Coldcard Seed Bug Linked to 2,055 BTC in Losses, Affecting Over 7,700 Addresses

Losses tied to exploitation of a Coldcard seed-generation weakness have climbed to about 2,055 BTC, or roughly $130 million, spread across more than 7,700 victim addresses, according to Galaxy Research estimates cited by Lookonchain. The suspected thefts follow multiple on-chain "sweep" waves connected to a flaw in how wallet seeds were generated on certain Coldcard firmware builds from Canadian hardware maker Coinkite. Researchers say the weakness could allow an attacker to derive and test candidate keys offline if they could determine, or tightly constrain, key device parameters. ### What went wrong in the firmware Block reported that a March 2021 firmware integration issue redirected seed generation to a deterministic software pseudorandom number generator (PRNG) instead of the STM32 hardware random number generator (RNG). In the production configuration, the hardwareRNG macro was set to zero, while the underlying libngu library checked for the macro's existence rather than whether it was enabled. That caused builds to rely on MicroPython's Yasmarang fallback. The fallback PRNG was initialized using chip unique identifiers and timer registers, and it did not gather fresh entropy after initialization. Block said an attacker who could determine or sufficiently constrain the device UID, timer state and prior RNG-call history could recreate output streams offline, derive addresses and match them against public blockchain data. In a security notice posted July 31, 2026, Coldcard urged users to act based on model and firmware: Mk3 units that generated a seed on 4.0.1+ without at least 50 private, independent dice rolls should begin a careful migration; Mk4/Mk5 devices below 5.6.0 and Q units below 1.5.0Q should update first, generate a new seed, then migrate. Coinkite estimated effective entropy for affected seeds at about 40 bits on Mk3 hardware and roughly 72 bits on Mk4, Mk5 and Q models, versus 128 bits for a 12-word BIP39 seed. Block noted that the real-world cost to reproduce seeds depends on what UID data is available, boot timing, prior RNG calls and derivation costs. Coinkite shipped emergency firmware updates across affected models and release tracks on July 31, but emphasized that updating firmware does not fix an already-weak seed. The company advised users with potentially exposed seeds to generate a new seed on patched firmware and move funds, warning that restoring an old seed preserves the weakness. ### On-chain sweeps: what analysts observed On-chain analysis of the PRNG issue flagged an initial sweep on July 30 that drained 1,082.65 BTC from 1,196 addresses in about 41 minutes, averaging close to 1 BTC per address. CoinDesk reporting on subsequent tracking described a third suspected wave that removed about 208 BTC from 1,912 addresses, or just over 0.1 BTC per victim. In that later wave, transactions batched about six victims per sweep, routed each victim's funds to a separate destination, and used pay-to-witness-script-hash (P2WSH) outputs rather than the plain single-key outputs seen earlier. Galaxy Research said it was confident each wave reflected a single operator internally, but cautioned that blockchain data alone cannot confirm whether the same attacker carried out all three waves. The firm also said it has not computationally verified that every identified address was generated using weak Coldcard entropy. Galaxy reported roughly 600 suspected attacker-controlled addresses to federal investigators, compliance firms and cybersecurity investigators.