Coldcard bug leads to $89 million bitcoin theft

Self-custody is supposed to be the safest way to hold bitcoin: no exchange, no counterparty, keys generated and stored on a device that never touches the internet. Starting July 30, 2026, that assumption failed for thousands of Coldcard hardware wallet users, and the flaw traces back five years.

What happened

Attackers drained bitcoin from Coldcard addresses in a series of waves. The first hit on July 30 moved roughly 594 BTC in a 25-minute sweep, according to CoinDesk. By August 1, the total had grown to about 1,082 BTC, and by August 2-3 the running tally reached approximately 1,367 BTC, worth roughly $88.6 million, pulled from 4,385 to 4,585 compromised addresses depending on the count cited. Infosecurity Magazine reported the initial wave alone affected 1,196 addresses for around $70 million, with further waves targeting smaller balances using harder-to-trace transaction patterns.

The root cause

The vulnerability was not a hack of the device in the conventional sense. Coldcard maker Coinkite’s own explanation, as reported by Infosecurity Magazine, was that affected firmware “sometimes didn’t use a hardware-based random-number generator (RNG) to create users’ wallet seeds (master keys),” and instead fell back to a generator that was deterministic, meaning an attacker who could identify the pattern could reconstruct the seed and, with it, every private key derived from it.

The bug affected Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, a range that begins in March 2021. Newer Mk4, Q and Mk5 models running pre-fix firmware were also affected, generating seeds with roughly 72 bits of entropy rather than the 128 bits the design called for, a difference that makes brute-forcing dramatically more feasible.

Why weak randomness is catastrophic rather than merely risky

It helps to understand why a flaw in random number generation is so much more dangerous than most software bugs. A bitcoin wallet’s seed phrase is meant to be selected from an astronomically large space of possibilities, using entropy, genuinely unpredictable data, drawn from a hardware source designed for that purpose, such as electrical noise measured on the device itself. That vast space of possibilities is what makes brute-forcing a properly generated seed computationally infeasible even with enormous computing resources. A deterministic fallback breaks that assumption entirely. If a generator produces seeds from a much smaller, predictable set of outcomes rather than the full range, an attacker who reverse-engineers the pattern does not need to guess against the full space at all; they only need to search the much narrower set the flawed code was actually capable of producing. The drop from the intended 128 bits of entropy to roughly 72 bits described in Coinkite’s disclosure represents exactly that kind of narrowing, and the difference between those two figures is not linear: each additional bit of entropy doubles the size of the search space, so a reduction of roughly 56 bits shrinks the problem by a factor large enough to make dedicated attackers competitive against it, where the properly specified 128-bit space would remain out of reach indefinitely.

Why open-source and air-gapped design didn’t catch it

Coldcard has long been marketed on two selling points meant to inspire exactly the kind of trust this incident undermined: its firmware is open source, meaning the code is publicly viewable and, in theory, subject to scrutiny by anyone capable of reading it, and the device is air-gapped, meaning it is designed to operate without ever connecting to the internet, communicating with a computer only through microSD cards or QR codes rather than a direct data connection. Both properties genuinely reduce real categories of risk. Open-source code means a determined community of security researchers can, and often does, review it for vulnerabilities that a closed, proprietary codebase would hide entirely. Air-gapping removes the most common vector by which malware compromises a device, a live network connection an attacker can reach remotely.

Neither property, though, guarantees that every code path was reviewed with equal rigor, and a build configuration error of the kind described in this case is exactly the sort of defect that can persist through code being technically open to inspection: the flaw was reportedly in how the entropy source was wired into the build for specific device and firmware combinations, not in an obviously broken cryptographic algorithm that a cursory audit would flag. That distinction matters for how the industry talks about hardware wallet security going forward. “Open source” describes an opportunity for scrutiny, not a guarantee that the scrutiny happened thoroughly enough, quickly enough, or on every code path that mattered.

The response

Coinkite released updated firmware for every affected model and advised users not to generate new seeds until they installed the fix. For anyone whose wallet was set up in the affected firmware window and never regenerated since, the practical guidance from security researchers has been to update firmware immediately and move funds to a freshly generated seed on patched software, since a seed created under the flawed RNG cannot be trusted retroactively.

The wave pattern in the theft itself

The staggered nature of the theft, an initial 25-minute sweep followed by additional waves over the following days, also says something about how an attacker exploits a vulnerability like this one at scale. Rather than draining every affected address simultaneously, whoever carried out the theft appears to have worked through a list of compromised addresses incrementally, moving the largest or most accessible balances first and returning for smaller ones, using transaction patterns designed to make tracing and freezing the proceeds more difficult with each subsequent wave. That pattern is consistent with an attacker who had already reconstructed a large batch of vulnerable private keys before the first theft occurred, rather than one discovering and exploiting addresses one at a time as the attack unfolded, since assembling that initial list would itself have required running the flawed generation logic against a wide range of possible parameters ahead of time.

What it means for self-custody

The episode does not make custodial exchanges or ETFs safer by comparison; those carry their own counterparty risk. What it demonstrates is that self-custody security depends on firmware supply chains most holders never audit themselves. A device can be air-gapped, open-source and widely recommended, and a single weak randomness routine shipped four years ago can still undo it. Anyone holding meaningful value on a hardware wallet should confirm their firmware version against the vendor’s advisories rather than assuming “cold storage” alone is the end of the security question. That confirmation step, checking a firmware version number against a published advisory, costs a few minutes; the alternative, discovering years later that a wallet’s keys were never truly random, costs whatever balance was sitting behind them.