title: "The Coldcard Vulnerability Explained: How a 2021 Firmware Bug Cost Bitcoiners $130 Million" description: "A five-year-old Coldcard firmware bug crushed wallet seed entropy from 128 bits to 40. Here's what happened, who's affected, how to migrate, and what the Bitcoin community is arguing about." slug: "coldcard-vulnerability-explained" date: "2026-08-05" updated: "2026-08-05" author: "Lyle Heartman" category: "Security" tags:

coldcard
coinkite
bitcoin security
hardware wallet
self custody
entropy
bip39 keywords: "coldcard vulnerability, coldcard hack, coldcard entropy bug, coinkite advisory, is my coldcard affected, coldcard firmware 4.0.1, bitcoin hardware wallet security, coldcard migration guide" image: "/blog/coldcard-vulnerability/cover.jpg" imageAlt: "Coldcard hardware wallet on a dark background with a cracked padlock overlay" canonical: "https://yourdomain.com/blog/coldcard-vulnerability-explained"

The Coldcard Vulnerability Explained: How a 2021 Firmware Bug Cost Bitcoiners $130 Million

Last updated: 5 August 2026. This is a live, ongoing incident. Figures are climbing daily.

TL;DR — the 30-second version

A firmware change shipped in March 2021 silently stopped Coldcard devices from using their hardware random number generator (TRNG) during seed creation.
Instead, seeds were built from a predictable software PRNG fed by non-secret data like the chip serial number and an internal timer.
Effective entropy dropped from the expected 128 bits to roughly 40 bits on Mk2/Mk3 — and around 72 bits on Mk4, Mk5 and Q.
40 bits is brute-forceable on a decent home rig. Attackers pre-computed millions of candidate seeds offline, then swept the matching addresses.
The first wave drained 1,082 BTC from 1,196 addresses in 41 minutes on 30 July 2026 — roughly 30 hours before Coinkite's public advisory.
As of 4–5 August, Galaxy Research tracks at least 15 separate attackers and losses approaching 2,055 BTC (~$130 million) across 7,700+ addresses.
Updating firmware does not fix an existing seed. If your seed was generated on affected firmware, that seed is permanently compromised. You must generate a new one and move your coins.

If you own a Coldcard and haven't migrated yet, skip to What to do right now. Do that first, read the rest after.

What actually happened

A hardware wallet has one job: generate a private key that nobody on earth can guess, and keep it off the internet. Coldcard, built by Toronto-based Coinkite, was one of the most respected devices in Bitcoin for exactly that reason. Air-gapped. Bitcoin-only. Open firmware. Recommended by half the educators in the space.

Nobody was phished. No device was stolen. No malware touched anyone's laptop.

The devices simply generated guessable keys, and had been doing so quietly since March 2021.

On 30 July 2026, between 01:10 and 01:51 UTC, an attacker emptied 1,196 Bitcoin addresses of 1,082.65 BTC — about $70 million at the time — according to on-chain mapping by Galaxy Research, built on a transaction pattern first identified by engineers at Block.

The forensic tell was in the transactions themselves: every sweep used the same unusually high 30 sat/vB fee and left no change output. That's not someone exploring a wallet. That's a script executing against keys the attacker already held.

Coinkite published its advisory roughly 30 hours later.

The technical root cause, in plain English

Where randomness is supposed to come from

When you set up a wallet, the device needs a number so random that guessing it is physically impossible. Coldcard hardware includes a dedicated TRNG on its STM32 chip for this — a circuit that harvests genuine physical noise.

What went wrong instead

In March 2021, Coldcard firmware v4.0.0 replaced its previous crypto stack with a library called libngu. Seed generation was rerouted from the hardware path to a software function.

Two problems compounded:

A broken preprocessor guard. A build-time check failed to force the hardware RNG path when a particular macro was set to zero. The software fallback was used silently — no error, no warning, no indication on screen that the TRNG wasn't contributing.
A deterministic fallback. The software PRNG (a Yasmarang variant) was seeded from things that are not secret: the device UID, timer state, and prior RNG call history. Security researchers also noted the output was XORed with a second deterministic stream initialised from hardcoded constants — and XOR of two known deterministic streams is still deterministic.

Why that's catastrophic

If an attacker can constrain the device UID and timer state, they can reproduce candidate output streams offline, derive the addresses for each candidate, and check them against the public blockchain. No device access needed. No network access needed. Just compute and patience.

