A firmware flaw in Coldcard hardware wallets has been linked to the theft of about $88.6 million in Bitcoin. Attackers exploited a compromised random number generator, allowing them to reconstruct victims’ private keys without ever physically accessing the devices.

The incident is a serious reminder that hardware wallet security depends not only on the device itself, but also on the randomness used during seed creation.

Key Details

Digital asset research firm Galaxy Research first noticed unusual activity on July 30, when an attacker drained about 1,082.65 BTC, worth roughly $70.2 million, from 1,196 addresses in just 41 minutes.

By August 1, additional waves of transactions pushed the total theft to 1,367.05 BTC, or about $88.6 million, across 4,585 addresses. Galaxy said the first two waves followed similar transaction patterns, suggesting a single operator. A third wave showed enough differences to suggest either a revised toolset or a separate attacker using the same weakness.

Unlike most hardware wallet attacks, this exploit did not rely on phishing, malicious firmware installation, or physical device access. Instead, it targeted the wallet creation process itself.

Technical Analysis

Block’s Bitcoin Engineering and Security teams traced the issue to a code change made on March 1, 2021. That change caused Coldcard’s production configuration to turn off the STM32 hardware random number generator.

A flawed check in the libngu library only verified whether a configuration macro existed, not whether it was enabled. As a result, the system fell back to MicroPython’s deterministic Yasmarang software generator, seeded from the device’s UID and timer state.

That meant seed generation was no longer truly random.

Coinkite estimated the effective entropy dropped to around:

• 40 bits on Mk3 devices.
• 72 bits on Mk4, Mk5, and Q devices.

That is far below the 128 bits typically expected from a standard BIP-39 recovery phrase. With such a weak entropy pool, attackers could generate candidate seeds offline, derive corresponding Bitcoin addresses, and compare them against public blockchain data until they found wallets holding funds.

Impact and Risk

Coinkite’s advisory says Mk2 and Mk3 devices running firmware versions 4.0.1 through 4.1.9 are affected. Mk4, Mk5, and Q devices are also at risk depending on version, with affected releases including:

• Mk4 and Mk5 before 5.6.0.
• Q devices before 1.5.0Q.

Galaxy noted that exposure depends on the firmware version used when a wallet’s seed was first generated, not the firmware currently installed. Wallets seeded before March 2021, or created with 50 or more dice rolls or a strong BIP-39 passphrase, are not considered at risk.

This makes the flaw especially dangerous because a wallet may appear secure today while still being tied to a compromised seed created years ago.

Expert Recommendations

Coinkite released emergency firmware patches on July 31:

• 4.2.0 for Mk3.
• 5.6.0 for Mk4 and Mk5.
• 1.5.0Q for Q devices.

However, updating firmware does not fix seeds that were already compromised. Affected users should take immediate recovery steps.

Recommended actions:

• Install the patched firmware immediately.
• Generate a new seed on the updated device.
• Verify the new address directly on the device.
• Send a small test transaction first.
• Migrate remaining funds to the new wallet as soon as possible.
• Treat old seeds as potentially compromised if created during the affected period.
• Consider multisignature setups across devices from different manufacturers.

A multisig design can reduce single-vendor risk by making one firmware flaw insufficient to steal funds.

Industry Context

This incident shows how hardware wallet security can fail at the entropy layer rather than the transport or firmware update layer. Even a device designed to protect private keys can become vulnerable if the seed-generation process is weak.

It also reinforces a broader lesson for crypto users: never assume a hardware wallet is safe simply because it is offline or self-custodied. Seed creation, entropy quality, firmware integrity, and backup practices all matter.

Conclusion

The Coldcard RNG flaw is a high-severity reminder that poor randomness can be just as dangerous as a direct device compromise. With tens of millions of dollars stolen and affected seeds potentially recoverable offline, users should patch immediately and move funds to fresh keys.

FAQ SECTION

What happened with Coldcard?

A flaw in the random number generation process weakened seed entropy and allowed attackers to reconstruct private keys.

How much Bitcoin was stolen?

Galaxy Research says about 1,367.05 BTC, worth roughly $88.6 million, was taken.

Which devices are affected?

Coldcard Mk2, Mk3, Mk4, Mk5, and Q devices are affected depending on firmware version and when the seed was created.

Does updating firmware fix old wallets?

No. Firmware updates stop future compromise but do not repair seeds that were already generated with weak randomness.

What is the safest response?

Patch the device, generate a new seed, verify the new address, and move funds immediately.