The Coldcard Exploit Explained: Who Lost Bitcoin and Who’s at Risk

An attacker exploited weak seeds generated by certain Coldcard hardware wallets to steal bitcoin worth roughly tens of millions from hundreds of addresses on July 30.

Many of the emptied addresses had remained dormant for years. The attacker moved rapidly, paid elevated fixed transaction fees, and left no change outputs, meaning each address was emptied completely. That pattern suggested an automated operation using a prepared list of private keys rather than customers independently moving their funds.

The theft was not caused by phishing, malware on a user’s computer, physical device theft or a conventional remote breach. Instead, a firmware error weakened the randomness used when some Coldcard devices created wallet seeds. Those seeds looked normal but came from a far smaller range of possible combinations than users had been promised.

A Bitcoin wallet seed is a secret, commonly displayed as 12 or 24 words, from which the wallet generates its addresses and private keys. A properly generated 12-word seed contains 128 bits of entropy, a technical measure describing an enormous number of possible combinations that makes guessing the seed effectively impossible.

Coldcard devices were supposed to obtain that randomness from a hardware random number generator inside the device’s microcontroller. The component draws from physical electrical noise that an outside observer should not be able to predict.

A configuration setting disabled the default MicroPython hardware path because Coinkite supplied its own hardware wrapper. The software checked only whether that setting existed, not whether it was enabled. Because the setting was present but assigned a value of zero, the build completed successfully, while seed generation silently shifted to the weaker software generator.

That fallback relied heavily on predictable device information, including a chip identifier similar to a serial number and internal clock values associated with startup timing. An attacker who could narrow those inputs would face a much smaller search than the 128-bit range expected from a securely generated seed.

Later Coldcard models, including the Mk4, Q and Mk5, added some randomness from a secure element. However, only a limited portion reached the affected generator, leaving an estimated 72 bits of effective entropy on seeds created before corrected firmware was installed. That was stronger than the Mk3 path but still below the intended 128-bit standard.

The difference is similar to replacing a truly random lock combination with one derived from a lock’s serial number and the time it was first switched on. The resulting combination may look random, but someone who knows the formula and can estimate the starting information can reproduce it. Many users are migrating, not only from Mk3 devices, but from Mk4, Q, and Mk5 as well.

Installing the update alone is not enough. A seed created under the flawed system remains weak permanently because the firmware update cannot add randomness to words that already exist.

Coinkite advised users to update their device, create a new seed, verify the backup and wallet fingerprint, confirm the receiving address, send a small test transaction, and then move the remaining balance. Users should retain the old backup until the transfer is confirmed, but should no longer treat the old seed as secure.

The company identified fixed releases including Mk3 version 4.2.0 or later, Mk4 and Mk5 version 5.6.0 or later, and Q version 1.5.0Q or later, along with corresponding Edge versions. Tapsigner, Opendime, and Satscard products use different code and were reportedly not affected.

Users who added enough independent dice rolls when generating a seed were substantially protected because their own randomness overwhelmed the defective software input. Coinkite said at least 50 private rolls of a fair die provided adequate protection from this issue, though additional rolls can provide a wider safety margin.

Those safeguards were optional, however. Many victims appear to have followed the standard security advice available at the time: Buy a respected hardware wallet, generate the seed offline, protect the backup, and never enter it into an internet-connected device.

Coinkite stressed it must assume an attacker used AI to inspect its open-source firmware, though no evidence has established how the flaw was discovered. The company also acknowledged that a recent review performed with a leading AI model failed to identify the problem. Several competitor hardware wallet manufacturers have taken to social media to note that their products are not affected.

The Trezor X account added:

“We have always mixed multiple independent sources of randomness together (device hardware + host + secure elements on newer models). We are truly sorry for everyone who has lost bitcoin.”

The attacker’s identity remains unknown, and the stolen bitcoin could move from its consolidation addresses at any time. Investigators are still working to determine how many vulnerable seeds were actually generated, how much bitcoin remains exposed, and whether additional high-value wallets have already been identified by the attacker. However, Coinkite may not have much info on owners from long ago.

The incident will also test whether Coinkite can restore confidence in Coldcard and whether hardware-wallet makers adopt stronger independent reviews of seed generation. For users, the immediate priority is simpler: Anyone who created a seed on affected firmware without strong independent dice entropy, a passphrase, or multisignature protection should treat it as compromised and move funds carefully to a newly generated wallet.

Beyond the devastating theft, bitcoiners across the community are sounding the alarm and pushing others to spread the word before more vulnerable wallets are emptied.