Coldcard Firmware Bug Leaves Bitcoin Wallets Vulnerable as Losses Top $89 Million

Jonathan Goodman did everything the self-custody guides tell you to do. He kept his Coldcard hardware wallet in a safety deposit box and never typed his seed phrase into a computer. Splitting his 18.25 BTC across multiple isolated setups, he held his funds exactly the way a cautious Bitcoin holder is supposed to. But on the night of July 29, between 9:36 and 9:43 p.m., every wallet he controlled was emptied. Goodman was sitting at home when he first heard something was wrong. Assuming it did not apply to him, he opened his wallet software out of curiosity, only to find a column of red withdrawal transactions where his balance used to be.

He was not alone. By August 4, Galaxy Research confirmed three coordinated waves of theft totaling 1,367.05 BTC, worth roughly $88.6 million. A fourth wave that began August 3 is still under evaluation, with several outlets already reporting cumulative losses past $100 million. These wallets relied on private keys generated with far less randomness than advertised, leaving holders with no built-in settings to detect the danger.

What a hardware wallet is supposed to guarantee

A device like the Coldcard exists to generate a recovery seed from randomness strong enough that no one can guess or recreate it. It's called entropy. That entropy is supposed to come from an internal hardware random number generator, producing 128 bits of randomness so attackers cannot brute-force the key.

How the randomness broke

In 2021, Coinkite migrated Coldcard's elliptic-curve signing code to libsecp256k1, the same library used by Bitcoin Core. That update required adding libNgU, an embedded MicroPython library that exposes signing functions to firmware. According to Coinkite's technical writeup, this migration accidentally rerouted seed generation away from the hardware generator.

The problem stems from an embedded-systems bug. Coldcard's firmware disables MicroPython's built-in software generator by setting a build flag, MICROPY_HW_ENABLE_RNG, to zero. However, the check inside libNgU only verified whether the flag was defined, failing to verify if its value was actually non-zero. Because the flag existed, the check passed, and the firmware silently fell back to MicroPython's non-cryptographic generator, Yasmarang.

Yasmarang does not draw from physical noise. It seeds itself using the microcontroller's fixed unique ID alongside system timers and real-time clock registers. Coinkite compounded the issue by XORing that output against a second Yasmarang instance seeded from hardcoded constants in the source code. Combining deterministic streams with an XOR adds no true randomness. The resulting bytes were hashed with SHA256d before becoming the seed, but hashing cannot manufacture entropy that was never there.

Coinkite's preliminary estimate puts the effective search space at around 40 bits for Mk2 and Mk3 devices on affected firmware, far below the 128-bit standard. Later hardware like the Mk4, Mk5, and Q mixed in extra randomness from onboard secure elements, raising effective entropy to roughly 72 bits. While stronger, that figure remains well short of what a secure wallet requires.

While the underlying MicroPython fallback code dates back to 2018, Coinkite's firmware did not execute it during seed generation until the 2021 migration. That places the true exposure window at just over five years.

Why checking your own seed would not have helped

A weak seed and a strong seed produce identical outputs on screen: 24 English words. No warning light flagged the issue, nor was there any visible pattern for an owner to catch. The only indicator was the specific firmware version used during setup, a detail most users check once and forget.

Coldcard's documentation made this situation worse. Security researcher Shanaka Anslem Perera pointed out that the manual described default hardware seed generation as the most trusted, low-risk path. Manual dice rolls were framed as an alternative for users who preferred not to trust the hardware. Most owners took the recommended default option, which Galaxy Research now links directly to the losses.

Why nobody at Coinkite caught it

Coinkite claims it was unaware of the bug until thefts were underway. Founder Rodolfo Novak stated that the hardware generator code remained in the binary the whole time, just missing from the specific execution path that created seeds. Previous code reviews confirmed the function existed, but no one verified which function actually executed at runtime.

Because Coldcard's firmware is open source, Coinkite suspects an attacker used AI to scan past releases and uncover the flaw. Weeks earlier, Coinkite audited its own codebase using advanced AI models specifically searching for vulnerabilities, yet those tools missed the bug entirely.

Who is actually at risk

The vulnerability covers Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, along with pre-fix releases across Mk4, Mk5, and Q models. Fixed firmware is now live for all affected tracks. Coinkite confirmed that its Tapsigner, Opendime, and Satscard products run separate codebases and remain unaffected.

Two specific configurations protected users. Entering at least 50 private dice rolls during setup added enough entropy to secure the seed. Alternatively, using a strong, unique BIP-39 passphrase created an isolated wallet the attacker could not reach.

How the theft unfolded

Galaxy Research began tracking on-chain movements right after Coinkite issued its July 30 advisory. The initial wave pulled 594 BTC from roughly 500 addresses in under 41 minutes. A second wave followed with identical transaction patterns, pointing to the same attacker. A third wave on August 1 swept another 207.73 BTC using modified techniques.

Across the first three waves, 1,367.05 BTC was stolen from 4,585 addresses. The coins had remained untouched for an average of 3.18 years, confirming that victims were mostly long-term self-custody holders. A fourth wave on August 3 moved an estimated 449 BTC across 709 addresses, with sweep rates hitting nearly 15 transactions per block.

What to do right now

Anyone holding an affected Coldcard seed must update to the fixed firmware before generating a brand new seed. Verifying the new receive address directly on the device screen and testing the wallet with a small transfer are critical steps before moving full balances. Updating firmware alone will not repair an existing seed.

Where this leaves things

Coinkite destroyed vulnerable inventory on August 2 while Galaxy Research continues submitting suspect addresses to law enforcement. The resulting panic drove active Bitcoin addresses up by 350,000 in a single day as holders migrated funds.

Goodman has filed reports with local law enforcement, holding little hope of recovering his 18.25 BTC.