A firmware bug that sat unnoticed in Coinkite’s Coldcard hardware wallets for roughly five years turned into one of the largest self-custody thefts on record this year. Between July 30 and early August 2026, an attacker swept as much as 1,816 BTC, worth close to $116 million at the time, out of more than 5,200 addresses whose private keys had been generated with far less randomness than the device promised, according to tracking by TRM Labs and Galaxy Research. Coinkite rushed out firmware 4.2.0 as an emergency patch on July 31, 2026 for the versions affected, 4.0.1 through 4.1.9, but the damage exposes a problem firmware updates can’t fix retroactively: once a seed is weak, it stays weak forever.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
What Happened: The Coldcard Entropy Flaw in Plain Terms
Coldcard is a Bitcoin-only hardware wallet made by Canadian firm Coinkite, popular among users who want to keep private keys fully offline. The device’s entire value proposition rests on one promise: when it generates a new seed phrase, it uses true hardware randomness so nobody, not even a supercomputer, can guess it. According to The Hacker News, that promise broke silently starting with a firmware build shipped in March 2021. A regression in version 4.0.0 caused the device to skip its hardware random number generator during seed creation and quietly fall back to a much weaker software method.
The practical result: instead of the roughly 128 bits of entropy a Bitcoin seed needs to be effectively unguessable, Coldcard Mk2 and Mk3 units running firmware 4.0.1 through 4.1.9 produced seeds with only about 40 bits of entropy, according to Coinkite’s own advisory cited by Privacy Guides, a shortfall independently confirmed by exchange security team Phemex in an August 10, 2026 technical breakdown of the bug. Mk4, Mk5, and Q devices running pre-patch firmware fared somewhat better, at roughly 72 bits, still a massive shortfall from the intended standard. Forty bits sounds abstract until you do the math on what it takes to brute-force it.
Intended seed entropy: 2^128 candidate seeds
Coldcard Mk2/Mk3 (4.0.1-4.1.9): 2^40 candidate seeds
Coldcard Mk4/Mk5/Q (pre-fix): 2^72 candidate seeds
2^128 / 2^40 = 2^88 -> a search space 288 billion times smaller
A modern GPU rig can exhaust 2^40 candidates in hours, not millenniaThat gap is the entire story. An attacker who saw a public Bitcoin address funded by a vulnerable Coldcard didn’t need physical access to the device, didn’t need malware on the owner’s computer, and didn’t need to phish anyone. They just needed to brute-force candidate seeds offline until one produced a matching address, then move the funds. No alarms, no warnings, no way for the victim to know their wallet was compromised until the balance hit zero.
Timeline: Five Years From Bug to Breach
The entropy regression shipped in March 2021 and survived, in Coinkite’s own words as relayed by security blog 808bits, “five years of releases and reviews.” That detail matters more than the theft itself for anyone thinking about firmware trust: Coldcard is open source, has a loyal following of technically sophisticated Bitcoin holders, and still nobody caught a fundamental randomness failure for half a decade.
The exploitation itself was fast once it started. Blockchain analytics firm Galaxy Research mapped the first wave to a 41-minute window between 01:10 and 01:51 UTC on July 30, 2026, during which an attacker fully drained 1,196 addresses of 1,082.65 BTC, worth about $70.2 million at the time, a figure Block’s Bitcoin Engineering team corroborated on August 1, 2026 when it separately estimated more than 1,000 wallets were drained of roughly $70 million in under an hour. Coinkite disclosed the flaw and shipped patched firmware for every affected model within roughly 24 hours, on July 31, 2026, by which point CoinDesk was already reporting a running toll near $38 million and noting that Coinkite was forcing every affected user to generate new wallets. But the attacks didn’t stop. Follow-up waves on July 31 and into early August pulled additional funds from addresses whose owners hadn’t yet migrated to new, safely generated seeds.
