catalyst for stronger security standards around one of the most important processes in cryptocurrency the creation of the private keys that control the funds.
