Cold Storage Betrayed: The Five-Year Coldcard Firmware Bug That Silently Drained $116 Million in Bitcoin

IT 7 Minutes

On July 30, 2026, a sophisticated attacker emptied 1,196 Bitcoin wallets in roughly 41 minutes. The victims had done everything security experts tell you to do: they used an air-gapped hardware wallet from one of the most respected brands in the industry, they never typed their seed phrase into an internet-connected device, and many had held their coins untouched for years. None of it mattered. A silent misconfiguration buried in a firmware update from March 2021 had already made every seed those devices generated essentially guessable — and someone finally came to collect.

The Coldcard hardware wallet exploit is the most significant self-custody failure in Bitcoin history. What started as a single wave of 1,082 BTC (~$70.2 million) drained across 1,196 addresses has since been confirmed by blockchain intelligence firm TRM Labs to span four separate attack waves, totaling approximately 1,816 BTC — roughly $116 million — across more than 5,200 addresses. It ranks as the third-largest crypto hack of 2026, and unlike exchange hacks or DeFi bridge exploits, this one came for the people who thought they had opted out of custodial risk entirely.

Five Years in the Dark: How the Flaw Got In

The root cause is deceptively mundane: a single configuration variable set to the wrong value. During a library migration in March 2021, Coinkite engineers integrated a random number generation library called libngu. That library was designed to use the STM32 microcontroller’s hardware RNG (random number generator) — a true source of cryptographic entropy generated from physical electrical noise. But a build configuration flag, MICROPY_HW_ENABLE_RNG, was set to zero instead of one. The libngu library checked whether the macro existed, not whether it was actually enabled, and silently fell back to a software-based pseudorandom number generator (PRNG) called Yasmarang.

Yasmarang is not designed for cryptographic use. Instead of drawing on hardware randomness, it was initialized from predictable, low-entropy sources: the chip’s unique ID (essentially a serial number) and a handful of internal timer register values tied to startup timing. Once initialized, it collected no additional entropy. Coinkite’s own post-incident assessment confirmed the damage: Mk3 seeds generated under the flaw contained approximately 40 bits of entropy rather than the 128 bits required for a properly secure 12-word BIP-39 seed phrase. Later models with secure elements — the Mk4, Mk5, and Q — fared somewhat better at around 72 bits, but still well below the security threshold.

For five years, the flaw sat undetected in production firmware. Every Coldcard Mk3 running versions 4.0.0 through 4.1.9, and every Mk4, Mk5, and Q running firmware before 5.6.0 (or 1.5.0Q for the Q model), generated seeds with this weakened randomness. The wallets looked completely normal. The Bitcoin was fully functional and spendable. And the private keys that protected it were, in principle, reconstructible by anyone who could constrain the small space of possible entropy inputs.

July 30, 2026: Forty-One Minutes That Changed Everything

When the attack came, it was fast, methodical, and automated. At approximately 07:00 UTC on July 30, the first sweep began. Attackers had pre-computed a list of private keys derived from the reduced entropy space — using specialized computing hardware to systematically reconstruct candidate seeds and match them against publicly visible blockchain addresses. By the time the operation concluded, 1,196 addresses had been completely drained in a window of roughly 41 minutes.

The attack signature was immediately anomalous. Galaxy Research, which mapped the sweep in the hours after the incident, noted that the transaction pattern — elevated fees, zero change outputs, and complete wallet drains — left no ambiguity. “A sweep that looks the same as if a coin owner chose to move coins,” the firm observed, but with one telling fingerprint: every transaction carried the same 30 satoshis-per-byte fee rate with no change address, a combination Galaxy found in no other Bitcoin transactions in the preceding 30 days.

Over the following days, TRM Labs identified three additional attack waves totaling 4,004 more addresses and 733 more BTC, bringing the full scope to 1,816 BTC across 5,200+ addresses and roughly $116 million at prevailing prices. Some of the stolen funds were moved to Wasabi Wallet and Tornado Cash-style mixers, though TRM noted the laundering activity appeared exploratory rather than sophisticated — one OP_RETURN field in the blockchain data even contained a spam message advertising money-laundering services at a 7% fee.

Who Got Hit: The Cruelest Detail

The most devastating aspect of this exploit is the profile of its victims. These were not people who cut corners on security. They were, by every measure, among the most security-conscious Bitcoin holders in the world. They had purchased a premium hardware wallet — Coldcards retail for $150 to $250 — specifically because they understood the risks of keeping coins on exchanges or in software wallets. They stored backups in safes. They kept their seed phrases offline and private.

One victim’s account, documented in security forums and widely circulated following the incident, captured the collective disbelief: “I never shared my seed phrase with anybody. My devices never touched the internet. Everything was kept in multiple safes.” And yet the Bitcoin was gone, drained to an attacker address within a single block confirmation.