The Numbers: How the Losses Kept Climbing
Tracking firms disagree slightly on the running total because new victim reports keep surfacing, but the trajectory is consistent across every source. By August 4, 2026, Galaxy Research had counted 1,596 BTC stolen from about 7,300 addresses across three confirmed waves of the attack. The table below compiles figures reported by Galaxy Research, Defimon, and Fystack as of mid-August 2026.
| Wave | Date | Addresses Drained | BTC Stolen | USD Value (approx.) |
|---|---|---|---|---|
| Wave 1 | July 30, 2026 | 1,196 | 1,082.65 BTC | $70.2 million |
| Wave 2 | July 31, 2026 | 1,478 | 76.16 BTC | ~$4.9 million |
| Wave 3 | Aug 1, 2026 | 1,912 | 207.73 BTC | ~$13.5 million |
| Wave 4 (partial, unconfirmed) | Early Aug 2026 | ~1,126+ | ~229 BTC (est.) | ~$14.9 million (est.) |
| Running total (confirmed) | Through Aug 7, 2026 | ~7,300 | 1,596 BTC | ~$103 million |
| Running total (if Wave 4 fully verified) | Through Aug 2026 | ~8,400+ | up to 2,055 BTC | up to $130 million |
Even the conservative figure, 1,596 BTC across roughly 7,300 addresses, makes this one of the largest self-custody hardware wallet failures ever recorded, dwarfing prior firmware-related incidents in the space. Custody-risk firm Safeheron went further in an August 2026 report, warning that more than $130 million in Bitcoin had been exposed to brute-force attacks via weak seeds generated under firmware 4.0.1 and later. Because Bitcoin transactions are irreversible and no central authority can freeze or claw back the funds, every dollar in that table is very likely gone for good.
Coinkite’s Response and the Firmware Fix
To its credit, Coinkite moved quickly once the flaw came to light. The company confirmed which models and firmware ranges were affected and shipped corrected builds for every product line within a day: version 4.2.0 for Mk3 devices, 5.6.0 for Mk4 and Mk5 units, and 6.6.0X for Edge variants, all dated July 31, 2026, according to a technical writeup from Cunicula. By August 30, 2026, Coinkite had formalized the minimum fixed builds as Mk4/Mk5 5.6.0, Q 1.5.0Q, and Edge 6.6.0X/6.6.0QX, while pointing users toward the newer standard releases, Mk4/Mk5 5.6.1 and Q 1.5.1Q, for full protection. Ledger, in an August 2, 2026 note on the incident, referenced Coinkite’s July 31 disclosure of a seed-generation firmware bug that had already caused what Coinkite itself called “significant user losses” exceeding $100 million. Coinkite has publicly characterized the bug as a build regression rather than a deliberate backdoor, and has stressed that it affected only seed generation, not the device’s transaction-signing logic.
That distinction is technically accurate but cold comfort to anyone who generated a wallet on the affected firmware. Coinkite’s own advisory carries a stark caveat: seeds generated from independent dice rolls, or protected by a strong BIP-39 passphrase, were never at risk regardless of the RNG bug, because those methods don’t depend on the device’s internal randomness at all. Everyone else who trusted the default on-device seed generation between 2021 and July 2026 is now in a race to move funds before an attacker gets there first.
Why a Firmware Update Doesn’t Make Old Seeds Safe
This is the part of the story that trips people up. Updating a Coldcard to the patched firmware stops the device from generating new weak seeds. It does nothing to protect Bitcoin already sitting behind an old, weak seed. The private key tied to that seed was compromised the moment it was generated, whether or not anyone has exploited it yet. Patching the firmware is like fixing a broken lock on your front door after a locksmith already cut a duplicate key. The new lock doesn’t invalidate the key that’s already out there.
Security researchers, including commentary compiled by ForkLog, describe the only real fix as a full migration: generate a brand-new seed under verified entropy conditions, ideally supplemented with dice rolls or a passphrase, and move every satoshi to fresh addresses. Anyone who delays that migration is effectively leaving a note on their door telling attackers exactly which addresses are still guessable, since the affected firmware versions and vulnerable date ranges are now public knowledge.
How Coldcard Compares to Past Hardware Wallet Failures
Hardware wallets have had security incidents before, but this one is structurally different from most of what came before it. Ledger’s most damaging event was the 2020 e-commerce database breach that exposed roughly 270,000 customers’ names and shipping addresses, a privacy and phishing-targeting problem rather than a cryptographic one. Trezor’s public research history mostly involves physical extraction attacks, where a researcher with the device in hand and specialized lab equipment can pull secrets off the chip, a threat model that requires the attacker to physically steal the wallet first.
