Coinkite Coldcard Firmware Bug Weakened Seed Randomness, Allowing Tens of Millions in Bitcoin to Be Stolen

Coinkite, the maker of Coldcard Bitcoin hardware wallets, says a firmware bug weakened the randomness used to generate seed phrases on some devices, and blockchain analysts say attackers quickly exploited the flaw to steal funds. The company disclosed the issue July 30 and updated its advisory Aug. 1, telling affected users to create a new seed phrase and move their bitcoin. A firmware update by itself does not make an already vulnerable seed safe.

The known losses are large, though the total is still evolving. Initial on-chain analysis found about 594.48 bitcoin moved from roughly 500 single-signature addresses, worth about $38 million at July 30-31 prices. Later, Galaxy Research said 1,082.65 bitcoin, about $70 million at the time, was drained from 1,196 wallets in a 41-minute window on July 30, adding that the total rose as more waves and addresses were identified. Analysts have cautioned that estimates depend on which addresses are classified as confirmed victims and which remain only suspected cases.

According to Coinkite, the highest-risk group is users whose seeds were generated on Coldcard Mk2 or Mk3 devices running firmware 4.0.1 through 4.1.9, unless they added at least 50 private dice rolls when creating the seed. The practical takeaway is urgent: users in that group should not assume they are protected after installing new firmware. Coinkite says they must generate a new seed phrase and move funds to wallets derived from that new seed.

A seed phrase is the human-readable backup that controls access to a bitcoin wallet. If the randomness used to create it is too weak, an attacker can guess or precompute likely private keys and then sweep funds from addresses linked to those seeds. That is what makes this incident especially serious: it did not rely on phishing, a fake app or an exchange breach, but on a weakness in the key-generation process itself.

In its technical explanation, Coinkite said the flaw traces back to a March 2021 build and link-time integration error during a libNgU migration. Because of that mistake, seed generation used MicroPython’s Yasmarang, a non-cryptographic pseudorandom number generator, instead of the intended hardware true random number generator. In plain terms, the wallets still generated seed phrases, but the underlying randomness for some devices was much weaker than intended.

Coinkite’s preliminary estimate is that affected Mk2 and Mk3 seeds had about 40 bits of effective entropy under its attack assumptions. For Mk4, Mk5 and Q devices, which mixed in some secure-element entropy, Coinkite estimated about 72 bits. Those later models were therefore less exposed, but not fully immune under the company’s analysis. Coinkite released patched firmware including version 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, and 1.5.0Q for Q devices.

Even so, the scope of the incident is narrower than some online claims suggest. The exploit primarily affects single-signature wallets created from vulnerable seeds. Research cited by Coinkite and analysts indicates multisignature wallets, which require multiple keys to spend funds, were not affected in the same way. Coinkite also said products built on separate codebases, including TAPSIGNER, OPENDIME and SATSCARD, were not affected.

Some users also had meaningful extra protection. Coinkite said seeds created with 50 or more independent private dice rolls are materially less exposed because those manual rolls add fresh entropy outside the flawed process. A strong, unique BIP-39 passphrase — an additional secret layered on top of the seed phrase — also materially changes the attack surface, making straightforward seed recovery much harder for an attacker.

As investigators continue tracing the thefts, analysts including Galaxy have said suspected attacker and victim addresses have been shared with exchanges and law enforcement to try to block deposits and support possible recovery efforts. Coinkite, in a technical post that floated an AI-assisted attacker theory without presenting proof, wrote: “Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.” What is established, however, is simpler and more immediate for users: anyone who may have generated a seed in the affected window needs a new seed and a fund migration, because updating firmware alone does not secure old keys.