At 40 bits, that search space is trivially small by modern standards. The strong assumption among researchers is that the attacker generated millions of candidate keys well in advance and simply waited — watching the chain for any of them to receive funds.

At 72 bits (Mk4/Mk5/Q), brute force is out of reach for consumer hardware but sits within theoretical reach of a well-funded adversary with specialised compute. Not "safe." Just "not yet."

Timeline of the incident

Date	Event
Dec 2017	Coinkite announces Coldcard; pre-orders open
Jul 2018	First Mk1 units ship
Jan 2021	The faulty preprocessor guard is committed to libngu
Mar 2021	Firmware v4.0.0 replaces the prior crypto stack; seed generation moves off the hardware RNG path
Mar 29, 2021	v4.0.1 ships — the earliest firmware Coinkite flags as confirmed vulnerable
~Apr 2021	Users publicly question the libngu rewrite. No action taken
2022	Isolated reports of individual Coldcard wallets being drained
May 2025	Developer James O'Beirne audits the firmware, flags libngu as a low-star pseudonymously maintained RNG source, and advises removing it. Coinkite reportedly responds that if something were wrong, "we'd already know about it by now"
Jul 30, 2026, 01:10 UTC	Wave one: 1,082 BTC swept from 1,196 addresses in 41 minutes
Jul 30, 2026	Coinkite publishes its security advisory and technical backgrounder
Jul 31, 2026	Fixed firmware released: 4.2.0 (Mk3), 5.6.0 (Mk4/Mk5), 1.5.0Q (Q)
Aug 1–2, 2026	Waves two and three identified; tracked losses climb past $89M across 4,585 addresses
Aug 4, 2026	Galaxy estimates at least 15 separate attackers; suspected totals near 2,055 BTC / $130M across 7,700+ addresses

The May 2025 line is the one that stings. The warning existed. It was specific. It was ignored.

Am I affected? Check this table

Device	Status
Mk2 / Mk3 on firmware 4.0.0 – 5.0.3	⚠️ Confirmed vulnerable. ~40 bits entropy. Migrate immediately
Mk4 / Mk5 below firmware 5.6.0	⚠️ Weaker variant. ~72 bits entropy. Migrate
Coldcard Q below 1.5.0Q	⚠️ Weaker variant. ~72 bits entropy. Migrate
Any device, seed created before firmware 4.0.0	✅ Not affected by this bug
Seed created using the dice roll option (50+ rolls)	✅ Safe — your entropy never touched the broken code path
Seed protected by a strong BIP-39 passphrase	🟡 Substantially lower risk — the passphrase sits outside the compromised seed
Tapsigner / Opendime / Satscard	✅ Different codebase. Not affected

The critical detail: exposure depends on the firmware your device was running when the seed was first created — not when you bought the hardware, and not what it's running today.

And to repeat the single most important sentence in Coinkite's entire advisory:

Updating the firmware does not change or repair an existing seed.

There is no patch for a weak private key. The key itself has to be replaced.

What to do right now (step by step)

Don't panic-move funds to a hot wallet. Scammers are actively hunting panicked users right now (see below).
Update to the fixed firmware — 4.2.0 for Mk3, 5.6.0 for Mk4/Mk5, 1.5.0Q for Q — from Coinkite's official site only.
Generate a completely new seed on the patched device. If you can, use the dice roll option with 50+ physical rolls so your entropy is verifiably your own.
Add a strong, unique BIP-39 passphrase to the new wallet.
Send your funds to the new wallet. Verify the receive address on the device screen, send a small test transaction first, confirm it lands, then move the rest.
Treat the old seed as burned. Never reuse it. Never restore it. Wipe the old backup.
Interim measure if you can't do a full migration today: Coinkite recommends adding a strong BIP-39 passphrase on the existing device and moving funds to the resulting wallet as a stopgap. It is a stopgap, not a fix.

If your wallet has already been drained, report the affected addresses and transactions to Galaxy Research and to law enforcement in your jurisdiction. Victim reports are actively helping researchers map new attacker clusters — one report from a victim who lost under 1 BTC helped identify an attacker who had taken 12 BTC from 126 addresses.

⚠️ Second-order attack: the fake "ColdCard Desktop" phishing wave

This is urgent and it is catching people.

American HODL publicly reported receiving a phishing email urging him to download a "ColdCard Desktop" app.

There is no ColdCard desktop app. There never has been. Coldcard is an air-gapped device. Any email, DM, ad, or search result pushing you to install desktop software to "check if your wallet is affected" or "secure your funds" is malware.

