A firmware entropy bug in certain Coldcard wallets has helped attackers drain at least 1, 596 BTC, showing how badly seed generation can fail when randomness breaks.
- At least 1, 596 BTC stolen from roughly 7, 300 affected Coldcard addresses
- March 2021 firmware error led some devices to use weak randomness for seed creation
- AI-assisted review found 85 critical bugs across wallet codebases and libraries
- No PIN guessing, no device theft, just broken seed generation
The Bitcoin protocol was not hacked. The wallets were.
That difference matters, because it gets to the real failure here. The weak point was seed creation, not the chain. A hardware wallet is supposed to generate a secret starting point no attacker can predict. In this case, a firmware path introduced in March 2021 caused some Coldcard devices to fall back to Yasmarang, a software pseudo-random number generator, instead of the intended hardware entropy source. For a deeper look at the basics, even a long-running discussion on hardware wallet randomness circles the same core issue: if entropy is weak, everything built on top of it is toast.
That is a huge deal for security. A pseudo-random generator can be fine for plenty of tasks, but not when you need strong, unpredictable entropy. On affected older devices, investigators say the result was seeds with as few as 40 bits of effective entropy. That is not “less secure than ideal.” That is wildly inadequate for wallet seed creation.
Galaxy Research said that by August 3 it had confirmed 1, 596 BTC stolen from about 7, 300 addresses. The firm also said a suspected fourth wave could raise total losses to about 2, 055 BTC, close to $130 million. On July 30 alone, attackers drained more than 1, 082 BTC from 1, 196 hardware wallets in roughly 41 minutes.
That is a coordinated sweep, not random opportunism. A broader breakdown of the Coldcard hardware wallet flaw linked to $70 million makes the scale of the damage painfully clear.
Galaxy tracked four suspected waves of theft activity beginning July 30, confirming the first three waves and 14 smaller linked incidents as responsible for the 1, 596 BTC total. Galaxy head of research Alex Thorn identified a suspected fourth wave on August 3, estimating another 448.7 BTC moved from 709 additional addresses.
The attack rate hit 13.8 wallet drains per Bitcoin block, versus a baseline of 0.3 per block, or about 45 times normal. When the on-chain pattern spikes like that, something is badly broken. In fact, one separate report on the exploit’s effect on Bitcoin on-chain activity showed just how violently this flaw distorted normal network behavior.
The affected hardware is not identical across all Coldcard models. Coinkite says Mk2 and Mk3 devices running firmware versions 4.0.0 through 4.1.9 could end up with about 40 bits of effective entropy. Mk4, Mk5, and Q devices got a small secure-element contribution at boot, but after hashing and truncation the result was still only about 72 bits of effective entropy.
That is better than 40 bits. It is still nowhere near good enough for a wallet that is supposed to keep private keys out of an attacker’s reach. And no, “72 bits” is not some magical shield. It is just a smaller disaster.
Attackers did not need physical access to the devices. No device was stolen. No PIN was guessed. The weakness sat earlier in the process, at seed generation, where the entire self-custody model lives or dies.
The largest single theft Galaxy identified involved 1, 159 BTC removed across seven addresses in one sweep. As of August 5, those coins had not moved and had not entered mixers or cash-out services. That matters because unmoved funds are far easier to trace, freeze, or recover through legal pressure.
A separate attacker had begun laundering 64 BTC, with about 10 BTC mixed in the first pass. Roughly 90% of the stolen funds remained unmoved at the time of reporting, which is both encouraging and frustrating. Every hour that passes gives thieves more time to split, mix, and disperse funds into places where recovery gets harder and uglier.
Chainalysis found that Canadian Bitcoin holders account for about 25% of attributable losses. That figure refers to losses it could link through on-chain analysis and related attribution work, not every single victim worldwide. Even so, the geographic spread is a reminder that bad firmware does not care about borders.
Coinkite has issued corrected firmware: 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, 1.5.0Q for the Q model, and Edge versions 6.6.0X and 6.6.0QX for Mk4 and Q on the Edge release track. It also halted outbound shipments after confirming the vulnerability and destroyed every device containing affected firmware still in its facilities.
The fixes matter, but they only protect future seed creation. They do not repair a seed already created under the flawed randomness path.
Coinkite says users who added at least 50 fair, independent, private dice rolls when generating a seed may have enough extra entropy to avoid the risk. In plain English, that means the user added their own real-world randomness during setup, making the device’s weak output much harder to exploit. A strong, unique BIP-39 passphrase also reduces immediate exposure, but it does not fix a weak seed. If the seed itself is compromised, the passphrase is just a stronger lock on a door whose hinges are already bent.
