Coldcard seed vulnerability linked to a Bitcoin theft, but the $112 million figure is not firmly pinned down
Coinkite has disclosed a Coldcard seed-generation issue, and multiple reports have tied it to a large Bitcoin theft. The catch is simple: the headline figure of $112 million is not cleanly verified across the available reporting, so that number should be treated with caution, not as settled fact.
- Coldcard disclosed a seed-generation problem
- Weak entropy can leave a wallet exposed from day one
- The reported theft totals do not agree across sources
- Firmware fixes future generation, not past bad seeds
A seed phrase is the master backup for a Bitcoin wallet. If that seed is generated with weak randomness, an attacker may be able to recover the wallet’s private keys. That is the nasty part of this kind of flaw: a device can look like a fortress while quietly baking in a crack from the moment the seed is created.
According to the materials reviewed, Coinkite publicly disclosed the issue and advised users to update firmware, create a fresh seed, verify backups and receive addresses, and then move funds after a small test transaction. That is boring security advice, which is exactly the kind you want when real money is on the line.
What’s confirmed, and what isn’t
Confirmed: Coldcard is the hardware wallet involved, and Coinkite disclosed a seed-generation problem. The issue is about entropy, the randomness used to create the seed, not ordinary user error or a lost PIN.
Also confirmed: updating firmware alone does not repair a seed that was already generated under affected conditions. If the seed was weak when it was born, it stays suspect. A patch can protect future seeds. It cannot travel back in time and fix the old one. Physics remains undefeated.
Not confirmed: the precise theft total tied to this problem. The available reporting does not settle the numbers. One source referenced a rapid sweep of approximately 594 BTC from roughly 500 wallets. Another source, citing Galaxy Research and TRM Labs-related tracking, pointed to 1, 367.05 BTC, reported at nearly $89 million. A separate passage in the same material put that figure closer to $86 million and more than 4, 500 wallets.
Those are materially different figures. They may reflect different incident framings, partial data, or different ways of counting wallets and addresses. What they do not do is support a clean, verified $112 million total.
How a seed flaw becomes a real-world risk
Bitcoin wallet security depends heavily on entropy. In plain English, the wallet needs good randomness when it creates the seed. Weak randomness makes the seed less unpredictable, which can make it easier to recover or brute-force than it should be.
The supplied material says the affected Coldcard firmware ranges include:
- Mk3: seeds generated on firmware versions 4.0.1 through 4.1.9
- Mk4 and Mk5: seeds generated before standard firmware 5.6.0 or Edge firmware 6.6.0X
- Coldcard Q: seeds generated before standard firmware 1.5.0Q or Edge firmware 6.6.0QX
It also notes that TAPSIGNER, OPENDIME, and SATSCARD use different codebases and are not affected by this specific issue.
One detail matters more than most people want to hear: a firmware update does not make an already-weak seed safe. The only serious response is to generate a new seed under fixed firmware and migrate funds carefully. That means verifying the backup, checking the receive address, and sending a small test transaction before moving the full balance. Yes, it is tedious. No, that does not make it optional.
Why the theft linkage is still not fully settled
Public reporting has linked the flaw to a large Bitcoin theft, but causation has not been proven in a simple, final way from the material provided. The existence of a wallet flaw does not automatically explain every stolen coin.
There are plenty of other ways funds can disappear: phishing, malware, compromised backups, exchange account takeovers, physical access, or phone-number attacks. Once money is gone, everyone wants a single clean villain. Reality usually hands out a messier invoice.
That is why the discrepancy in the reported totals matters. If one set of numbers points to a few hundred wallets and another to several thousand, readers are not looking at a tidy single incident summary. They are looking at a developing attribution problem, with on-chain tracing still doing the heavy lifting.
What the technical angle appears to be
According to the materials, the flaw involved the intended hardware random-number contribution not being incorporated properly under certain conditions, which weakened seed generation. Independent analysis cited in the same material suggested the issue could make seed generation reproducible in some setups, though exploitation may depend on variables such as device identifiers, timing state, prior random-number calls, and derivation cost.
That nuance matters. A vulnerability can be severe without being trivial in every case. Still, “not always easy to exploit” is a very long way from “safe enough to ignore.”
The practical takeaway is simple: if a seed was created during an affected period, assume it may be compromised until proven otherwise. Self-custody works best when people are brutally honest about failure modes instead of hoping the hardware gods will clean up after them.
For a closer look at the mechanics, see Coldcard Firmware Bug Drained Bitcoin After Weak Seed, which breaks down how weak seed generation can translate into actual losses.
Possible legal fallout
The materials also point to potential legal questions if a product defect contributed to losses. Observers have raised possibilities such as breach of warranty, negligence, misrepresentation, and consumer protection claims, depending on what was disclosed and when.
That said, liability is not automatic. Causation still has to be established, and forensic evidence matters. A suspicious wallet flaw is not the same thing as a proven chain from defect to theft.
For those exploring the legal side, Coldcard Wallet Bitcoin Theft and Legal Options outlines the kinds of claims that may come into play when hardware defects and stolen Bitcoin intersect.
Key takeaways and questions
-
What is the Coldcard issue about?
It concerns seed generation and entropy. In some affected versions, the randomness used to create a wallet seed appears to have been weakened. -
Does a firmware update fix an old seed?
No. Firmware updates can protect future seed generation, but a seed created under affected conditions should still be treated as risky. -
Is the $112 million figure confirmed?
No. The available reporting conflicts on BTC totals, dollar values, and wallet counts, so that headline number is not firmly established. -
Should Coldcard users panic?
No, but affected users should verify whether their seed was generated in an impacted range, then migrate funds to a newly generated seed if needed. -
What is the most important user action?
Generate a fresh seed under fixed firmware, verify the backup carefully, and move funds only after confirming the new setup works.
Coldcard has built a strong reputation among Bitcoin self-custody users for a reason: it is designed for people who want serious security, not custodial hand-holding. But this is a reminder that hardware branding is not magic. Security lives or dies on implementation details, and entropy bugs are the kind of mistake that can turn a trusted tool into an expensive lesson.
If seed generation was ever in doubt, the sane move is to treat it as compromised until you know otherwise. In Bitcoin, paranoia is not a hobby. It is part of the job.
Related reporting has described this as a major breach, including The Largest Hardware Wallet Exploit of 2026 and a separate view that framed it as a Coldcard flaw tops $100M as David Schwartz warns self-custody carries real operational risk.
There is also a broader conversation about how far the damage may have spread, with some analysts suggesting a Coldcard firmware bug may have exposed Bitcoin holders to substantial losses, while other tracking posts described a COLDCARD Seed Generation Flaw Linked to Nearly $89 Million and one report pinned the issue to a Coldcard seed vulnerability tied to $112 million in stolen Bitcoin.
