A build error in Coldcard’s firmware drained $38 million in bitcoin in 25 minutes
Coinkite says an attacker used AI to find a flaw its own AI review missed, exposing 500 wallets to a seed generation bug that reduced 128 bits of entropy to 40.
Summary
- An attacker drained 594 BTC, approximately $38 million, from roughly 500 Coldcard hardware wallets in 25 minutes on July 31, exploiting a seed generation flaw present since March 2021.
- The bug reduced the effective entropy of Mk3 seeds from 128 bits to approximately 40 bits, making private keys guessable through brute force computation instead of cryptographic attack.
- Coinkite, the maker of Coldcard, believes the attacker used AI to discover the flaw in its open source firmware, and says its own AI audit of the same code weeks earlier found nothing.
- Every current Coldcard model is affected to some degree, with Mk4, Q, and Mk5 seeds estimated at roughly 72 bits of entropy instead of 128, and updating the firmware does not repair seeds already created.
- Block, Trezor, and Ledger have confirmed their products are unaffected, while the incident raises fundamental questions about whether hardware wallets can be trusted as the sole custodial layer for significant bitcoin holdings.
The attack took 25 minutes. At 2:14 a.m. UTC on July 31, a single entity began sweeping bitcoin from Coldcard hardware wallets. By 2:39 a.m., 594 BTC had moved from approximately 500 wallets into a consolidation address. The funds, worth roughly $38 million at the time of the sweep, were not stolen through phishing, malware, or physical access to the devices. They were stolen because the devices generated predictable private keys.
Coinkite, the Toronto based company that manufactures Coldcard, published an advisory and a technical breakdown on July 30 after discovering the flaw. The company said a build error in its firmware caused seed generation to draw randomness from a software fallback rather than the hardware random number generator the device was designed to use. The bug had been present since firmware version 4.0.1, released in March 2021. Every seed generated on an affected Coldcard during the past five years was weaker than its owner believed.
The implications extend beyond the immediate financial loss. Coldcard has been the hardware wallet of choice for bitcoin maximalists, security researchers, and institutional custodians who prioritize air gapped, open source, bitcoin only security. If the most trusted hardware wallet in bitcoin could ship a five year old entropy bug without detection, the question is not whether Coldcard failed. The question is whether any hardware wallet can be trusted as a single point of custodial security.
The mechanism: how 128 bits became 40
The technical explanation is both simple and alarming. Coldcard’s firmware calls a function to fetch randomness during seed generation. Two implementations of that function existed in the codebase with identical signatures: the hardware random number generator that Coinkite wrote, and a software fallback inherited from MicroPython, the embedded Python runtime the firmware is built on.
A preprocessor guard was supposed to select the hardware implementation. But the guard checked only whether a configuration setting was defined, not whether its value was correct. When the firmware was compiled, the build system resolved the ambiguity by selecting the software fallback. The build completed without warnings. The resulting firmware generated seeds that appeared normal, produced valid bitcoin addresses, and accepted deposits without any indication that the underlying entropy was catastrophically weak.
On the Mk3, Coinkite estimates the effective search space for a seed generated under this condition at approximately 40 bits. A 128 bit seed has more possible combinations than there are atoms in the observable universe. A 40 bit seed has roughly one trillion combinations. That is within reach of a moderately resourced attacker using commodity hardware. The difference is not a rounding error. It is the difference between a lock that cannot be picked and a lock that can be kicked open.
The Mk4, Q, and Mk5 models include additional secure elements that mix their own entropy into the seed generation process. Coinkite estimates these models produce seeds with approximately 72 bits of effective entropy under the bug. That is materially better than 40 bits but still far below the 128 bit target. A 72 bit key space is not practically brute forceable with current consumer hardware, but it is within theoretical reach of a well funded adversary with access to specialized computing resources.