Rules for the next few weeks:

Only ever type coinkite.com / coldcard.com in directly. Never click a link from an email.
Coinkite will never email you asking for your seed words, and neither will anyone else who isn't stealing from you.
Be suspicious of any "migration helper" tool, browser extension, or Telegram/Discord "support" contact.
Sponsored search results are a common vector during panic events. Scroll past the ads.

Panic is the payload. A crisis where everybody genuinely does need to urgently move their coins is the perfect cover for a phishing campaign, and attackers know it.

What the Bitcoin community is actually saying

This is where the conversation has gone in the groups and timelines since 30 July. These are real arguments from real holders, and they're worth reading because the disagreements are more instructive than any single takeaway.

"So what's left — a password-protected wallet.dat on a Core node?"

An honest reaction, and it's the right instinct pointed at the wrong solution. A Bitcoin Core wallet.dat on a full node is a legitimate option, and Core's entropy comes from the OS CSPRNG, which is a much better-audited surface than a small vendor's custom library. But you trade one risk class for another: now you're securing a general-purpose, internet-connected computer, and your backup is a file rather than 12 words on steel.

The more useful conclusion isn't "abandon hardware wallets." It's that your entropy source is the single most important thing in your entire setup, and you should prefer setups where you can supply it yourself — dice rolls, coin flips, your own randomness. If you generate your own entropy, no vendor's RNG bug can touch you.

"I'm a HUGE fan of splitting up your stash"

This is the argument that aged best out of the entire incident.

"I saw the first guy who was compromised post on Reddit... Man, that sucks. But if he had his funds split up on three different wallets, he would be hurting but not wrecked."

Correct — with the crucial refinement that another member immediately added:

"Yeah, three different technologies I guess is the better statement."

That distinction is the whole lesson. Three Coldcards is not diversification. Three seeds generated on the same firmware share the same bug and get swept in the same 41 minutes. Diversification only helps if the failure modes are genuinely independent:

Different vendors (Coldcard, Trezor, BitBox, Foundation, Blockstream Jade)
Different entropy sources (device TRNG vs. your own dice rolls vs. OS CSPRNG on a Core node)
Different codebases — worth noting that Foundation's Passport was originally built in part on Coldcard's firmware, so shared lineage is a real thing to check
Different security models entirely — single-sig vs. multisig

Multisig is the strongest version of this argument. A 2-of-3 multisig with keys from three different manufacturers means a catastrophic entropy failure at one vendor costs you one key and zero coins. Multisig has real operational complexity and its own footguns — but this incident is the clearest case yet made for it.

"I have a few Ledger wallets but I don't know if they're affected"

Ledger devices are not affected by this bug. This is a Coldcard/Coinkite firmware issue in a specific library on specific models and firmware versions. It does not touch Ledger, Trezor, BitBox, or Jade.

Ledger's own security team publicly framed the incident as a failure of one specific implementation rather than an indictment of hardware wallets as a category — which is fair, if unavoidably self-interested coming from a competitor.

That said, the related supply-chain concern raised in the same conversation is legitimate and applies to every brand:

"I heard about people buying them on Amazon and not realizing they had been opened. I always order straight from Ledger.com."

That's the right habit. Buy hardware wallets directly from the manufacturer, never from Amazon, eBay, or a reseller. Tampered and pre-seeded devices sold through marketplaces are a well-documented attack. Check tamper-evident packaging on arrival, and never, under any circumstances, use a seed phrase that came printed in the box.

"At best, this is gross negligence"

The harshest view, and it has real evidence behind it:

The bug shipped in March 2021 and survived five years in publicly available open-source firmware.
Users publicly questioned the library rewrite as early as April 2021.
A credible developer audit in May 2025 identified the exact library as a risky RNG source and recommended removing it — and the reported response was essentially that if something were wrong, they'd already know.
Coldcard's entire market position was built on being the most secure option, marketed and promoted as such for years.

When your one differentiator is security, "our RNG silently didn't work for five years" is not a normal bug. And the fact that the fix requires every affected user to individually migrate — something no vendor can force — means the exposure window stays open for as long as people stay unaware.

"I'm not seeing anything obviously nefarious"

The counterweight, and it deserves equal airtime:

"There're obviously lots of conspiracy theories floating around now, but I don't know if there's any real proof of foul play yet? Security is hard so I expect bugs in every wallet."

