Coldcard: 2026 Firmware Random-Number Flaw and Bitcoin Theft

At a glance

A zero-valued guard selected a deterministic fallback. The stable root cause was a defined-only build guard that silently selected a deterministic fallback; the hardware TRNG code remained present but the seed-generation call did not reach it.

Sources

1. 1. blog.coinkite.com · coldcard mk3 seed generation …
2. 2. blog.coinkite.com · entropy technical backgrounder
3. 3. github.com · ChangeLog.md
4. 4. engineering.block.xyz · predictable rng fallback and …
5. 5. x.com · revision
6. 6. x.com · revision
7. 7. mempool.space · revision

Data behind this diagram

Coldcard RNG failure causal chain

Stage	What happened	Evidence source
Firmware migration	The 2021 libsecp256k1 migration rerouted wallet-seed generation through a general random-number call	Coinkite advisory; Block Engineering
Build guard	MICROPY_HW_ENABLE_RNG tested whether the setting was defined rather than whether it was nonzero	Coinkite advisory; Block Engineering
Zero value	The setting existed with value 0, so the intended guard did not fire	Coinkite technical backgrounder
Fallback selection	The firmware linked the deterministic Yasmarang software fallback instead of the hardware TRNG	Coinkite advisory; Block Engineering
Silent build	The TRNG code was present and both generators shared a function signature, so the build produced no error	Coinkite technical backgrounder
Reduced entropy	Coinkite estimated about 40 bits for Mk2/Mk3 and about 72 bits for Mk4/Mk5/Q	Coinkite advisory; Block Engineering
Attack mechanism	Attackers can precompute reachable keys, watch the public mempool, and race the owner with a competing spend	WatchGuard and eevblog accounts; cited on-chain transaction
Repair boundary	Fixed firmware stops new affected seeds but does not repair an existing affected seed	Coinkite advisory; Coldcard changelog

Scroll →

A firmware build error caused some Coldcard hardware wallets to generate Bitcoin private keys with far less randomness than the device was designed to provide. Coinkite disclosed the flaw on July 30, 2026, and shipped fixed firmware for every affected model the next day. Its current advice is to migrate funds from affected seeds. A passphrase does not repair the seed; independently generated dice entropy has separate conditions. Reported losses vary by source and date. This article covers the cause, the affected devices, how attackers are actually draining wallets, an unresolved accountability claim, and what remains attributed rather than confirmed.

What happened, and why

Coinkite's security advisory and a same-day independent analysis from Block trace the flaw to a 2021 migration that rerouted wallet-seed generation from Coldcard's hardware random-number generator toward a general call meant to resolve to the device's STM32 true-random-number generator. A build guard, MICROPY_HW_ENABLE_RNG, checked only whether that setting was defined, not whether it was nonzero. Coinkite had defined it as 0, so the guard never fired, and the firmware silently linked MicroPython's deterministic software fallback, Yasmarang, instead of the hardware TRNG. Coinkite's technical backgrounder states the TRNG code was present in the compiled binary and had passed review; nobody had traced whether the seed-generation call actually reached it. Both generators shared the same function signature, so the build produced no error.

On Mk2/Mk3 firmware 4.0.1–4.1.9, the fallback drew mainly from the device's fixed hardware ID and timer state, which Coinkite estimates left roughly 40 bits of effective search space against a 128-bit target; Block describes these devices as fully deterministic once an attacker knows the identifier and timer history. Mk4, Mk5, and Q devices partially mitigate this with a secure-element mix-in and a 32-bit reseed at boot, reaching an estimated ~72 bits by Coinkite's count (Block bounds the secure-element contribution at up to 2³² possibilities). Both figures are well short of 128 bits and remain practically exploitable, not theoretical.

Which devices are affected

Updating firmware does not repair an existing seed. Coinkite's current advisory says a passphrase does not repair it either: migrate as soon as practical. The dice exception requires at least 50 independent, fair, private rolls that have not been exposed. The advisory lists the exact conditions and current firmware releases.

How attackers are actually draining wallets

Independent researcher Dave Jones (eevblog) and a live defensive demo from the WatchGuard project (we_satoshis) describe a consistent mechanism, not guesswork about intent. Attackers precompute a database mapping every private key reachable inside the weakened search space to its corresponding Bitcoin address, then run real-time monitoring of the public mempool against that address list. The moment a matching address receives a deposit, the attacker already holds the private key and can broadcast a competing spend immediately; in one documented test the sweep attempt appeared roughly 10 seconds after the deposit.

Because the legitimate owner and the attacker are now both trying to spend the same output, replace-by-fee (RBF) fee bumping becomes a live race in both directions. WatchGuard pre-signed a defensive RBF transaction at a 9,000-sat fee that beat a rival attacker rebid of 9,100 sats on a live Mk3 test transaction, because the attacker's bump fell short of Bitcoin's minimum required fee increment; the same account shows attackers winning other races the same way. The transaction is visible on-chain. Jones stresses the technique is not Coldcard-specific: any wallet whose effective RNG entropy is low enough to precompute is exposed the same way once an address receives funds.