The most critical detail in Coinkite’s advisory is a single sentence: “Updating the firmware does not change or repair an existing seed.” Every Coldcard owner who generated a seed on affected firmware must create a new seed on patched hardware and migrate their funds. There is no software fix for a weak private key. The key itself must be replaced.
The AI dimension
Coinkite’s advisory introduced a claim that drew immediate scrutiny from the security community. The company said it believes “someone used AI to review previous versions of our firmware” to discover the bug. It added that it had run “one of the best available models” over the same code weeks before the attack, and the model “did not find this bug or anything serious.”
The claim is plausible but unverified. The Coldcard firmware is open source and publicly available on GitHub. Any person or automated system can review it. The specific class of bug, a preprocessor guard that checks definition rather than value, is the kind of subtle code path error that large language models have shown varying ability to detect depending on context, prompt engineering, and the model used.
The asymmetry Coinkite described is real even if its specific attribution is speculative. Attackers and defenders do have access to the same AI tools. But attackers have a structural advantage: they need to find one exploitable flaw, while defenders need to find all of them. An AI that reviews code and reports nothing serious provides false confidence. An AI that reviews code and finds a single exploitable path provides the attacker with everything needed.
The incident also raises questions about the security audit process for hardware wallets more broadly. Coldcard has been praised for its open source approach, which allows anyone to inspect the firmware. But open source visibility is only as valuable as the quality of the inspections performed. If the manufacturer’s own AI review, presumably conducted with full context about the codebase’s architecture and intent, missed the bug, the open source advantage becomes theoretical, not practical.
The security research community has debated the AI attribution claim with skepticism. Several researchers noted on social media that the specific bug class, a preprocessor guard checking definition versus value, is well documented in embedded systems literature and could have been found through conventional code review. The AI framing, they argued, risks obscuring a more fundamental failure: that Coinkite did not have sufficient human review processes in place for a critical code path that had not changed in five years. Whether AI found the bug or a human researcher did, the underlying problem is the same. The code was public, the bug was subtle but not novel, and nobody on the defending side caught it.
Block published an independent technical analysis on July 31 confirming that none of its products, including Bitkey, are affected. Block’s hardware lead Max Guise urged anyone with an affected Coldcard to “move funds as soon as they safely can.” Trezor confirmed its devices use a different entropy generation approach and are not vulnerable. Ledger has not published a formal response but its Secure Element architecture uses a dedicated hardware random number generator that operates independently of the firmware.
The five year window
The timeline of the vulnerability is as damaging as the vulnerability itself. Firmware version 4.0.1, which introduced the bug, was released in March 2021. Every seed generated on an affected Coldcard between March 2021 and the patched firmware releases on July 31, 2026, is potentially compromised. That is five years and four months of affected seed generation.
During that window, Coldcard shipped the Mk3 (affected at 40 bits), the Mk4 (affected at 72 bits), and the Q (affected at 72 bits). The Mk5, released in 2026, is also affected at 72 bits. Coinkite released multiple firmware updates during this period, none of which addressed or detected the entropy issue. The company’s own security reviews, including the recent AI audit, did not catch it.
The five year window also coincided with a period of significant bitcoin price appreciation. Seeds generated on affected Mk3 devices in 2021, when bitcoin traded between $29,000 and $69,000, now protect holdings at prices above $60,000. The economic incentive for an attacker to invest computational resources in brute forcing 40 bit keys increased with every price rally. A wallet holding 1 BTC that was worth $30,000 when the seed was generated is now worth twice that. The attacker’s return on investment improved simply by waiting.
The number of affected wallets is difficult to estimate precisely. Coinkite does not publish sales figures. The 500 wallets drained in the initial attack represent the most exposed subset, likely Mk3 users with the weakest 40 bit entropy who held balances large enough to justify the attacker’s computational investment. The total number of wallets with compromised seeds across all affected models could be significantly larger.
