Coldcard Seed-Generation Flaw Exploited; Up to Nearly $70M in Bitcoin Drained

Attackers exploited a weakness in recovery seeds generated by certain Coldcard hardware wallets, rapidly sweeping funds from hundreds of wallets on July 30 in a tightly coordinated burst. Galaxy Research said the core wave of theft occurred in roughly 25 minutes, with related activity later tying about 1,196 addresses to as much as 1,083 bitcoin—valued at nearly $70 million—over an estimated 41-minute span. Investigators cautioned totals may shift as tracing continues on the public Bitcoin blockchain. The incident centered on long-term holders who created seeds using Coldcard devices running vulnerable firmware released from March 2021 onward. Coldcard, built by Canadian manufacturer Coinkite, is an air-gapped bitcoin (BTC) wallet designed to keep private keys isolated from internet-connected devices. Many of the affected addresses had been inactive for years. On-chain patterns pointed to automation: the attacker moved quickly, used elevated fixed transaction fees, produced no change outputs, and fully emptied each address—consistent with a prepared set of private keys rather than users independently moving coins. Coinkite and researchers said the theft did not stem from phishing, malware, device theft, or a conventional remote compromise. Instead, the root cause was flawed randomness during seed creation. How the seed weakness occurred A wallet seed—typically shown as 12 or 24 words—derives all addresses and private keys. A properly generated 12-word seed should contain 128 bits of entropy, making brute-force guessing effectively impossible. Coldcard devices were intended to source randomness from a hardware random number generator in the microcontroller. Coinkite disclosed that during a 2021 software-library migration, two random-number functions with matching interfaces were mixed up: one used the proper hardware generator, while the other was a weaker software fallback meant for boards without suitable hardware. A configuration setting disabled the default MicroPython hardware path because Coinkite provided its own hardware wrapper. The software checked only whether the setting existed, not whether it was enabled. With the setting present but set to zero, builds succeeded while seed generation quietly fell back to the weaker software generator. Predictable inputs replaced true randomness The fallback leaned on device data that could be more guessable than true hardware noise, including a chip identifier resembling a serial number and clock values tied to startup timing. If an attacker can narrow those inputs, the search space collapses dramatically. Coinkite estimated vulnerable Mk3 seeds had about 40 bits of effective entropy under current assumptions—still large, but feasible to search with specialized computing, especially when candidate seeds can be validated against bitcoin addresses visible on-chain. Later models—including Mk4, Q, and Mk5—added randomness from a secure element, but only part of it fed the affected generator. Coinkite estimated roughly 72 bits of effective entropy for seeds created before patched firmware was installed—stronger than the Mk3 path, but still below the intended 128-bit standard. What users are being told to do Coinkite issued security advisories and released fixed firmware after becoming aware of active exploitation. The company said anyone who created seeds on affected firmware must generate an entirely new seed on updated firmware and transfer funds to addresses controlled by that new seed. Updating firmware alone is not sufficient: a seed created under the flawed process remains permanently weak because the update cannot add entropy to existing seed words. Coinkite recommended a careful migration sequence: update the device, create a new seed, verify the backup and wallet fingerprint, confirm the receiving address, send a small test transaction, then move the remaining balance. Users should keep the old backup until transfers are confirmed but stop treating the old seed as secure. Coinkite listed fixed versions as Mk3 4.2.0 or later; Mk4 and Mk5 5.6.0 or later; and Q 1.5.0Q or later, plus corresponding Edge releases. It said Tapsigner, Opendime, and Satscard use different code and were reportedly unaffected. Why some holders were protected Users who injected sufficient independent randomness during seed creation were far less exposed. Coinkite said at least 50 private rolls of a fair die provided adequate protection for this issue, with additional rolls offering more margin. A strong BIP39 passphrase creates a separate wallet that cannot be reconstructed from seed words alone. Multisignature setups were largely or fully protected when the vulnerable Coldcard seed represented only one component of the signing policy. Coinkite's response and the AI angle Coinkite CEO Rodolfo Novak (NVK) apologized publicly on July 31 and said the company accepted full responsibility. Novak said the hotfix protects newly created seeds but cannot repair seeds generated under vulnerable firmware. He added Coinkite would publish a full technical account after verifying details and would assist affected users seeking police reports, insurance claims, or independent investigations. Novak also warned that artificial intelligence tools can now comb old public code for hidden weaknesses faster than traditional review may catch them. Coinkite said it must assume an attacker used AI to review its open-source firmware, though it has not established how the flaw was found. The company also acknowledged that a recent review using a leading AI model did not flag the issue. Rivals used the moment to reassure customers. Ledger said it was not affected, citing a certified True Random Number Generator (TRNG) in its Secure Element generating 256 bits of entropy for each 24-word Secret Recovery Phrase. Trezor said the issue was limited to Coldcard's custom firmware and emphasized it does not share that code, adding that it mixes multiple independent sources of randomness. What to watch next The attacker remains unidentified, and the stolen bitcoin could move from consolidation addresses at any time. Investigators are still assessing how many vulnerable seeds were created, how much bitcoin remains exposed, and whether additional high-value wallets were already identified. Outreach may be difficult: Casa co-founder Jameson Lopp said on X that Coinkite purges customer records after 120 days to reduce breach risk, leaving the company unable to directly warn many buyers of vulnerable devices over the past five years. Open-source bitcoin developer calle wrote on X that victims may have followed standard best practices at the time—buy a reputable hardware wallet, generate a seed offline, protect the backup, and never enter it into an internet-connected device—yet still suffered losses. For users, the immediate guidance is clear: if a seed was created on affected firmware without strong dice entropy, a passphrase, or multisignature protection, treat it as compromised and move funds cautiously to a newly generated wallet. Community members are urging wider awareness to prevent further wallets from being emptied.