A flaw in Coldcard hardware wallet firmware is linked to a Bitcoin sweep that drained 1,196 wallet addresses in 41 minutes, taking 1,082.65 BTC worth roughly $70.2 million at the time, with later analysis raising observed losses to about $88.6 million across 4,585 addresses. Researcher Galaxy Research mapped the theft and tied it to a seed-generation bug in the wallets made by Coinkite.
The sweep occurred on July 30, and Coinkite shipped emergency firmware for every affected model and release track the following day. Installing the update does not repair an existing seed, however; owners must generate a new seed on patched firmware and move their coins. Galaxy reported roughly 600 suspected attacker-controlled addresses to federal investigators, compliance firms, and cybersecurity investigators.
The Weak PRNG Root Cause Behind the Coldcard Compromise
The vulnerability traces to a March 2021 firmware integration error that routed seed generation to MicroPython’s deterministic software PRNG instead of the STM32 hardware RNG. Coinkite’s production configuration defines MICROPY_HW_ENABLE_RNG as zero because the company supplies its own hardware-RNG wrapper, but the embedded interpreter checked whether the macro existed rather than whether it was enabled. The fallback was seeded from the chip’s unique ID and timer registers with no fresh entropy afterward.
Effective Entropy Well Below the BIP-39 Baseline
Coinkite estimates that the bug produced roughly 40 bits of effective entropy on the Mk3 and about 72 bits on the Mk4, Mk5, and Q models, compared with 128 bits for a standard 12-word BIP-39 seed. A seed built with at least 50 fair, independent, private dice rolls is not at risk from this bug alone, and multisig helps only when the signing quorum is not built entirely from affected devices.
Reproducing Candidate Seeds Offline From Public Data
The research notes that an attacker who can determine or constrain the device UID, the timer state, and the prior RNG-call history can reproduce candidate output streams offline, then check candidate seeds against public blockchain data. That offline guessing is what makes the theft scalable: once the seed space is small enough, the entire set of addresses on a vulnerable device can be enumerated and tested against the ledger.
Emergency Firmware and the Versions at Risk
Coinkite’s update covers all affected models and release tracks. The vulnerable versions are Mk3 firmware 4.0.1 through 4.1.9, fixed in 4.2.0; Mk4 and Mk5 before 5.6.0; the Q before 1.5.0Q; and the Edge before 6.6.0X for Mk4/Mk5 and 6.6.0QX for the Q. Galaxy identified two additional suspected waves beyond the first sweep, and noted that while waves one and two may share an operator, the third wave should not be assumed to be the same attacker. TAPSIGNER, OPENDIME, and SATSCARD products are unaffected.
What the Sweep Signals for Hardware Wallet Threat Models
The Coldcard incident undercuts the assumption that hardware wallets are immune to offline compromise because their seeds never leave the device. This bug produced the opposite outcome: a seed that was never exfiltrated could still be guessed, because the device generated it from a small, predictable state space. The 41-minute span of the first sweep suggests the operator had already reconstructed candidate seed streams before the transfer began, confirming the offline guessing model in practice. The broader lesson for the industry is that cold-storage protection rests on the quality of the entropy source as much as on physical isolation, and that wallet vendors that ship custom RNG wrappers carry an obligation to verify those wrappers are actually invoked. For the thousands of affected owners, the practical consequence is a permanent migration to new seeds, with no way to know whether an old seed has already been guessed against the blockchain, and no retrospective fix for funds already drained.
