Coldcard firmware flaw tied to up to $130M in suspected Bitcoin theft

Block's Bitcoin Engineering and Security team, working with independent Bitcoin Core developers, says a specific Coldcard firmware defect likely underpins a string of wallet drainings that have now been linked to as much as 2,055 BTC (about $130 million), based on an Aug. 4 estimate cited by Lookonchain from Galaxy Research. Investigators say the issue sits at the very start of Bitcoin self-custody: seed creation. On certain Coinkite Coldcard devices, a bug rerouted random-number generation away from the STM32 hardware RNG and into MicroPython's deterministic Yasmarang fallback. Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9 allegedly generated seeds from a small, searchable set. Mk4, Q, and Mk5 were described as less impacted but still produced seeds with roughly 72 bits of entropy, below the design target of 128 bits. The practical consequence is that safe storage and offline use would not have been enough. A user could record 12 or 24 words, lock them away, keep the wallet air-gapped for years, and still end up with a recovery phrase whose key space could be brute-forced. The weakness travels with the mnemonic itself, meaning importing the same words into another brand's wallet does not remove the risk. Coinkite has advised impacted users to generate a brand-new seed and move funds. The patch only protects seeds created after the update is installed; any seed produced previously along the flawed path requires full replacement. Two user groups were highlighted as less exposed to the specific attack described. First, owners who used a strong, unique BIP39 passphrase added an independent secret, because BIP39 derives the wallet seed from the mnemonic plus a salt containing the passphrase. Second, owners who introduced external entropy by using at least 50 fair, independent private dice rolls were not relying solely on the device's defective RNG. The episode is notable because Coldcard has long marketed itself around features commonly recommended for self-custody security, including Bitcoin-only firmware, air-gapped signing, dual secure elements, published source code, and reproducible builds. Reproducible builds can confirm that the distributed binary matches the published code, but that only addresses distribution integrity. Detecting a design-level defect still requires deeper auditing of the source, and investigators say the vulnerable path shipped for years: firmware released from 2021 until the disclosure in July 2026. Loss estimates have risen as attribution work continues. Early sweeps reportedly pulled about 594 BTC from around 500 wallets. On-chain researchers later tied at least three suspected waves to the flaw totaling nearly 1,367 BTC across more than 4,500 addresses (about $89 million at the time). Reports circulating Aug. 3 pointed to a potential fourth wave that could lift the total toward $114 million. Galaxy Digital's Alex Thorn cautioned that blockchain patterns alone cannot definitively prove every swept address was tied to vulnerable Coldcard firmware. Lookonchain's Aug. 4 update, citing Galaxy Research, put suspected Coldcard-related losses at roughly 2,055 BTC across more than 7,700 addresses. The broader backdrop is that many major crypto losses are now operational rather than cryptographic. TRM Labs said infrastructure and operational compromise—primarily private-key and seed-phrase theft—accounted for about 76% of the value stolen in crypto hacks in the first half of 2026, while representing about 15% of total incidents. CertiK separately labeled wallet compromise the most expensive attack category over the same period, totaling more than $444 million across 33 incidents. Xapo Bank CISO Andrew Mannoukas framed the takeaway as a concentration problem: when the security of a Bitcoin position depends on a single secret created on a single device in a single moment, the owner inherits every assumption embedded in that moment. The report also draws a contrast with Ledger's optional Recover service, which duplicates and encrypts wallet entropy inside the Secure Element, splits it into three encrypted shards, and sends them to separate backup providers with subscription and on-device approval. In that case, the boundary question is about moving secret material outside the device under explicit user approval. With Coldcard, investigators say the boundary failed earlier: the firmware potentially weakened the secret before the device's security model could even matter. Coinkite founder Rodolfo Novak issued a public apology, said the company accepts full accountability, and offered assistance with police reports, insurance claims, and blockchain investigations. As of Aug. 3, reimbursement was not listed among the remedies. Market participants are now watching whether migration out of vulnerable seeds can outpace additional exploitation. In an optimistic scenario, wallet makers respond with entropy attestations, seed-generation testing, and clearer tooling for emergency key rotation, pushing passphrases, external dice entropy, and properly diversified multisig from advanced guidance into default practice. A more negative scenario would see additional weak-seed paths uncovered in other devices or setup flows, sparking panic migrations that introduce fresh risks such as rushed transfer errors, address-reuse mistakes, and a new wave of wallet-support scams. The episode underscores a central tension in Bitcoin self-custody: holding your own keys removes exchange-level risks like withdrawal freezes and insolvency, but it still leaves users dependent on the manufacturer that turns randomness into a private key. The report's conclusion is blunt: "not your keys" offers limited protection if the key was generated under a single, fragile assumption.