How a 2021 Firmware Bug Broke Bitcoin's Best-Known Cold Wallet and What it Means for the Future of Self Custody

 A firmware regression introduced in March 2021 caused Coldcard hardware wallets to generate seed phrases using a predictable software fallback instead of the device's hardware random number generator, collapsing effective entropy to roughly 40 bits on Mk2 and Mk3 devices and about 72 bits on Mk4, Mk5 and Q, against an intended 128. Attackers reconstructed the resulting keys entirely offline, draining over 1,500 BTC across multiple waves beginning July 30, 2026. Updating firmware does not repair an existing seed, but seeds created with at least 50 private dice rolls are not considered at risk from this flaw alone

 

 

 

For years the strongest claim in Bitcoin self-custody was the air gap: a device that never touches the internet, generating private keys in isolation from any network an attacker could reach. Coinkite's Coldcard was widely treated as the reference implementation of that model. Over the first week of August 2026, that model failed, and it failed without anyone breaching the isolation.

Coinkite disclosed on July 30 that a coding error dating to March 2021 caused Coldcard devices to generate seed phrases using a predictable software program rather than the dedicated hardware chip built to produce genuine randomness. Attackers reconstructed victims' private keys offline with no physical access to any device, no phishing and no malware on victims' machines. The first sweep took 1,082.65 BTC, worth roughly $70 million, from 1,196 addresses in 41 minutes. Galaxy Research subsequently traced three waves totalling 1,367.05 BTC across 4,585 addresses, with its confirmed count later reaching 1,596 BTC and a possible fourth wave that would push the figure toward 2,055 BTC. Dollar valuations reported across the first week ranged from roughly $88 million to more than $130 million as the wave count and the Bitcoin price has both moved since then.

 

Bitcoin key security rests on entropy, the true unpredictability behind a master seed. A 12-word BIP-39 seed is meant to carry 128 bits of it, producing roughly 3.4 × 10³⁸ possibilities, a search space no adversary can exhaust. If an attacker can predict how a device produces that randomness, the physical security of the device stops mattering.

According to the analysis published by Block's Bitcoin engineering and security teams, the failure originated in a software library migration in 2021 during which two random-number functions with matching interfaces were confused. One reached the device's proper hardware generator. The other was a weak software fallback intended for boards without suitable hardware. Coldcard's production configuration defines the macro MICROPY_HW_ENABLE_RNG as zero, because Coinkite supplies its own hardware-RNG wrapper rather than using MicroPython's default path. The libngu library checked whether that macro existed rather than whether it was enabled, which silently bound the build to MicroPython's Yasmarang fallback. That fallback was initialized from the chip's unique ID and timer registers, and it collected no fresh entropy after initialization.

The resulting seed phrases looked random to a human reader while being drawn from a search space small enough to enumerate. Block's assessment is that an attacker who can determine or sufficiently constrain the device UID, timer state, and prior RNG-call history can reproduce candidate output streams offline without ever touching the device. Candidate seeds are then checked by deriving their addresses and comparing them against public blockchain data. A single code change on March 1, 2021 shipped in firmware 4.0.1 and remained in place, in open-source code, for over five years.

 

Coinkite's own estimates put effective entropy at roughly 40 bits on Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, and about 72 bits on Mk4, Mk5 and Q, where partial mixing with the secure elements limited the damage. Both figures are preliminary, and both are catastrophic relative to the 128-bit target.

Forty bits is approximately 1.1 trillion combinations. At a search rate of one billion candidates per second, exhausting that space takes under twenty minutes, and finding an average key takes half that. This is not a theoretical weakness requiring a nation-state adversary; it is tractable on commodity hardware, which is precisely what the July 30 sweep demonstrated. The gap between 128 bits and 40 bits is not a difference of degree.

Seventy-two bits deserves a more careful reading than it usually receives. Nominally, 2⁷² is about 4.7 × 10²¹ combinations, which at a billion guesses per second would take on the order of 150,000 years, and the jump from 40 to 72 bits makes the search roughly 4.3 billion times harder. The reason 72 bits is still treated as a failure is not that anyone will brute-force it head-on. It is that the nominal figure overstates the real search space, because the underlying generator is deterministic and seeded from constrained inputs. Block's point about reconstructing candidate streams from device UID, timer state and call history applies here too, and any additional constraint an attacker can impose reduces the practical work far below the headline number. For hardware sold to secure generational wealth, a seed whose entropy depends on how well an attacker can narrow a timer register is a broken seed.

For contrast, a properly generated 12-word seed at 128 bits requires on the order of 10²² years to exhaust at the same rate, and a 24-word seed at 256 bits offers about 1.16 × 10⁷⁷ combinations, a span exceeding the age of the universe by many orders of magnitude.

