Coldcard's 2021 Firmware Bug Drains $89M in Bitcoin — A Five-Year Blind Spot

In March 2021, a single configuration error in Coldcard's firmware quietly swapped the device's hardware random number generator for a predictable software substitute — and nobody caught it for five years. On July 30, 2026, attackers began systematically draining wallets built on the weakened seeds, taking 1,082.65 BTC (~$70.2 million) from 1,196 addresses in a 41-minute sweep. Once Galaxy Research tallied additional waves, the total reached 1,367.05 BTC (~$88.6 million) drained from 4,585 addresses — one of the largest thefts ever linked to a hardware wallet.

What went wrong in the firmware

Coldcard, made by Canadian manufacturer Coinkite, is a purpose-built offline signing device: the entire pitch is that private keys and seed generation never touch an internet-connected machine. Starting with firmware 4.0.0 in March 2021, a build configuration error caused the device's libngu library to check only whether a hardware-randomness macro existed in the code, not whether it was actually enabled. In practice, seed generation silently fell back from the chip's true hardware RNG to a software pseudorandom generator seeded from non-secret data — the device's serial number and its internal clock.

On Mk3 devices the resulting seeds carried roughly 40 bits of entropy instead of the 128 bits a BIP-39 Bitcoin seed is meant to guarantee; Mk4, Mk5, and Q devices running affected builds fared somewhat better at around 72 bits. Both are small enough for an attacker to brute-force against a plausible range of serial numbers and clock values — which is exactly what appears to have happened.

Which devices are exposed

• Mk2 and Mk3: firmware 4.0.0 through 4.1.9 (fixed in 4.2.0)
• Mk4 and Mk5: any firmware before 5.6.0
• Q: any firmware before 1.5.0Q
• Edge/beta builds: before 6.6.0X (Mk4/Mk5) or 6.6.0QX (Q)

Coinkite shipped emergency firmware on July 31, 2026, closing the RNG fallback. But updating the firmware does not retroactively fix a seed that was already generated under the broken code path — the weak entropy is baked into the seed the moment it's created, not introduced by the software that later signs with it.

A seed built with at least 50 fair, independent, private dice rolls is not at risk from this bug alone.

— Coinkite

Why this matters beyond one vendor

The incident illustrates a failure mode specific to hardware security devices: the entire value proposition rests on one hard-to-audit assumption — that the RNG call actually does what its name implies. A macro-existence check standing in for a macro-enabled check is the kind of defect unit tests routinely miss, because the firmware still boots, still signs transactions, and still produces seed phrases that look entirely correct. Nothing in the device's behavior signals the entropy loss; only an attacker draining a wallet and researchers reverse-engineering the pattern exposed it. That's a five-year blind spot in a product category whose sole job is trustworthy key generation.

For anyone who generated a Coldcard seed between March 2021 and July 31, 2026, the fix isn't "update the firmware" — it's "generate a new seed on patched firmware and move every coin." A strong BIP-39 passphrase layered on top creates a functionally separate wallet and may have protected some users, but Coinkite and independent researchers both recommend full seed replacement regardless of passphrase use.