| Incident | Root Cause | Requires Physical Access? | Scale |
|---|---|---|---|
| Coldcard entropy flaw (2026) | Weak RNG in seed generation firmware | No, remote brute-force from a public address | 1,596+ BTC (~$103M+) confirmed |
| Ledger data breach (2020) | E-commerce database exposed customer PII | No, but enabled phishing, not direct theft | ~270,000 customer records exposed |
| Trezor physical extraction research | Side-channel/chip-level key extraction | Yes, device must be physically obtained | Demonstrated in lab conditions, not mass exploited |
| CryptoJS weak RNG flaw (2026) | Predictable randomness in JS crypto library | No, remote key reconstruction | $5.7M in wallets drained |
What sets Coldcard’s incident apart is that the flaw undermined the single most foundational guarantee a hardware wallet makes: that the number it picked to become your private key was actually random. Everything else in the security model, tamper-resistant chips, air-gapped signing, PIN protection, is built on top of that assumption. When the assumption fails, all the downstream protections become irrelevant, because the attacker never has to touch them at all. Tech Insider covered a similar dynamic earlier this year with the CryptoJS weak RNG vulnerability, which used a nearly identical mechanism, a broken software random number generator, to drain $5.7 million from browser-based wallets. Two unrelated incidents, same root cause, months apart.
The Broader Problem: Entropy Bugs Are a Recurring Failure Mode
Cryptography has a long, uncomfortable history with random number generator failures, and the Coldcard incident fits a familiar pattern rather than being a one-off fluke. In 2008, a patch to Debian’s OpenSSL package accidentally reduced the entropy pool for SSL key generation down to a predictable 15-bit range, invalidating hundreds of thousands of cryptographic keys across the internet for nearly two years before anyone noticed. In 2013, a flaw in Android’s SecureRandom implementation led to duplicate or predictable values that were used to steal Bitcoin from Android wallet apps. The common thread across every one of these incidents, Debian, Android, CryptoJS, and now Coldcard, is that entropy failures are invisible by design. A weak key looks exactly like a strong key to the person holding it. There’s no error message, no warning light, nothing that tips off the user until someone with the technical skill to notice the pattern goes looking, or until an attacker beats them to it.
That invisibility is precisely why hardware wallet vendors carry an outsized responsibility. Software developers can patch and redeploy a web app in minutes. A hardware wallet’s firmware, once it has generated a seed and that seed has received funds, has created a liability that persists for as long as the coins sit on that address, regardless of what the firmware does afterward.
Market and Industry Impact
The theft has not moved Bitcoin’s price meaningfully. At roughly $103 million confirmed, the Coldcard incident is a rounding error against total crypto market capitalization, and Bitcoin’s price action through August 2026 shows no discernible dip tied to the disclosure. Where the impact shows up instead is in hardware wallet purchasing behavior and vendor scrutiny. Crypto security discussion tracked by Crypto.news reports a visible uptick in interest around multi-signature setups that split custody across hardware wallets from different vendors, precisely so a single vendor’s firmware bug can’t compromise an entire holding.
Coinkite’s reputation has taken a hit among a community that had treated Coldcard as one of the gold standards for Bitcoin self-custody, precisely because it is open source and marketed on the premise of verifiable security. The company’s fast disclosure and same-day patch cycle have earned some credit for transparency, but the five-year duration of the bug is now the headline detail security-conscious buyers will remember, not the speed of the eventual fix.
What Security Researchers Recommend Right Now
The advice converging across incident writeups is consistent and worth repeating plainly for anyone who owns a Coldcard purchased or set up between 2021 and July 2026:
- Update to the patched firmware immediately (4.2.0 for Mk3, 5.6.0 for Mk4/Mk5, 6.6.0X for Edge models), but treat this as step one, not the whole fix.
- Generate a completely new seed on the updated firmware, ideally supplemented with physical dice rolls for extra entropy assurance.
- Move all funds from any address created under the vulnerable firmware window to a new address tied to the new seed, as soon as possible.
- Add a strong BIP-39 passphrase to any wallet going forward, since a passphrase-protected wallet was never at risk from the RNG bug regardless of firmware version.
- Consider multi-signature setups spanning more than one hardware vendor for large holdings, so a single vendor’s firmware failure can’t compromise the entire balance.
Researchers are also pushing a harder message at the industry level: firmware audits for hardware wallets need dedicated, adversarial testing of randomness generation paths specifically, not just general code review, because a subtle regression in RNG sourcing can pass ordinary functional tests indefinitely. The device still generates a seed, still signs transactions, still looks completely normal. Nothing in a routine test would flag that the seed is weak.
Predictions: Where Hardware Wallet Security Goes From Here
A few likely consequences follow from an incident of this scale and visibility.
