Coldcard's Firmware Bug Let an Attacker Drain $70 Million in Bitcoin in Under an Hour
On July 30, someone swept 1,082.65 BTC from 1,196 Bitcoin addresses in 41 minutes. At the time, that haul was worth roughly $70.2 million. Galaxy Research traced the operation and linked it to a firmware defect in Coldcard, the Bitcoin-only hardware wallet sold by Canadian company Coinkite.
The root cause is a March 2021 integration mistake. A configuration error sent seed generation to a software pseudorandom number generator rather than the STM32 chip's actual hardware RNG. So instead of pulling entropy from dedicated silicon, the device was running a deterministic software fallback the whole time.
The technical details are uncomfortable. Coldcard's production config set MICROPY_HW_ENABLE_RNG to zero because Coinkite wraps its own hardware RNG separately. The problem is the libngu library checked whether that macro existed, not whether it was switched on. It found the macro, assumed hardware RNG was active, and silently fell through to MicroPython's Yasmarang fallback instead. That fallback seeds itself from the chip's unique ID and a timer register, then collects no additional entropy after that point.
What that means in practice: an attacker who knows or can sufficiently narrow down the device's UID, boot timer state, and history of prior RNG calls can reconstruct candidate seed outputs entirely offline, no device access required. From there, deriving addresses and comparing against public blockchain data is straightforward.
Coinkite estimates the effective entropy at around 40 bits on the Mk3 and roughly 72 bits on the Mk4, Mk5 and Q. A standard 12-word BIP-39 seed should carry 128 bits. Block's analysis sets conditional upper bounds below 240.7 and 273.3 bits respectively, while noting that the higher figure does not translate to genuine 73-bit cryptographic security. No public brute-force benchmark has been published.
Coinkite pushed emergency firmware for all affected models on July 31. Installing it does not fix a seed that was already generated under the flawed code. The company's guidance is clear: generate a new seed on patched firmware, then move your coins. Restoring the old seed to updated firmware, or importing it to a different wallet entirely, carries the vulnerability forward.
Exposure depends on which firmware version was running when the seed was originally created:
Mk2 and Mk3: versions 4.0.0 through 4.1.9 are affected, fixed in 4.2.0.
Mk4 and Mk5: anything before 5.6.0.
Q: anything before 1.5.0Q.
Edge builds: before 6.6.0X for Mk4/Mk5, before 6.6.0QX for Q.
Seeds generated using at least 50 fair, independent, private dice rolls are not vulnerable to this specific bug. If there is any uncertainty about the quality or privacy of those rolls, Coinkite says migrate anyway. A strong, unique BIP-39 passphrase creates a derived wallet the bare seed words cannot reach, but Coinkite still recommends replacing the underlying seed. Multisig arrangements only help if the signing quorum is not made up entirely of affected devices. TAPSIGNER, OPENDIME and SATSCARD use separate codebases and are not affected.
Nobody has publicly identified the attacker. Galaxy noted the 1,196-address sweep shared an identical 30 sat/vB fee rate with no change outputs, a signature it found nowhere else in Bitcoin transactions during the preceding 30 days. The caveat worth bearing in mind: a coordinated sweep looks identical to a legitimate owner choosing to consolidate and move their own funds.
This comes shortly after Coinspect's Ill Bloom disclosure in early July, which exposed a separate weak-PRNG vulnerability in older software wallets. That flaw has been linked to more than $5 million drained across Bitcoin, Ethereum, Tron, Rootstock and Polygon since May. Weak entropy is apparently having a moment.