Coldcard: 2026 Firmware Random-Number Flaw and Bitcoin Theft

A firmware build error caused some Coldcard hardware wallets to generate Bitcoin private keys with far less randomness than the device was designed to provide. Coinkite disclosed the flaw on July 30, 2026, shipped fixed firmware for every affected model the next day, and confirmed that funds tied to affected seeds stay at risk unless the seed used independent dice entropy or a strong BIP-39 passphrase. Independent trackers report drained totals in the hundreds of millions of dollars across multiple waves, with figures still moving as of this update. This article covers the cause, the affected devices, how attackers are actually draining wallets, an unresolved accountability claim, and what remains attributed rather than confirmed.

├─△CautionDisclosed

2026-07-30

Coinkite advisory

├─■ConfirmedFixed firmware

2026-07-31

Coinkite / GitHub changelog

├─▲WarningMk2/Mk3 entropy

~40 bits

Coinkite estimate

└─▲WarningTracked losses

594–1,816 BTC

Galaxy / press, disputed range

What happened, and why

Coinkite's security advisory and a same-day independent analysis from Block trace the flaw to a 2021 migration that rerouted wallet-seed generation from Coldcard's hardware random-number generator toward a general call meant to resolve to the device's STM32 true-random-number generator. A build guard, MICROPY_HW_ENABLE_RNG, checked only whether that setting was defined, not whether it was nonzero. Coinkite had defined it as 0, so the guard never fired, and the firmware silently linked MicroPython's deterministic software fallback, Yasmarang, instead of the hardware TRNG. Coinkite's technical backgrounder states the TRNG code was present in the compiled binary and had passed review; nobody had traced whether the seed-generation call actually reached it. Both generators shared the same function signature, so the build produced no error.

On Mk2/Mk3 firmware 4.0.1–4.1.9, the fallback drew mainly from the device's fixed hardware ID and timer state, which Coinkite estimates left roughly 40 bits of effective search space against a 128-bit target; Block describes these devices as fully deterministic once an attacker knows the identifier and timer history. Mk4, Mk5, and Q devices partially mitigate this with a secure-element mix-in and a 32-bit reseed at boot, reaching an estimated ~72 bits by Coinkite's count (Block bounds the secure-element contribution at up to 2³² possibilities). Both figures are well short of 128 bits and remain practically exploitable, not theoretical.

Which devices are affected

Updating firmware corrects new seed generation only; it does not repair a seed already generated on affected firmware. Coinkite says a seed created with at least 50 independent, private, fair dice rolls carries enough of its own entropy to resist the flaw on its own, and a strong, unique BIP-39 passphrase adds an independent barrier the reduced seed entropy cannot cross — though migration is still recommended in both cases.

How attackers are actually draining wallets

Independent researcher Dave Jones (eevblog) and a live defensive demo from the WatchGuard project (we_satoshis) describe a consistent mechanism, not guesswork about intent. Attackers precompute a database mapping every private key reachable inside the weakened search space to its corresponding Bitcoin address, then run real-time monitoring of the public mempool against that address list. The moment a matching address receives a deposit, the attacker already holds the private key and can broadcast a competing spend immediately; in one documented test the sweep attempt appeared roughly 10 seconds after the deposit.

Because the legitimate owner and the attacker are now both trying to spend the same output, replace-by-fee (RBF) fee bumping becomes a live race in both directions. WatchGuard pre-signed a defensive RBF transaction at a 9,000-sat fee that beat a rival attacker rebid of 9,100 sats on a live Mk3 test transaction, because the attacker's bump fell short of Bitcoin's minimum required fee increment; the same account shows attackers winning other races the same way. The transaction is visible on-chain. Jones stresses the technique is not Coldcard-specific: any wallet whose effective RNG entropy is low enough to precompute is exposed the same way once an address receives funds.

An unresolved warning claim

Bitcoin Core contributor James O'Beirne stated on X that he audited coldcard/firmware in May 2025, traced its RNG path to libNgU, a little-used library with a handful of GitHub stars, and found it relied on hardcoded Yasmarang constants he considered sloppy. He says he reported doubts that the true hardware RNG was in use and advised Coinkite to remove the library and link libsecp256k1 directly, but was told the boards were already properly configured and that a problem would already be known if one existed. He did not push further at the time. This is O'Beirne's own account; Cunicula found no public Coinkite reply addressing it specifically. Separately, following disclosure, at least one outlet reported that researchers traced the commit containing the faulty build guard to a code path signed off by Coinkite co-founder and CTO Peter Gray — a named detail worth tracking, not a finding this review independently verified.

