Coldcard Seed "Entropy" Bug Tied to $38M Bitcoin Sweep, Researchers Warn

Coldcard users are being urged to act immediately if they generated a wallet seed on a Coldcard Mk3, Mk4, Mk5, or Q before Coinkite's latest firmware hotfix. Security researchers say funds could be exposed, and migrating to a fresh seed is the only reliable remediation. On-chain data flagged by Lookonchain shows roughly 594.48 BTC—more than $38 million—moved out of around 500 wallets into a single consolidating address starting with bc1qnk…. The transfers occurred within a narrow block range and exhibited a coordinated, near-simultaneous pattern. Many of the affected wallets appear to have been single-signature setups (no multisig protection), and several had been inactive for years—a profile consistent with an automated sweep of older, vulnerable seeds rather than theft of recently used accounts. Coinkite has not publicly confirmed that this specific $38M sweep was caused by the Coldcard issue. Still, researchers say the timing and wallet characteristics align closely with a recently disclosed weakness affecting seed generation entropy. Coinkite's technical write-up describes a chain of firmware/build issues that prevented the device's hardware True Random Number Generator (TRNG) from properly contributing entropy during seed creation on certain versions. Instead, affected firmware could silently fall back to a software PseudoRandom Number Generator (PRNG) from MicroPython, without presenting a clear warning to the user. The result was a major reduction in effective security during seed generation: - Mk3: about ~40 bits of effective security versus the intended 128 bits. - Mk4, Mk5, Q: about ~72 bits of effective security (helped partially by secure elements), still below the 128-bit target. At ~40 bits, the search space is on the order of 2^40 (about 1 trillion) possible seeds—large in everyday terms, but potentially reachable for well-resourced attackers using modern compute. At ~72 bits, brute force becomes far harder, but remains materially weaker than the 128-bit standard designed to make such attacks impractical. Affected devices and firmware (per Coinkite): - Mk3 (HIGH RISK): seeds generated on firmware 4.0.1 (released March 2021) through the final supported version 5.0.3. - Mk4, Mk5, Q (ELEVATED RISK): seeds generated on any firmware prior to the latest hotfix, with reduced entropy around ~72 bits. - Not affected: TAPSIGNER, OPENDIME, SATSCARD (different codebases). Lower-risk cases noted by Coinkite include users who added at least 50 independent, private dice rolls during seed generation (external entropy the device cannot reduce), or users protected by a strong, unique BIP39 passphrase. The passphrase is processed separately from internal device entropy and can materially raise the bar even if the seed entropy was weaker than intended. What to do now: Coinkite's migration steps Coinkite emphasizes that firmware updates do not repair previously generated seeds. If a seed was created with insufficient entropy, the only fix is to generate a brand-new seed on fixed firmware and move funds. 1) Assume at-risk seeds may be compromised If your seed was created on an affected device/firmware and you did not add 50+ dice rolls and did not use a strong passphrase, treat it as vulnerable. 2) Update to fixed firmware - Mk4/Mk5: update to firmware 5.6.0 or later - Q: update to firmware 1.5.0Q or later - Mk3: no fix available (see interim measure below) 3) Create a completely new seed on the updated device Generate a new seed; do not restore the old seed phrase. For added protection, Coinkite recommends adding at least 50 independent dice rolls during seed creation, and pairing the new seed with a strong, unique BIP39 passphrase stored separately. 4) Back up correctly Write down the new seed phrase and store it securely. If using a BIP39 passphrase, store it separately from the seed backup. Both are required to access funds. 5) Verify the new wallet before moving funds Confirm the wallet fingerprint and verify at least one receive address. 6) Run a small test transfer Send a small amount from the old wallet to the new wallet and confirm receipt. 7) Migrate the full balance Move all remaining funds to the new wallet and stop using the old seed. Mk3 interim measure If an Mk3 is the only device available and immediate access to a Mk4/Mk5/Q is not possible, adding a strong, unique BIP39 passphrase to the existing wallet may reduce exposure temporarily. Coinkite frames this as a stopgap, not a permanent solution; a full migration to a non-affected setup remains necessary. Why entropy matters (plain-English version) A hardware wallet ultimately stands on the randomness used to generate its seed—the master secret from which all Bitcoin addresses are derived. If the randomness pool was smaller than intended, the number of possible seeds collapses from 2^128 to something closer to 2^40 or 2^72. That difference separates a seed that is effectively unbreakable from one a capable adversary might feasibly enumerate. Physical protections such as air-gapping and tamper resistance cannot compensate if the seed itself starts from weakened cryptographic foundations. Coinkite advises users to rely only on official channels for instructions, and to avoid unsolicited "support" outreach or third-party recovery offers. Bottom line Researchers say the Coldcard entropy bug is a serious issue and, based on publicly observed on-chain behavior, may already be linked to theft of roughly $38.2 million in Bitcoin. If you generated a seed on affected firmware without substantial dice-roll entropy or a strong BIP39 passphrase, the recommended response is immediate: update firmware (where applicable), generate a new seed, and migrate funds. FAQ What is the Coldcard entropy flaw? A firmware/build issue that caused some Coldcard versions to use a software PRNG instead of the hardware TRNG during seed generation, producing seeds with about ~40-bit security (Mk3) or ~72-bit security (Mk4/Mk5/Q) rather than the intended 128-bit level. Is my Coldcard affected? Mk3 devices on firmware 4.0.1 through 5.0.3 are considered high risk. Mk4, Mk5, and Q devices on firmware prior to the latest hotfix are also affected. TAPSIGNER, OPENDIME, and SATSCARD are not. Will updating firmware fix my existing seed? No. Firmware updates do not retroactively strengthen an already-generated seed. You must generate a new seed and move funds. What firmware versions should I update to? Mk4/Mk5: 5.6.0 or later. Q: 1.5.0Q or later. Mk3: no fix is available; use a strong BIP39 passphrase only as an interim measure while planning migration.