The attacker’s consolidation pattern suggests systematic preparation. The 594 BTC were swept from approximately 500 wallets into a consolidation address and then moved to a single address holding 562 BTC. The 25 minute execution window and the number of wallets targeted simultaneously indicate the attacker had precomputed the vulnerable keys before initiating the sweep. This was not an opportunistic attack. It was an operation that required weeks or months of preparation.
On chain analysis of the sweep shows a methodical execution sequence. The attacker did not broadcast all 500 transactions simultaneously, which would have risked mempool congestion and potential front running by MEV style bots monitoring for unusual transaction patterns. Instead, the transactions were batched in groups, each batch confirming within one or two blocks. The consolidation address received funds across multiple blocks before a final transaction moved 562 BTC to what appears to be a long term holding address. As of this writing, the funds have not moved further.
The migration problem
Coinkite’s remediation guidance asks affected users to perform a wallet migration: generate a new seed on patched firmware, verify the backup, send a test transaction, and then move remaining funds. The process is straightforward for users with a single wallet and moderate balances. It is significantly more complex for users with multisig setups, timelocked transactions, or wallets that serve as one key in a larger custodial arrangement.
The migration also creates its own security risks. Moving funds from a compromised wallet to a new wallet requires the compromised wallet to sign a transaction. If the attacker has already computed the private key, the attacker can front run the migration by monitoring the blockchain for any transaction from the compromised address and immediately sweeping remaining funds. Users with significant balances face a race condition between their own migration and the attacker’s sweep.
For users holding bitcoin in multisig arrangements where a Coldcard served as one of multiple signing devices, the migration is more complex but the risk is partially mitigated. A 2 of 3 multisig wallet where only one key was generated on an affected Coldcard remains secure as long as the attacker cannot compromise a second key. However, the compromised key still weakens the overall security model and should be replaced. The process requires coordinating with all key holders to construct a new multisig wallet with a replacement key, sign a migration transaction with the existing quorum, and verify the new arrangement before moving remaining funds.
Coinkite addressed one edge case that provides partial relief. Users who added at least 50 independent dice rolls during seed generation contributed enough external entropy to bring the total above 128 bits regardless of the firmware bug. The dice input was hashed together with the device generated randomness, so strong dice entropy compensated for weak device entropy. Users who added 99 or more rolls contributed approximately 256 bits from dice alone.
The dice exception highlights an irony. The users most likely to have added extensive dice rolls during seed generation are the most security conscious users, precisely the demographic that chose Coldcard specifically because of its reputation for superior security practices. For these users, their own paranoia about entropy quality may have inadvertently protected them from the manufacturer’s failure to deliver it.
What this means for hardware wallet security
The Coldcard incident is not the first hardware wallet compromise. Ledger faced a database breach in 2020 that exposed customer information. Trezor disclosed a physical extraction vulnerability in 2023. But those incidents involved either metadata exposure or physical access requirements. The Coldcard bug is different because it undermines the fundamental security promise of the device: that it generates truly random private keys.
The timing compounds the damage. The incident arrives as bitcoin trades near all time highs, and institutional adoption of self custody solutions has accelerated. Companies and family offices that selected Coldcard specifically for its security reputation now face an urgent operational decision: migrate funds on potentially compromised keys while racing against an attacker who may have already computed those keys.
The incident challenges several assumptions that the bitcoin community has treated as foundational. The assumption that open source firmware is inherently more secure than proprietary firmware because it can be audited. The assumption that hardware random number generators in dedicated bitcoin devices are more trustworthy than software alternatives. The assumption that a device focused exclusively on bitcoin, rather than supporting multiple cryptocurrencies, will have a simpler and therefore more auditable codebase.
None of these assumptions are wrong in principle. They are wrong only as absolutes. Open source firmware can be audited, but it was not audited effectively. Hardware random number generators are more trustworthy, but only when the build system actually links to them. A bitcoin only codebase is simpler, but simplicity did not prevent a five year old bug from going undetected.
