Coldcard Seed-Generation Bug Tied to Bitcoin Thefts Estimated at Up to $130 Million

Coldcard's core promise—keeping private keys offline—did not protect some users from a separate class of failure: weak randomness at the moment a wallet seed was created. In the incident reviewed by multiple outlets, attackers reportedly never needed to access victims' devices. Instead, they generated candidate seed phrases offline and tested them against publicly visible blockchain activity, The Hacker News reported on 1 August 2026, summarizing research attributed to Block. The issue traces to Coldcard, a Bitcoin-only hardware wallet made by Canadian firm Coinkite. Block attributed the weakness to a production configuration error dating back to March 2021. In that build, a macro named MICROPY_HW_ENABLE_RNG was defined as zero because Coinkite uses its own hardware random-number generator wrapper, but a dependency (libngu) reportedly checked only whether the macro existed, not whether it was enabled, per The Hacker News. As a result, affected builds fell back to MicroPython's Yasmarang generator. The fallback was seeded from a chip's unique ID and timer registers and did not gather additional entropy afterward. Coinkite estimates the effective entropy at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q models, versus the 128 bits a standard 12-word BIP39 seed is intended to represent, The Hacker News reported. Block did not publish a practical brute-force benchmark; instead it set conditional upper bounds and warned that even the higher figure should not be treated as true 73-bit cryptographic strength, according to the same report. No public report cited here reconstructs a specific victim's seed and ties it to a particular drained address. Why 'offline' wasn't enough Coldcard did not need to be connected to the internet for this attack model to work. The weakness was embedded in the seed-generation process itself. If an attacker can constrain the device's unique ID, timer state and prior randomness calls, Block found that candidate seed streams can be produced and checked entirely offline, with verification done against blockchain data anyone can access, The Hacker News said. The victim's device, safe, or deposit box was not part of the attack surface. On-chain activity tied to the incident has been tracked by Galaxy Research. Galaxy mapped a sweep of 1,196 Bitcoin addresses completed in 41 minutes on 30 July 2026, moving 1,082.65 BTC worth about $70.2 million at the time, per The Hacker News. Galaxy said it found no other Bitcoin transactions in the prior 30 days sharing the same fee rate and no-change signature, and warned the pattern may identify an operator without proving theft because a sweep can resemble an owner consolidating coins. Galaxy later described two additional suspected waves, lifting its observed total to 1,367.05 BTC (about $88.6 million) across 4,585 addresses, The Hacker News reported, while cautioning that the later wave may involve a different operator and that it had not computationally confirmed every flagged address originated from the weak-entropy condition. Hardware vs. software: one failure mode, different trust assumptions Insufficient randomness at key generation is not exclusive to hardware wallets. The Hacker News also cited Coinspect's separate "Ill Bloom" research, which it said identified a weak PRNG flaw in older software wallets tied to more than $5 million drained since May across Bitcoin, Ethereum, Tron, Rootstock and Polygon. The outlet described the Coldcard and Ill Bloom findings as separate incidents, not one shared bug. Taken together, they underline a common dependency: whether keys are generated inside a dedicated device or inside an app, the randomness source is a single critical point of failure. A different risk sits alongside entropy: firmware supply-chain trust. Cointelegraph, in a summary referenced here, described firmware updates in general terms as "the perfect attack vector" for covert key access by parties ranging from "a regulatory agency" to "a criminal organization," and pointed to a 2018 Ledger vulnerability as an example. This is distinct from the Coldcard case, which stems from an unintended coding/configuration error introduced in 2021 rather than a deliberately compromised update, and no evidence in the cited coverage connects the two. Patch shipped, but old seeds remain risky Coinkite released emergency firmware updates for all affected models and release tracks on 31 July 2026, The Hacker News reported. CoinDesk cited an open letter from Coinkite CEO NVK on the same date urging users to "move your funds now" using updated guidance. The patch prevents newly generated seeds from inheriting the flaw. It does not "fix" a seed that was created on vulnerable firmware: restoring that seed onto patched firmware, or importing it into another wallet, preserves the weakness, the outlets reported. Exposure depends on the firmware version in use when the seed was originally generated, not what runs today. Firmware ranges described in the coverage differ slightly by source. Coinkite lists Mk3 versions 4.0.1 through 4.1.9 as affected, fixed in 4.2.0, and does not name Mk2. Block's account reportedly includes Mk2 and Mk3 versions 4.0.0 through 4.1.9 on the vulnerable path, The Hacker News said. For Mk4 and Mk5, versions earlier than 5.6.0 are affected; for the Q, earlier than 1.5.0Q. Edge builds earlier than 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q) were also affected, per The Hacker News. Coinkite said seeds generated using at least 50 fair, independent, private dice rolls are not at risk from this bug alone; where the number or privacy of rolls is uncertain, it advises migration. A strong, unique BIP39 passphrase creates a separate wallet that the seed words alone cannot access, but Coinkite still recommends replacing the underlying seed. Multisig setups are only protected if the signing quorum is not composed entirely of affected devices. Coinkite's TAPSIGNER, OPENDIME and SATSCARD use different codebases and are not affected, The Hacker News reported. How much was lost: multiple moving estimates Because Galaxy's tracing was described as ongoing, different outlets published different totals at different times. None of the numbers is presented in the cited coverage as a final audited loss total: 31 July 2026: $38 million (CoinDesk) 1 August 2026 (initial sweep): 1,082.65 BTC (~$70.2 million) (The Hacker News, citing Galaxy Research) Undated update within the same report: 1,367.05 BTC (~$88.6 million) across 4,585 addresses (The Hacker News, citing Galaxy Research) Over $100 million (Bloomberg; no publication date provided in the evidence referenced here) 4 August 2026 ("as of Tuesday"): around $130 million (TechCrunch, citing Galaxy Research; Elliptic cofounder and chief scientist Tom Robinson reportedly said this was roughly correct) For industry context, TechCrunch cited TRM Labs as saying more than 200 hacks targeting crypto companies had occurred so far in 2026, with total losses exceeding $950 million—an aggregate figure not specific to Coldcard. TechCrunch also reported that Jonathan Goodman said on X he lost $1.6 million from a Coldcard wallet despite never sharing his seed phrase or connecting devices to the internet; this claim is self-reported and not independently verified in the sources referenced here. What remains unconfirmed in the available coverage The cited reports do not establish a final loss total, identify the attacker(s), or confirm that every flagged address in later sweep waves is definitively linked to the weak-entropy condition. The Bloomberg "over $100 million" figure cannot be placed precisely on the timeline with the other estimates because no date is provided in the evidence referenced here. The relationship, if any, between Coinspect's Ill Bloom findings and the Coldcard bug is not explained; The Hacker News treats them as separate incidents. The Cointelegraph material addresses a different threat model (compromised updates) and is included only as a summary and excerpt without corroboration from other outlets in this packet. Finally, the evidence base described here relies on news coverage summarizing primary materials rather than the primary documents themselves. Sources cited in the coverage include The Hacker News, CoinDesk, TechCrunch, Bloomberg, Cointelegraph, and research attribution to Block and Galaxy Research, as summarized by those outlets.