Coldcard Bitcoin Exploit Explained: Entropy, How Keys Are Generated, and Why Bits Matter

Somebody has been emptying Bitcoin wallets that were never supposed to be reachable.

The coins sat on Coldcard devices—hardware wallets from Canadian manufacturer Coinkite, the kind that never touch the internet. No phishing link. No malware. No stolen laptop. The attackers simply worked out what the private keys were.

Galaxy Research has now tracked more than 1,596 BTC stolen across three confirmed waves, with a suspected fourth wave that would lift the total to roughly 2,055 BTC—about $130 million at current prices. One sweep moved $70 million in 41 minutes. Coinkite says at least 15 separate attackers have piled in.

In 2021, Coinkite moved Coldcard's cryptography onto libsecp256k1, the same library Bitcoin Core uses. Sound decision. The integration is where it fell apart.

The migration quietly rerouted seed generation away from Coldcard's own hardware random number generator and onto MicroPython's software fallback—a small algorithm called Yasmarang that exists for devices with no randomness chip at all.

LOSSES FROM COLDCARD HACK EXCEED $100M

High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents.

If we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).

Coldcard has a randomness chip. It just stopped being asked.

The reason is almost too small to believe. A build guard used #ifndef, which checks whether a setting exists rather than whether it's switched on. Coinkite had defined that setting as zero, meaning "off." Because zero still counts as defined, the safety check passed and the build completed. Both versions of the function had identical signatures, so nothing looked wrong.

"The bulk of randomness on the COLDCARD was coming from a PRNG that I didn't know was actually in the source code base," Coinkite wrote, referring to a pseudo-random number generator—software that produces numbers that look random but follow a fixed recipe from a starting value.

Feed the recipe the same starting value and you get the same output. Every time.

On Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, that starting value came from the chip's serial number and its clock. Coinkite estimates the resulting search space at about 40 bits. Newer models mixed in a little secure-element entropy, lifting them to roughly 72 bits.

Neither is 128, the target.

The gap matters more than it looks. Bits are exponents. A 128-bit search space holds more combinations than there are atoms in the observable universe, and nobody is searching it. Forty bits is about a trillion—a number a decent laptop can chew through. Each bit you lose halves the work.

And deterministic is the opposite of random, which is essential to cryptography.

Coinkite suspects it was found by machine. "We have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue," the company wrote, adding that it had recently run one of the best available AI models over the same code and turned up nothing. "Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys."

Entropy is the measure of how much an attacker doesn't know.

In other words, it's basically uncertainty, counted in bits. One bit is one coin flip: two outcomes, and a guesser gets it right half the time. Ten bits is 1,024 outcomes. Each bit doubles the guesser's workload.

A Bitcoin wallet is a very large number kept secret. The address people send coins to is derived from it mathematically, and the derivation runs one way only—you can go from key to address, but never back.

So the security of every wallet rests on one question: How many numbers would an attacker have to try?

If the number was picked with 128 bits of entropy, the answer is "more than physics permits." If it was picked with 40, the answer is "give me some time."

This is where the vocabulary gets slippery. A pseudo-random generator produces output that passes statistical tests for randomness, so basically nothing a spreadsheet would flag. That output is still fully determined by its seed value. It looks random but isn't.

Statistical randomness and cryptographic unpredictability are different properties, and Coldcard's output would have sailed through the first test while failing the second completely.

True randomness has to come from physical noise: electrical jitter in a circuit, thermal fluctuation, radioactive decay. That's what the hardware chip on the Coldcard was for. That's the chip the build flag disconnected.

As users scrambled to regenerate seeds, many reached for the obvious low-tech fix. Coldcards let you roll physical dice and feed the results in as entropy. Coinkite's own guidance treats seeds made with at least 50 independent, private dice rolls as not at risk from the bug.

Bitcoin Twitter did not take it calmly.

should I hire someone with parkinsons to throw the dice?

"Overkill. A perfect d6 gives 2.585 bits per roll. A noticeably biased die, e.g. with one face landing 20% of the time instead of 16.7%, still gives about 2.55 bits. Across 99 rolls that's the difference between ~256 bits and ~252 bits of entropy."

Four bits out of 256. That's the whole penalty for a visibly unfair die.

Dashjr isn't wrong that cheap dice have measurable bias—injection-molded pips remove slightly different amounts of plastic from each face, which is precisely why casinos use flush-filled precision dice. He's right about the physics and wrong about the stakes. Losing four bits from 256 leaves you at 252. Coldcard's bug left users at 40.

There's a sharper argument buried in his advice, though, and it isn't about manufacturing tolerance. It's about not trusting any single source. Coldcard's failure wasn't that its entropy was slightly biased—it was that one component silently stopped contributing and nothing caught it.

If you generated a seed on an affected Coldcard without dice rolls (really) or a strong BIP-39 passphrase, that seed is compromised.

Update the firmware, generate a new seed, verify the fingerprint, send a test transaction, then move everything. Coinkite's advisory walks through it model by model. Exported seeds carry the flaw with them—moving a bad seed into a different wallet app doesn't solve anything.

For everyone else, the takeaway isn't that hardware wallets are broken or that dice are a trap.

It's that "random" is a claim, and claims need checking. Coldcard's source code was public the entire time. The intended hardware RNG was sitting right there in the binary. Reviewers confirmed it existed and never confirmed the seed generator actually called it.

Eight years of audits looked at the right code. Nobody checked whether it ran.