An unresolved warning claim

Bitcoin Core contributor James O'Beirne stated on X that he audited coldcard/firmware in May 2025, traced its RNG path to libNgU, a little-used library with a handful of GitHub stars, and found it relied on hardcoded Yasmarang constants he considered sloppy. He says he reported doubts that the true hardware RNG was in use and advised Coinkite to remove the library and link libsecp256k1 directly, but was told the boards were already properly configured and that a problem would already be known if one existed. He did not push further at the time. This is O'Beirne's own account; Cunicula found no public Coinkite reply addressing it specifically. Separately, following disclosure, at least one outlet reported that researchers traced the commit containing the faulty build guard to a code path signed off by Coinkite co-founder and CTO Peter Gray, a named detail worth tracking, not a finding this review independently verified.

Scale of theft: a disputed range, not one number

Trackers do not agree on a single total, and the number has moved almost daily. Galaxy Research's own count began at roughly 1,000 BTC (~$70M) from an initial 41-minute sweep on July 30, then rose across further waves; Fortune reported a running total of 1,816 BTC (~$116M) across about 5,200 addresses on August 4, and Cointelegraph reported Galaxy's assessment that at least 15 distinct attackers were involved, with combined losses approaching $100–130 million. A separate lower figure of roughly 594 BTC has also circulated, attributed in places to TRM Labs; Cunicula could not locate a TRM-published report stating that number and treats it as an unverified low-end estimate rather than a confirmed count. Given this spread, any single figure reported below the current news cycle should be read as a snapshot, not a final tally.

The AI-discovery claims: kept attributed

A separate set of claims links AI models to this incident and should not be conflated with the confirmed technical facts above. Coinkite says it ran an AI model over its own firmware weeks before disclosure and it missed the bug, but separately says it must assume an outside party used AI on an earlier firmware version to find it, an assumption, not a confirmed finding. Dragonfly's Haseeb Qureshi said roughly "$2 of AI hardening" could have prevented the exploit, citing social-media reports of AI models rediscovering the bug in minutes post-disclosure. Cointelegraph reported those claims alongside a named rebuttal from Tokenomist's Tatsapat Saerejittima, who traced the "found it in 2 minutes" claim to a single pseudonymous, evidence-free Reddit post made after the bug was already public, with no blind test and no documented methodology. Cunicula did not independently reproduce any AI code-scan claim and found no primary, methodologically sound source establishing that AI found this bug before disclosure; treat the AI-speed claims as disputed and attributed, not established.

What a Coldcard owner can check

• Confirm which firmware version generated your current seed. If it's a Mk2/Mk3 on 4.0.1–4.1.9, or a Mk4/Mk5/Q on any version before your model's July 31, 2026 fix (standard vs. Edge track), treat the seed as affected unless it meets the independent-dice conditions in the current advisory.
• A passphrase does not remove the need to migrate an affected seed. Firmware history and seed-generation records matter; an automated check cannot prove a seed is safe.
• To migrate: update firmware first, generate a new seed on the updated device, verify the backup and a new receive address on-device, send a small test transaction, confirm it arrives, then move remaining funds. Keep the old backup until migration is confirmed. Follow Coinkite's current migration guide for the complete process.

Comparing custody options

This is a firmware defect in one vendor's random-number path, not a flaw in air-gapped signing or open-source firmware generally. Owners weighing whether to stay on Coldcard, move to a different open-source signer such as Foundation Passport, or reconsider custody tradeoffs can compare device records on the Coldcard provider page. Ledger's unrelated 2020 data breach, covered in Ledger Data Breach and Physical-Security Risks, exposed contact records, not seed entropy, and did not touch any device's key generation.

Sources

• Coinkite: Coldcard security advisory
• Coinkite: Technical deep dive into the entropy issue
• Coinkite: Update, Sunday
• Coldcard/firmware GitHub: release changelog
• Block Engineering: predictable RNG fallback and 32-bit reseed analysis
• BleepingComputer: Coldcard RNG flaw linked to $88 million theft
• CoinDesk: how bitcoin cold wallets lost $70 million
• CoinDesk: losses may near $114 million as fourth sweep emerges
• CoinDesk: Coldcard urges users to move bitcoin as exploit continues
• Decrypt: Coldcard exploit balloons to $88 million
• Decrypt: Coldcard exploit explained
• Cointelegraph: at least 15 attackers exploited the vulnerability
• Fortune: what we know about the $116 million Coldcard exploit
• James O'Beirne (@jamesob) on X: May 2025 audit account
• WatchGuard (@we_satoshis) on X: live RBF defense demonstration
• Dave Jones (@eevblog) on X: attack mechanism explainer
• mempool.space: cited RBF-conflict transaction