This is the disciplined position. A cluster of circumstantial details is circulating about pseudonymous development practices around the library in question — and Coinkite's CTO did publicly confirm back in 2022 that the company encourages developers to work under nyms. But pseudonymity is completely normal in Bitcoin, and circumstantial pattern-matching is not evidence of intent.

Every element of this failure has an entirely mundane explanation: a preprocessor guard that didn't do what its author thought it did, a build configuration that silently fell back instead of failing loudly, and no test asserting that the hardware RNG was actually contributing. That's an ordinary, catastrophic engineering failure. It's exactly what a real bug looks like.

Negligence is well-supported by the record. Malice is not, at least not yet. Those are very different claims and it's worth keeping them apart — for accuracy, and because loudly guessing wrong about named individuals has consequences.

"They only sell hardware wallets, they never claimed to sell the best random numbers 😜"

The joke that contains the entire lesson. A hardware wallet is a random number generator with a screen attached. Everything else — the air gap, the secure element, the PIN, the tamper mesh — protects a key that is only as strong as the randomness that created it. Get the entropy wrong and every other layer is decoration.

Someone in the group also shared a visualisation of the scope of the randomness bug, which is worth watching if you want to see what a collapsed key space actually looks like: Visualising the Coldcard randomness bug

The lessons worth keeping

Generate your own entropy. Dice rolls take fifteen minutes and make you immune to every vendor RNG bug, past and future. This is the single highest-leverage habit in self-custody.
Always use a BIP-39 passphrase. It's the reason a meaningful number of affected users still have their coins.
Diversify across technologies, not units. Three devices from one vendor is one point of failure wearing three hats.
Consider multisig for meaningful amounts. 2-of-3 across different manufacturers turns a catastrophe into an inconvenience.
Buy direct from the manufacturer. Every time.
Open source is necessary but not sufficient. This firmware was public for five years. Nobody with the right expertise looked hard enough, and when someone finally did, the warning was dismissed. "Open source" is not the same as "audited."
Verify your setup periodically. Security isn't a purchase. It's maintenance.

FAQ

Is my Coldcard affected? If your seed was created on a Mk2 or Mk3 running firmware 4.0.0–5.0.3, treat it as compromised. Mk4, Mk5 and Q seeds created before firmware 5.6.0 / 1.5.0Q carry weaker (~72-bit) entropy and should also be migrated. Seeds created with the dice roll option are safe.

Does updating the firmware fix my existing wallet? No. Updating fixes future seed generation only. An already-weak seed stays weak forever. You must create a new seed and move your funds.

I used a BIP-39 passphrase — am I safe? Your risk is substantially lower, because the passphrase is an independent secret that sits outside the compromised seed. You should still migrate to a properly generated seed.

How much has been stolen so far? Estimates have climbed continuously. The first wave was 1,082 BTC (~~$70M). By 4 August, Galaxy Research put confirmed losses near 1,596 BTC (~~$100M) with a suspected total around 2,055 BTC (~$130M) across 7,700+ addresses, attributed to at least 15 separate attackers.

Can the stolen Bitcoin be recovered? Most of it hasn't moved — large consolidation addresses are being tracked publicly on-chain. But Bitcoin transactions are irreversible, and recovery would depend on identifying and prosecuting the attackers. Don't count on it.

Are Ledger, Trezor or BitBox affected? No. This is specific to Coldcard firmware from Coinkite.

Is the danger over? No. Because the vulnerability is now public and well understood, multiple independent attackers are actively racing to sweep wallets that haven't been migrated. Every day an affected wallet stays unmigrated is another day of exposure.

Should I stop using hardware wallets? No. The alternatives — exchanges, hot wallets, paper — have worse and more frequent failure modes. The correct response is better practice: your own entropy, a passphrase, diversification across technologies, and multisig for larger amounts.

Bottom line

Coldcard's failure wasn't in the parts of the device you can see. It was in the one thing you can never inspect: whether the number that became your private key was actually random.

If you own a Coldcard, migrate today. If you don't, take the lesson anyway — roll your own dice, add a passphrase, and stop keeping everything behind one vendor's assumptions.

This is a developing story. We'll update this post as Galaxy Research and Coinkite publish new figures.

Sources

Coinkite Security Advisory and Entropy Technical Backgrounder (blog.coinkite.com)
Galaxy Research on-chain analysis (Alex Thorn)
Block engineering analysis of Coldcard entropy
The Block, CoinDesk, TechCrunch, Fortune, The Hacker News reporting, 30 July – 4 August 2026

Nothing here is financial or security advice. Verify everything against Coinkite's official advisory before acting.