Scale of theft: a disputed range, not one number

Trackers do not agree on a single total, and the number has moved almost daily. Galaxy Research's own count began at roughly 1,000 BTC (~$70M) from an initial 41-minute sweep on July 30, then rose across further waves; Fortune reported a running total of 1,816 BTC (~$116M) across about 5,200 addresses on August 4, and Cointelegraph reported Galaxy's assessment that at least 15 distinct attackers were involved, with combined losses approaching $100–130 million. A separate lower figure of roughly 594 BTC has also circulated, attributed in places to TRM Labs; Cunicula could not locate a TRM-published report stating that number and treats it as an unverified low-end estimate rather than a confirmed count. Given this spread, any single figure reported below the current news cycle should be read as a snapshot, not a final tally.

The AI-discovery claims: kept attributed

A separate set of claims links AI models to this incident and should not be conflated with the confirmed technical facts above. Coinkite says it ran an AI model over its own firmware weeks before disclosure and it missed the bug, but separately says it must assume an outside party used AI on an earlier firmware version to find it — an assumption, not a confirmed finding. Dragonfly's Haseeb Qureshi said roughly "$2 of AI hardening" could have prevented the exploit, citing social-media reports of AI models rediscovering the bug in minutes post-disclosure. Cointelegraph reported those claims alongside a named rebuttal from Tokenomist's Tatsapat Saerejittima, who traced the "found it in 2 minutes" claim to a single pseudonymous, evidence-free Reddit post made after the bug was already public, with no blind test and no documented methodology. Cunicula did not independently reproduce any AI code-scan claim and found no primary, methodologically sound source establishing that AI found this bug before disclosure; treat the AI-speed claims as disputed and attributed, not established.

What a Coldcard owner can check

• Confirm which firmware version generated your current seed. If it's a Mk2/Mk3 on 4.0.1–4.1.9, or a Mk4/Mk5/Q on any version before your model's July 31, 2026 fix (standard vs. Edge track), treat the seed as affected unless it used at least 50 independent dice rolls or a strong, unique BIP-39 passphrase you trust.
• There is no test that proves an existing seed is safe; affected status can only be narrowed by firmware version and dice/passphrase use, not verified directly.
• To migrate: update firmware first, generate a new seed on the updated device, verify the backup and a new receive address on-device, send a small test transaction, confirm it arrives, then move remaining funds. Keep the old backup until migration is confirmed.

Comparing custody options

This is a firmware defect in one vendor's random-number path, not a flaw in air-gapped signing or open-source firmware generally. Owners weighing whether to stay on Coldcard, move to a different open-source signer such as Foundation Passport, or reconsider custody tradeoffs can compare device records on the Coldcard provider page. Ledger's unrelated 2020 data breach, covered in Ledger Data Breach and Physical-Security Risks, exposed contact records, not seed entropy, and did not touch any device's key generation.

Sources

• Coinkite: Coldcard security advisory
• Coinkite: Technical deep dive into the entropy issue
• Coinkite: Update, Sunday
• Coldcard/firmware GitHub: release changelog
• Block Engineering: predictable RNG fallback and 32-bit reseed analysis
• BleepingComputer: Coldcard RNG flaw linked to $88 million theft
• CoinDesk: how bitcoin cold wallets lost $70 million
• CoinDesk: losses may near $114 million as fourth sweep emerges
• CoinDesk: Coldcard urges users to move bitcoin as exploit continues
• Decrypt: Coldcard exploit balloons to $88 million
• Decrypt: Coldcard exploit explained
• Cointelegraph: at least 15 attackers exploited the vulnerability
• Fortune: $116 million hack — what we know about the Coldcard exploit
• James O'Beirne (@jamesob) on X: May 2025 audit account
• WatchGuard (@we_satoshis) on X: live RBF defense demonstration
• Dave Jones (@eevblog) on X: attack mechanism explainer
• mempool.space: cited RBF-conflict transaction