The Coldcard Hack: Anatomy of an $85M Entropy Failure

On July 30, 2026, an attacker drained 1,196 Bitcoin addresses in just 41 minutes, sweeping 1,082.65 BTC — roughly $70.2 million at the time — in what on-chain analysts at Galaxy Research mapped as a single, methodical operation. It was only the beginning: a second wave followed, and by August 1 independent on-chain tallies counted at least 1,359 BTC — about $85 million — drained from more than 4,300 addresses. The victims all had one thing in common: their wallet seeds had been generated on a Coldcard, one of the most respected hardware wallets in the Bitcoin ecosystem.

There was no phishing, no malware, no supply-chain implant. The devices did exactly what their firmware told them to do. The problem is that, for more than five years, that firmware had been generating seeds with far less randomness than everyone believed. If this story sounds familiar, it should: it is the same class of failure behind Randstorm, the 2023 disclosure that put millions of early browser-generated wallets at risk. This article reconstructs the Coldcard incident, revisits Randstorm, and draws out the lessons the two events share.

Key facts at a glance

• What happened: a weak-entropy vulnerability in Coldcard hardware wallet firmware, exploited on-chain on July 30–31, 2026.
• Damage so far: at least 1,359 BTC (about $85 million) swept from more than 4,300 addresses — and the tally may still grow.
• Status: the stolen coins have not moved; wallets holding funds on unmigrated weak seeds remain at risk right now.
• Root cause: since March 2021 the firmware silently used a software PRNG (roughly 40–72 bits of effective entropy) instead of the hardware TRNG.
• Affected: seeds generated on Mk2/Mk3 with firmware 4.0.1–4.1.9, Mk4/Mk5 before 5.6.0, Q before 1.5.0Q.
• The fix: update the firmware, generate a brand-new seed and move your coins — a patch cannot repair an existing seed.
• The precedent: Randstorm (2023), the same class of failure in browser-generated wallets from 2011–2015.

Last updated: August 2, 2026. Figures are evolving; follow Coinkite's official channels for device-specific guidance.

What happened

On July 30, Coinkite — the maker of Coldcard — published a security advisory after researchers at Block traced the theft to a firmware flaw. The bug dates back to March 2021, when firmware 4.0.0 migrated Coldcard's cryptography to Bitcoin Core's libsecp256k1 library. During that migration, the routine that generates new wallet seeds silently stopped calling the device's dedicated hardware random number generator (TRNG) and started calling MicroPython's software fallback instead.

The detail is almost painfully mundane. Coinkite's build configuration set the flag MICROPY_HW_ENABLE_RNG to zero, intending to disable MicroPython's randomness entirely. But the preprocessor checked whether the flag was defined (#ifndef) rather than what its value was — so the weak fallback PRNG (an algorithm called Yasmarang) was compiled in anyway. Because the hardware and software functions shared the same name, the wrong one was linked silently: no error, no warning, and nothing visible in years of audits. The fallback was seeded only with predictable data — the chip's serial number and internal timer registers.

The consequence: instead of the 128 bits of entropy a 12-word BIP-39 seed requires, Coinkite estimates the effective search space at roughly 40 bits on Mk2 and Mk3 devices (firmware 4.0.1–4.1.9) and roughly 72 bits on Mk4, Mk5 and Q devices before their fixed releases. Forty bits can be brute-forced in hours on commodity hardware; seventy-two is expensive, but within reach of a well-funded attacker — and the prize was worth tens of millions.

One more uncomfortable detail: Coinkite suspects the attacker found the bug using AI-assisted review of the open-source firmware — and admits its own internal AI security review had failed to catch it. Emergency firmware shipped on July 31: version 4.2.0 for Mk2/Mk3, 5.6.0 for Mk4/Mk5, and 1.5.0Q for the Q.

The theft did not stop with the first sweep. On August 1, Galaxy Research identified a second wave of drains tied to the same attacker, bringing on-chain tallies to at least 1,359 BTC across more than 4,300 addresses. Strikingly, none of the stolen coins has moved since — unusual for a theft this size, and a sign the attacker can afford to wait. Independent trackers monitoring the drained clusters warn that any funds still sitting on weak Coldcard seeds are one scan away from joining them: this remains an ongoing event, not a closed case.

Who is affected — and what a patch cannot fix

This is the crucial point, and it is the same one Randstorm taught: updating the firmware does not repair a seed that was already generated. A key derived from weak entropy is weak forever. If your seed was created on an affected version, the only fix is to update, generate a brand-new seed, and move your coins to it.

• Affected: seeds generated on Mk2/Mk3 with firmware 4.0.1–4.1.9; Mk4/Mk5 before 5.6.0; Q before 1.5.0Q.
• Dice rolls: seeds created with 50 or more fair, private dice rolls are not exposed by this bug — the dice alone contributed at least 128 bits of entropy.
• Passphrases: a strong, unique BIP-39 passphrase creates a separate wallet that cannot be reached from the seed words alone. It buys time, but it does not repair the seed.
• Multisig: protects only if the quorum is not built entirely from affected devices.
• Not affected: TAPSIGNER, OPENDIME and SATSCARD use different codebases.

Randstorm: the warning we already had

In November 2023, recovery firm Unciphered disclosed Randstorm, a set of weaknesses in BitcoinJS — the JavaScript library that powered browser-based wallet generation on Blockchain.info (now Blockchain.com) and dozens of derivative services between 2011 and 2015. Unciphered stumbled onto it in January 2022 while helping a customer recover a wallet created in 2014.