Block’s Bitcoin engineering and security team independently identified and confirmed the same error, which should kill any temptation to dismiss this as a one-off vendor blunder. Hardware wallets are only as trustworthy as the code paths that actually execute, including the boring fallback logic everyone assumes will never matter.
Nick Percoco, Kraken’s chief security officer, put the point bluntly:
“Production firmware should undergo independent testing to confirm that the approved source of randomness is the one actually used.”
That should not sound controversial. It should sound like the minimum bar.
The uncomfortable part is that this does not look isolated. A separate AI-assisted review found 85 critical-severity findings across multiple wallet implementations and supporting libraries. Not all of those findings have been made public as of August 7, 2026, but the number alone suggests a broader testing problem across the wallet stack, especially around entropy handling and the code that decides where randomness comes from. One analysis of the RNG flaw put the problem in even sharper focus, showing how easily a tiny implementation mistake can turn into a full-blown wallet-draining event.
That is where the standards debate gets sharper. Common Criteria, CSPN, FIPS 140, NIST SP 800-90B, and BSI AIS-31 all exist for a reason: cryptographic modules and randomness validation are hard to get right. But certification can still miss the live path actually used at runtime. If the approved entropy source looks fine on paper and the firmware quietly routes around it, the badge on the box is not much comfort.
AI-assisted static analysis is not magic, but it is useful because it can trace awkward code paths, compile-time branches, and dependency interactions that human reviewers miss. Security bugs often live in the places nobody expects to matter. That is why this kind of auditing is becoming more relevant, not less.
The market reaction has been telling too. OKX chief compliance officer Jonathan Brockmeier said the exchange has seen record inflows since the attacks began, calling it “the flip side of FTX.” The point is simple: when exchange failures or wallet failures hit the headlines, more people move toward self-custody. They want control. They also want tools that do not quietly betray them.
OKX also reported preventing $26.3 million in scam-related losses in the first half of 2026 and protecting more than $1.1 billion in customer assets in the same period. That does not fix the Coldcard issue, but it helps explain why custody and security are suddenly back at the center of user behavior.
K33 Research said nearly 890, 000 BTC moved on-chain in the seven days after the initial attacks, the highest seven-day active supply figure recorded in 2026. In the same period, Bitcoin’s 30-day high-to-low trading range was the narrowest since 2023, and realized volatility fell below that of the Nasdaq 100.
That is a strange but useful contrast. The asset itself was unusually calm while the custody layer around it was getting hammered. Bitcoin did not break. The human and software layers around self-custody did.
David Schwartz, Ripple’s CTO Emeritus, compared the situation to MF Global. The comparison lands because the biggest losses in finance often come from custody, not from the settlement rail. Bitcoin does not eliminate operational risk. It exposes it. A separate lab note on the Trezor Safe 7 secure element flaw lands in the same uncomfortable territory: funds may be safe today, but trust is fragile when the hardware stack starts wobbling.
Key questions and takeaways
-
Was Bitcoin hacked?
No. The Bitcoin protocol was untouched. The failure happened in wallet seed generation, where weak randomness made some keys far easier to recover than they should have been. -
How much has been stolen?
Galaxy Research confirmed 1, 596 BTC stolen from about 7, 300 addresses. A suspected fourth wave could push losses to about 2, 055 BTC, according to Galaxy’s estimate. -
Why was this so dangerous?
A seed phrase is the root of a wallet. If the seed is weak, attackers can brute-force the wallet without stealing the device or guessing the PIN. -
Can a firmware update fix an already exposed seed?
No. Updated firmware can protect future seed creation, but it cannot repair a seed that was already generated under the flawed randomness path. -
What should affected users do?
They should assume exposure if their seed was created under the flawed firmware path, check their device version, and move funds only after creating a fresh seed with verified entropy. A BIP-39 passphrase helps, but it is not a cure for a bad seed. -
Is this only a Coldcard problem?
Probably not. The AI-assisted review found 85 critical-severity findings across wallet implementations and supporting libraries, which suggests broader weaknesses in how wallet randomness is tested. -
Can any of the stolen BTC still be recovered?
Possibly. Roughly 90% of the stolen funds remained unmoved at the time of reporting, and coins that have not entered mixers or cash-out services are much easier to trace or freeze.
The blunt lesson is simple: self-custody is freedom, but freedom without ruthless engineering discipline is just expensive optimism. Bitcoin can be sound. Wallet software still needs to earn that trust, every time it creates a seed.