 

Galaxy traced the first sweep to a 41-minute window between 01:10 and 01:51 UTC on July 30, spread across nine blocks. Coinkite's first public advisory followed roughly 30 hours later. Every coin taken in the first two waves came from a wallet created after March 17, 2021, which remains the strongest evidence tying the thefts to the firmware release.

Rob Hamilton, CEO of AnchorWatch, tracked 1,324 spent outputs moving across 500 transactions within a three-block window. Every drained wallet was single-signature, each held more than 0.15 BTC. Many had been dormant for years, with coins dating to 2021. The transactions used a uniform high fee rate, often 30 sat/vB, and left no change outputs. Chainalysis found the attacker took roughly $30 million within the first ten minutes by prioritising the largest wallets first.

The stolen funds have largely not moved. Galaxy noted that the entire 1,158.66 BTC tracked at one stage sat unspent across seven attacker-controlled addresses, and offered two readings: the operator is waiting for scrutiny to fade, or has no viable path to launder a sum this visible. Galaxy also cautioned that its work is on-chain analysis and that it has not computationally confirmed every identified address was generated with weak Coldcard entropy, and that while waves one and two may share an operator based on transaction patterns, wave three should not be assumed to involve the same attacker.

Coinkite has said it must assume someone used AI to review previous versions of the firmware, and disclosed that the company itself ran a leading AI model over the code weeks earlier without the problem being flagged. Five years of open-source availability, multiple review passes, and one adversary who looked with better tooling.

 

 

The severity of the bug has driven sustained speculation about intent, and it centres on a genuine artifact. On October 10, 2021, the official Coldcard account was asked to define a "retirement attack" and replied that it is when the project makers could have a "bug" in the entropy generation for later retrieval. The bug had already been in shipping firmware for seven months when that reply was posted.

The coincidence is striking, and a portion of the Bitcoin community has read it as evidence of a deliberate, dormant backdoor timed to be harvested during a bull market. Anyone reporting on this should also weigh what cuts the other way. The tweet describes a threat model long known in wallet security, and Coldcard raised it in the context of marketing protection against exactly that risk, which is a normal thing for a security vendor to do. The technical mechanism Block documented is a mundane and plausible configuration error, of the kind that a macro-existence check instead of a macro-value check produces routinely. Coinkite disclosed the flaw itself, shipped emergency firmware across every affected model and release track on July 31, and has begun destroying remaining vulnerable inventory. No evidence of intent has emerged, and Coinkite characterises it as an accidental misconfiguration.

The company's public posture has been contrite rather than defensive, with an open letter urging affected users to move funds and an acknowledgment that the preceding days had been among the hardest in its history. Incompetence and malice produce identical code here, which is the deeper problem: an open-source, air-gapped device offers no way for a user to distinguish between them.

The single most important fact is that installing fixed firmware does not repair a seed that already exists. The flaw lives in the key that was generated, so a patched device protects new seeds only. Equally important, not every Coldcard holder is exposed, and treating this as a universal emergency has produced its own losses through rushed transfers and a fresh wave of wallet-support scams targeting people trying to move funds. Read Coinkite's official advisory as the authoritative source and work through your own situation before touching anything.

Exposure depends on four conditions holding together: the seed was generated on a Coldcard, the device was running affected firmware at the time, you did not add at least 50 private dice rolls, and the wallet is not protected by a strong, unique BIP-39 passphrase. On firmware version numbers, Mk2 and Mk3 seeds from versions 4.0.1 through 4.1.9 are considered affected, as are Mk4 and Mk5 seeds below 5.6.0 and Q seeds below 1.5.0Q. TAPSIGNER, OPENDIME and SATSCARD use different codebases and are not affected by this bug.

On the safeguards, Coldcard hashed the device-generated seed together with every roll entered through the Add Dice Rolls flow, so dice entropy you supplied was never removed by the defect. Coinkite counts 50 to 98 independent, private rolls as contributing at least 128 bits on their own, and 99 or more as roughly 256 bits, and does not consider a seed created that way at risk from this issue alone. If you rolled fewer than 50, cannot remember, or the roll sequence was recorded or exposed, treat the seed as affected. A strong, unique BIP-39 passphrase creates a separate wallet that cannot be reconstructed from the seed words alone, but Coinkite is explicit that short, common, patterned, quoted or reused passphrases may be guessable, and advises replacing the underlying seed as soon as practical even for users with strong ones. Some researchers, including Wizardsardine, take a harder line and treat passphrases as buying hours or days rather than safety. Multisig protects only where the spending threshold cannot be met by vulnerable Coldcard keys alone, and several victims learned the distinction the expensive way: three keys from the same vendor is one point of failure held three times, not a diversified quorum.