The mechanics rhyme almost perfectly with Coldcard's. BitcoinJS's SecureRandom() function was supposed to use the browser's cryptographically secure generator (window.crypto). A type error meant that call silently failed, and the code fell back to Math.random() — which in the browsers of that era was typically a 48-bit linear congruential generator, often seeded with the time. Keys that should have had 256 bits of entropy sometimes had as few as 48. Unciphered estimated that millions of wallets — holding on the order of 1.4 million BTC at the time of disclosure — were generated during the vulnerable window, with the oldest wallets (2011–2012) the easiest to crack.

Perhaps the most sobering part: the flaw had been publicly flagged as early as April 2018 by a pseudonymous researcher on the bitcoin-dev mailing list. The warning was there, five years before the coordinated disclosure — just as entropy failures had been documented for years before Coldcard's bug was introduced.

Two incidents, one disease

Put side by side, Coldcard 2026 and Randstorm 2023 look like the same illness in different bodies:

• A silent fallback. In both cases, secure randomness was replaced by a weak substitute without any error: a type check in JavaScript, a preprocessor directive in C. The failure mode was invisible by design.
• Weak keys look normal. Nothing distinguishes a weak seed from a strong one. Addresses work, signatures validate, backups restore. The defect only becomes visible when someone else spends your coins.
• Patches do not heal victims. Fixing the code protects future wallets only. Every key generated during the vulnerable window stays vulnerable until funds are migrated.
• Long fuse, instant detonation. Coldcard's bug sat dormant for over five years; Randstorm's for over a decade. When exploitation came, it was total: 41 minutes for the first $70 million.
• The history was known. Android's SecureRandom flaw drained Bitcoin wallets in 2013. The Profanity vanity-address tool led to the $160 million Wintermute hack in 2022. Trust Wallet's browser extension and Libbitcoin's "Milk Sad" bug followed in 2023. Weak entropy is the oldest failure mode in applied cryptography — and it keeps returning.

The difference between the two cases is what makes Coldcard's sting: Randstorm hit hot wallets generated in browsers during crypto's improvised early years. Coldcard is a purpose-built, air-gapped, security-audited device marketed to the most careful users in the ecosystem. Entropy failures do not respect product categories.

Lessons for self-custody

• A hardware wallet is not a security proof. The security of every wallet reduces to the quality of the randomness at the moment of key generation. Where a device lets you contribute your own entropy — Coldcard's dice-roll seeding is the canonical example — use it. It is precisely what saved the users who did.
• Layer your defenses. A strong BIP-39 passphrase and multisig across devices from different vendors turn one catastrophic failure into a survivable incident.
• Exploitation can precede disclosure. The sweep began before most users had ever heard of the bug. Follow your vendor's security channels and treat entropy advisories as act-now events.
• Migrate, do not just update. After any key-generation flaw, funds must move to a freshly generated wallet on fixed software. An updated device with an old seed is still a vulnerable wallet.
• Old wallets do not age out of risk. If you still hold coins in a wallet created in a browser between 2011 and 2015, Randstorm applies to you today. Move them.

FAQ: the Coldcard hack and Randstorm

How much was stolen in the Coldcard hack? At least 1,359 BTC — about $85 million — drained from more than 4,300 addresses on July 30–31, 2026, according to Galaxy Research and independent on-chain trackers. The stolen coins have not been moved yet, and the total may still grow.

Is my Coldcard wallet affected? If your seed was generated on a Mk2 or Mk3 with firmware 4.0.1–4.1.9, on a Mk4 or Mk5 before 5.6.0, or on a Q before 1.5.0Q, treat it as compromised. Seeds created with 50 or more private dice rolls are not exposed by this bug. TAPSIGNER, OPENDIME and SATSCARD are unaffected.

Does updating the Coldcard firmware make me safe? No. The update only fixes future seed generation. You must install the fixed firmware, generate a completely new seed and move your bitcoin to it — a patch cannot repair a seed that already exists.

What is Randstorm and how is it related? Randstorm is a vulnerability disclosed by Unciphered in 2023: browser wallets created between 2011 and 2015 with BitcoinJS silently fell back from window.crypto to Math.random(), producing weak keys. It is the same class of failure as the Coldcard bug — a silent fallback to weak randomness — and those old wallets are still at risk today.

Are other hardware wallets vulnerable? This specific bug is unique to Coldcard's firmware. But the lesson is universal: a wallet's security reduces to the quality of its randomness at key generation, so use user-supplied entropy (such as dice rolls), a strong passphrase and multisig across vendors wherever possible.

Sources

• Coinkite — Coldcard Security Advisory
• Coinkite — Technical Deep Dive into the Entropy Issue
• Unciphered — Randstorm: You Can't Patch a House of Cards
• CoinDesk — Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep
• The Hacker News — Coldcard flaw linked to $70M Bitcoin theft
• The Crypto Times — Coldcard hack grows after second attack wave (Galaxy Research)
• BloomingBit — Coldcard hack losses top 1,359 BTC, about $85 million
• Coldcard Watch — independent on-chain tracker of the drained addresses

This article is for information purposes only and is not financial advice. If you own a Coldcard, check your firmware version and follow Coinkite's official guidance.