A flaw in Coldcard's code has resulted in a staggering $100 million theft, raising concerns about self-custody in cryptocurrency.
A significant security breach in Coldcard's software has resulted in the theft of over $100 million worth of bitcoin, highlighting serious concerns about the reliability of self-custody solutions in the cryptocurrency space.
Entrepreneur Jonathan Goodman, who took extensive precautions to protect his bitcoin, reported that on July 29, all his wallets were compromised, leading to the loss of 18.25 bitcoin, valued at approximately $1.17 million at the time. His Coldcard wallet, which was never connected to the internet and stored securely, was not enough to prevent this breach.
This incident is part of a larger hacking campaign affecting around 7,300 Coldcard users, with Galaxy Research estimating that approximately 1,596 bitcoin were stolen. Alex Thorn from Galaxy Research indicated that at least 15 different hackers exploited the same vulnerability without needing physical access to the devices.
Coldcard hardware wallets are designed to secure cryptographic keys offline. However, this incident has revealed a critical flaw in the assumption that these wallets are immune to online attacks. The vulnerability resulted from how the seed phrase was generated, rather than issues within the hardware itself.
Types of Bitcoin Wallets
Bitcoin wallets generally fall into two categories: software wallets, or "hot wallets," which are internet-connected, and hardware wallets, known as "cold wallets," which store keys offline. While cold wallets are considered more secure, they are not immune to vulnerabilities that can occur in the key generation process.
Bobby Gray, founder of TEXITcoin, emphasized the necessity of secure key generation, stating that although air-gapped systems enhance security, they are not infallible.
Identifying the Code Flaw
Coinkite, the company behind Coldcard, shifted its focus to hardware solutions after discontinuing its hosted hot wallet in 2016. The Coldcard hardware wallet was launched in December 2017, featuring a numeric keypad and secure elements designed to keep user information safe.
Despite being open-source, a critical error in the code went unnoticed for years. This flaw was introduced during a software update in 2021, which inadvertently included a seed-generation error that compromised wallet security.
Discovery of the Vulnerability
Concerns about the seed generation process were raised by bitcoin developer James O’Beirne in May 2025, but Coinkite dismissed these claims. An issue with the randomness used in wallet creation stemmed from a configuration error that caused the wallet to rely on a less secure software generator, reducing the number of possible seed combinations and making it easier for attackers to guess the keys.
Analysis of the Root Cause
The flaw arose from miscommunication between two software components responsible for random number generation. A failure to disable the insecure generator meant that devices were producing weak seeds with only 72 bits of randomness instead of the intended 128 bits. This dramatically increased the risk of key compromise.
Despite the source code being publicly accessible and the correct hardware generator being included in the firmware, reviews failed to adequately verify the seed-generation process. Coinkite has since released updated firmware to address the flaw, but it cannot recover the lost funds, advising affected users to create a new seed and transfer their bitcoin to secure addresses.
Impact on Self-Custody Solutions
This incident raises significant questions about the trustworthiness of self-custody solutions, which are intended to reduce reliance on third-party custodians. Goodman's experience illustrates that even the most secure user practices can be undermined by inherent vulnerabilities in wallet technology.