If you do need to migrate, Install the fixed firmware for your exact model and release track, verify the version on the device screen, then generate an entirely new seed on the updated device. Record and verify the backup, ideally on metal, and confirm the wallet fingerprint before depositing anything. Verify a fresh receive address on the device screen itself, send a small test transaction, and wait for confirmation. Only then move the remaining balance, and keep the old backup until every coin has arrived and confirmed. Be aware that attackers monitoring compromised addresses can attempt to intercept outgoing transactions by bidding higher fees, which is why out-of-band transaction submission was recommended during the active waves. Never enter a recovery phrase into an internet-connected computer, and treat any unsolicited migration assistance as hostile.

 

Bitcoin's base layer did nothing wrong here; SHA-256 remains unbroken and no consensus rule failed. What failed was the supply chain of tools people use to reach the network, and the failure originated at the key generation stage, before the protocol was ever involved.

Blockchain security firm Blockaid has noted that most crypto losses in the first half of 2026 came from compromised keys and operational failures rather than smart contract exploits, and Coldcard fits that pattern precisely. As Blockaid co-founder Ido Ben-Natan put it, a hardware wallet's security ultimately comes down to firmware and systems that users interact with but never see. Casa CTO Jameson Lopp made the adjacent point that verifying complex hardware and software systems is not feasible for the overwhelming majority of users, which leaves the choice between security models rather than between trust and its absence. Xapo Bank's chief information security officer Andrew Mannoukas framed the structural lesson as concentration rather than hardware: when security reduces to a single secret created on a single device in a single unrepeatable moment, every assumption baked into that moment is inherited whole.

The practical consequence is that several practices previously filed under advanced are becoming baseline for meaningful sums. Multisig across different manufacturers means a firmware defect at one vendor cannot compromise a quorum. Self-supplied dice entropy means no vendor's generator is the sole thing standing behind a seed. The ability to rotate to a new seed without drama turns an emergency into a procedure. Whether the industry responds with entropy attestations, seed-generation testing, and better key-rotation tooling is the open question this incident leaves behind.

 

What is the Coldcard entropy vulnerability? 

A firmware regression introduced on March 1, 2021 caused Coldcard hardware wallets to generate seed phrases using a predictable software fallback instead of the device's hardware random number generator. Effective entropy collapsed to roughly 40 bits on Mk2 and Mk3 devices and about 72 bits on Mk4, Mk5 and Q, against an intended 128 bits, making seeds reconstructable offline without any access to the device.

 

Which Coldcard models and firmware versions are affected? 

Mk2 and Mk3 seeds generated on firmware versions 4.0.1 through 4.1.9 are considered affected, along with Mk4 and Mk5 seeds created below version 5.6.0 and Q seeds below 1.5.0Q. TAPSIGNER, OPENDIME and SATSCARD use different codebases and are not affected by this bug. Check Coinkite's official advisory for the exact versions applying to your device.

 

How much Bitcoin was stolen in the Coldcard exploit? 

The first sweep took 1,082.65 BTC, roughly $70 million, from 1,196 addresses in 41 minutes on July 30, 2026. Galaxy Research subsequently traced three waves totalling 1,367.05 BTC across 4,585 addresses, with its confirmed figure later reaching 1,596 BTC and a possible fourth wave that would raise it toward 2,055 BTC. Reported dollar values ranged from about $88 million to more than $130 million across the first week.

 

Does updating Coldcard firmware fix the problem? 

No. The flaw lies in seeds that were already generated, so patched firmware protects new seeds only. Anyone whose seed was created on affected firmware without adequate dice entropy or a strong passphrase must generate a new seed and move funds to it.

 

Am I safe if I used dice rolls or a passphrase? 

Coldcard hashed device entropy together with dice rolls entered through Add Dice Rolls, so at least 50 fair, independent, private rolls means Coinkite does not consider the seed at risk from this flaw alone, with 99 or more contributing roughly 256 bits. Fewer than 50, or rolls you cannot recall or that were exposed, means treating the seed as affected. A strong unique BIP-39 passphrase is a real barrier, but Coinkite still advises replacing the seed, and short, reused or predictable passphrases should not be relied on.

 

Does multisig protect against the Coldcard bug? 

Only where the spending threshold cannot be reached using vulnerable Coldcard keys alone. A quorum built from several Coldcards is a single point of failure duplicated rather than genuine diversification. Multisig across different manufacturers is materially more resilient.

 

Was the Coldcard bug a deliberate backdoor? 

No evidence of intent has emerged, and Coinkite describes it as an accidental misconfiguration. Speculation centres on a genuine October 10, 2021 post from the official Coldcard account defining a "retirement attack" as a bug deliberately placed in entropy generation for later retrieval, published seven months after the flaw shipped. The countervailing reading is that the post described a well-known theoretical risk in the course of marketing protection against it, that the documented mechanism is a plausible configuration error, and that Coinkite disclosed the flaw and shipped fixes itself.

 

How was the vulnerability discovered? 

Coinkite has said it must assume someone used AI to review earlier versions of its firmware, noting that the company ran a leading AI model over the same code weeks beforehand without the issue being flagged. The code had been publicly available and open source for more than five years.