- Third-party entropy audits become a selling point. Expect competing hardware wallet vendors to commission and publicize independent RNG audits within the next two quarters, turning “verified entropy” into a marketing claim the way “open source” already is.
- Dice-roll seed generation moves from niche to default recommendation. Security-conscious guides and even vendor documentation will likely start recommending dice-assisted seed generation as the default rather than an advanced option for paranoid users.
- Multi-vendor multi-sig adoption rises among large holders. Institutional custodians and high-net-worth individual holders will increasingly split custody across at least two hardware wallet brands specifically to firewall against single-vendor firmware failures.
- Bug bounty and audit spending increases industry-wide. Hardware wallet makers will likely expand bug bounty scope explicitly to include entropy and RNG code paths, an area that has historically received less scrutiny than signing and PIN logic.
- Regulatory and insurance scrutiny of self-custody grows. As losses from firmware-level failures accumulate across incidents like this one and the CryptoJS RNG bug, expect crypto insurers and possibly regulators to start asking harder questions about the software supply chain behind “cold storage,” a term that has implicitly meant “safe” without much technical verification behind it.
How to Check If You’re at Risk
If you own a Coldcard, the first step is checking your firmware version against Coinkite’s published vulnerable ranges: Mk2/Mk3 on 4.0.1 through 4.1.9, or Mk4/Mk5/Q on any pre-July 31, 2026 build. If your device falls in that range and you generated your seed on-device without dice rolls or a passphrase, assume the seed is compromised regardless of whether you’ve noticed any unauthorized activity yet. Community tracking resources referenced by multiple outlets covering the incident have compiled lists of confirmed drained addresses, but the absence of your address from that list is not proof of safety. Attackers are working through the vulnerable address space over time, not all at once, and later waves have continued to find fresh targets weeks after the initial disclosure.
The safest assumption, and the one every security researcher covering this incident agrees on, is to treat any seed generated under the vulnerable conditions as burned. Move the funds. Don’t wait to see if you get lucky.
Frequently Asked Questions
What is the Coldcard entropy flaw?
It’s a firmware bug, introduced in March 2021, that caused certain Coldcard hardware wallets to generate Bitcoin seed phrases using a weaker software randomness source instead of the device’s hardware random number generator, cutting effective entropy from roughly 128 bits down to as low as 40 bits on some models.
How much Bitcoin was stolen in the Coldcard hack?
Confirmed losses stand at roughly 1,596 BTC, about $103 million, drained from around 7,300 addresses across multiple waves between July 30 and early August 2026, though a cross-referenced tally from TRM Labs and Galaxy Research puts the toll as high as 1,816 BTC, about $116 million, from more than 5,200 addresses. Some analysts estimate the figure could reach 2,055 BTC, close to $130 million, if a disputed fourth wave is fully verified, a ceiling in line with Safeheron’s August 2026 warning that over $130 million in Bitcoin remained exposed to brute-force attacks tied to the flaw.
Which Coldcard models are affected?
Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9 are affected most severely, at around 40 bits of entropy. Mk4, Mk5, and Q devices running any firmware released before July 31, 2026 are also affected, at around 72 bits of entropy.
Is my Coldcard safe if I update the firmware?
Updating firmware prevents the device from generating new weak seeds, but it does not protect funds already tied to an old seed created under the vulnerable firmware. Any coins on an address generated during the vulnerable window remain at risk until you move them to a newly generated, safely entropy-verified address.
Were seeds generated with dice rolls affected?
No. Coinkite has confirmed that seeds generated using independent dice rolls, or wallets protected with a strong BIP-39 passphrase, were never at risk from this bug, since those methods don’t rely on the device’s internal random number generator.
Can the stolen Bitcoin be recovered?
No large-scale recovery or clawback has occurred, and Bitcoin transactions are irreversible by design. Security researchers treat the stolen funds as permanently lost, with no centralized authority able to freeze or reverse the transfers.
How does this compare to other hardware wallet security incidents?
It’s structurally worse than most prior hardware wallet incidents, including Ledger’s 2020 customer data breach and Trezor’s physical extraction research, because it undermines seed generation itself and requires no physical access or user interaction to exploit remotely, only knowledge of a public address.
What should I do if I own an affected Coldcard?
Update to the patched firmware immediately, generate a brand-new seed (ideally with dice-roll assistance), add a strong passphrase, and move all funds from any address created under the vulnerable firmware to the new wallet as soon as possible.
