Coinkite Warns Weak Randomness in Coldcard Firmware May Have Exposed Some Bitcoin

Coinkite, the maker of the Bitcoin-only Coldcard hardware wallet, warned Thursday that a firmware flaw weakened the randomness used to create some wallet seeds, potentially exposing users’ bitcoin even after they install an update.

The company said affected customers may need to do more than patch their device. If a seed phrase — the secret recovery words that control a wallet — was originally generated with weak entropy, or randomness, “their funds may be at risk,” Coinkite said in a July 30 security advisory. The remedy is to generate a new seed on fixed firmware and move funds to the new wallet.

That makes the issue more serious than a routine software bug. Firmware updates can prevent new weak seeds from being created, but they do not repair an old seed that was generated with flawed randomness. Community researchers and independent analysts have already linked the weakness to apparent on-chain sweeps of about 594 BTC from dormant single-signature addresses, worth roughly $35 million to $42 million at late-July bitcoin prices. Community posts citing a preliminary analysis by Block’s engineering and security team said another 488.10957948 BTC may also be related, which would push the total above 1,082 BTC, though that higher figure remains provisional.

The warning applies most directly to the older Coldcard Mk3. “Out of an abundance of caution, Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) or any subsequent version that their funds may be at risk,” the company said. In the same advisory, Coinkite said Mk4, Mk5 and Q devices that generated seeds before the fixed firmware releases are also affected, although the company said those models appear to have had higher effective entropy under its current attack assumptions.

In a technical post published the same day, Coinkite said the bug traces back to a 2021 library migration. In plain terms, wallet generation ended up using MicroPython’s software pseudorandom number generator fallback instead of the board-specific hardware random-number generator the devices were supposed to use. Weak randomness is a severe class of cryptographic failure because it can make otherwise secret wallet seeds more predictable.

Coinkite estimated that affected Mk3 seeds may have had an effective search space of about 40 bits. For Mk4, Mk5 and Q devices, the company estimated about 72 bits under its current assumptions. The company added: “we have released an emergency hotfix for current products.”

For current devices, Coinkite told users to upgrade Mk4 and Mk5 wallets to firmware version 5.6.0 or later, and Q devices to version 1.5.0Q or later, before generating any new seeds. But the company stressed that updating firmware alone does not fix an already generated weak seed. Users who may be affected need to create a new seed on fixed firmware and migrate their bitcoin.

Some users may face lower risk. Coinkite said seeds created with enough external entropy — including 50 or more private dice rolls entered through the device’s “Add Dice Rolls” flow — are not considered at risk from this random-number issue alone. The company also said a strong, unique BIP-39 passphrase, an optional extra secret layered on top of the seed words, materially lowers risk.

The company said it is considering whether it can safely ship a final fix for the deprecated Mk3, but warned that updating some legacy Mk3 devices carries a risk of bricking them, rendering the hardware unusable.

Coldcard has long been marketed to people who want to hold their own bitcoin rather than rely on an exchange or custodian. That security model depends heavily on the device producing strong randomness when it creates a seed. When that step fails, users may need to replace the seed itself, not just the software around it.

The full scale of any theft linked to the flaw is still being examined, and there is no verified public attribution for whoever may have exploited it.