The practical lesson is that hardware wallets should not be treated as the sole custodial layer for significant bitcoin holdings. Multisignature arrangements that distribute keys across multiple devices from different manufacturers, combined with independently generated entropy sources, provide defense in depth that no single device can match. The Coldcard incident demonstrates that even the most trusted device can fail in ways that are invisible to the user until the funds are gone.
The broader question is whether the hardware wallet industry’s security review processes are adequate for the assets they protect. A $38 million loss from a single firmware bug suggests they are not. The self custody model that bitcoin advocates promote requires custodial tools that meet a standard of reliability comparable to the banking infrastructure they seek to replace. After Coldcard, that standard has not been met.
What to watch
- The attacker’s movement of the 562 BTC consolidation. Whether the funds are mixed, sent to exchanges, or held in place will provide information about the attacker’s sophistication and jurisdiction. Chain analysis firms are already monitoring the address.
- Additional affected wallets beyond the initial 500. The attacker may have computed keys for additional wallets but chose not to sweep them simultaneously. The total exposure across all affected Coldcard models could be significantly larger than the initial $38 million.
- The pace of user migration. Coinkite cannot force users to generate new seeds. The number of wallets that remain on compromised seeds after 30, 60, and 90 days will indicate how effectively the advisory reached the affected user base.
- Regulatory response. A $38 million loss caused by a manufacturer’s firmware bug in a consumer financial product would trigger regulatory action in traditional finance. Whether consumer protection agencies or financial regulators respond to this incident will signal how governments classify hardware wallets.
- Competing manufacturers’ security disclosures. Block, Trezor, and Ledger have confirmed they are unaffected. Whether they publish detailed technical analyses of their own entropy generation processes will indicate whether the industry treats this as a Coldcard specific failure or a systemic review opportunity.
Frequently asked questions
How much bitcoin was stolen in the Coldcard exploit?
Approximately 594 BTC, worth roughly $38 million, was drained from about 500 Coldcard hardware wallets in 25 minutes on July 31, 2026. The funds were consolidated into a single address holding 562 BTC.
What caused the Coldcard vulnerability?
A build error in Coldcard’s firmware caused seed generation to use a software random number fallback from MicroPython instead of the hardware random number generator. A preprocessor guard checked only whether a configuration setting was defined, not its value, so the build linked to the wrong implementation without warning.
How weak were the affected seeds?
Mk3 seeds had approximately 40 bits of effective entropy instead of the intended 128 bits. Mk4, Q, and Mk5 seeds had approximately 72 bits due to additional entropy from their secure elements. A 40 bit key space is brute forceable with commodity hardware.
Does updating the firmware fix the problem?
No. Updating the firmware corrects future seed generation but does not repair a seed already created on affected firmware. Users must generate a new seed on patched hardware and migrate all funds to the new wallet.
Which Coldcard models are affected?
Every current model is affected to some degree. The Mk3 is most severely affected at 40 bits of entropy. The Mk4, Mk5, and Q are affected at approximately 72 bits. Tapsigner, Opendime, and Satscard use different code and are not affected.
Are other hardware wallets affected?
Block, Trezor, and Ledger have confirmed their products are not affected. Block published an independent technical analysis. Trezor said its devices use a different entropy generation approach. The vulnerability is specific to Coldcard’s firmware build process.
Did Coinkite know about the bug before the attack?
Coinkite says it discovered the flaw and published an advisory on July 30, after the bug was reported. The company says it ran an AI review of its firmware weeks before the attack and the review did not find the issue. The bug had been present since March 2021.
What should Coldcard owners do now?
Update to the latest firmware for your model. Generate a new seed on the patched device. Verify the backup and a receive address. Send a test transaction. Move remaining funds. Users who added at least 50 independent dice rolls during original seed generation may not need to migrate, but Coinkite recommends migrating regardless.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. The information presented reflects publicly available data as of July 31, 2026. Readers should conduct their own research and consult qualified professionals before making security or custody decisions.