Galaxy Research’s analysis found that the majority of affected wallets had been dormant for extended periods — some for multiple years. These were holders, not traders. The coins had simply been sitting in cold storage, doing exactly what hardware wallets are designed to protect. The flaw that exposed them was never visible in any behavior, any log, or any warning the device could have surfaced. The entropy was wrong from the moment the seed was first generated.

Tracking the Attackers: What the Blockchain Reveals

TRM Labs was explicit in its attribution assessment: the attack is not consistent with North Korea’s Lazarus Group or TraderTraitor, which typically conduct large-scale crypto heists with aggressive, layered laundering operations. The transaction construction differed meaningfully across the four waves, suggesting multiple independent actors may have been working from the same underlying exploit — possibly a privately circulated tool or research that identified the entropy weakness before the public disclosure.

Most stolen funds remain pooled in a small number of attacker-controlled addresses with minimal onward movement. Galaxy Research identified approximately 600 suspected attacker addresses and reported them to federal investigators and blockchain compliance firms. However, Galaxy cautioned that it had not computationally confirmed every identified address as being generated from weak Coldcard entropy — the investigation is ongoing.

The presence of Wasabi deposits and one Tornado Cash interaction, combined with the OP_RETURN spam, suggests at least some portion of the attackers are unsophisticated or opportunistic, likely capitalizing on exploit code developed elsewhere rather than conducting original cryptographic research.

Coinkite’s Response: A Patch That Cannot Undo the Past

Coinkite shipped emergency firmware patches within 24 hours of the first public disclosure — Mk4/Mk5 to version 5.6.0, Q to 1.5.0Q, and Mk3 to 4.2.0, among other edge-build updates — and the company deserves credit for the speed of that response. But Coinkite was also unambiguous about a critical limitation that no patch can address: installing the update does not repair seeds that were generated on vulnerable firmware.

“Installing the update is not enough,” Coinkite’s advisory stated plainly. A seed generated with 40 bits of entropy does not retroactively become more random when the firmware is updated. Any wallet whose seed was created between March 2021 and the patch window remains permanently exposed, regardless of which firmware version currently runs on the device. The company’s official guidance is equally unambiguous: generate a new seed on patched firmware, verify the wallet fingerprint, and migrate all funds to the new addresses.

Notably, several product lines were entirely unaffected. TAPSIGNER, OPENDIME, and SATSCARD use different codebases and different entropy sources. Users of those products have no exposure from this vulnerability.

What You Need to Do Right Now

If you own a Coldcard hardware wallet, the following steps are not optional. They are urgent:

  1. Determine whether your seed is at risk. If your seed was generated on a Mk3 running firmware 4.0.0-4.1.9, a Mk4 or Mk5 running anything before 5.6.0, or a Q running anything before 1.5.0Q, treat your seed as compromised.
  2. Install the patched firmware. Download the appropriate update from Coinkite’s official site and verify the firmware signature before installation.
  3. Generate a completely new seed on the patched device. Do not restore your old seed to the updated firmware — restoring carries the weakness forward.
  4. Verify your new wallet by confirming the fingerprint and testing with a small transaction before moving the full balance.
  5. Move your coins. Transfer all funds from old addresses to addresses controlled by the new seed.

Three circumstances provide protection against the exploit even without migration: seeds originally generated using 50 or more independent dice rolls, strong BIP-39 passphrases (which create a separate wallet derivation path unreconstructable from seed words alone), and multisig configurations where the vulnerable Coldcard is only one signer among several non-Coldcard devices. If you are uncertain which of these applies to you, assume none do and migrate.

The Bigger Picture: Cold Storage Was Never Simple

The Coldcard exploit will be studied for years as a case study in how security-critical software fails in practice. The vulnerability was not a clever cryptographic attack against Bitcoin itself. It was a configuration error — the kind of bug that lives silently in codebases for years, catches no automated tests because both code paths produce valid-looking output, and surfaces only when someone is sufficiently motivated to probe the entropy space.

For the broader Bitcoin community, the lesson cuts deep. Self-custody has always been framed as the gold standard: not your keys, not your coins. That framing is correct, but it assumes the key generation process itself is sound. When the randomness underlying your private key is weak, the security model collapses at its foundation — not because you made an operational error, but because the device you trusted to handle the hardest part of the problem silently failed.

Hardware wallet manufacturers now face heightened scrutiny of their entropy pipelines, firmware build configurations, and third-party library integrations. Coinkite has committed to a full audit of its codebase. Other hardware wallet vendors — Ledger, Trezor, Foundation Devices, and others — have each issued statements confirming their entropy implementations are not affected by this specific flaw, though independent audits of those claims are already being demanded by security researchers.

The $116 million is gone. The more important number is the unknown figure representing how many more weakly seeded wallets still sit in safes around the world, coins intact, waiting to be swept. If you own a Coldcard and have not migrated yet, that number includes yours.

Sources:

Unknown's avatar

Published by jamrockbrown

Published

Leave a comment