Summary
- A flaw in the firmware caused Coldcard wallets to generate seed keys using a software pseudo-random generator rather than the dedicated hardware chip.
- This error reduced the effective search space from 128 bits to approximately 40 bits on older models.
- This issue has resulted in over $130 million worth of Bitcoin being stolen.
Recent reports indicate that Bitcoin wallets, previously thought to be secure, have been compromised.
The affected coins were stored on Coldcard devices—secure hardware wallets produced by Coinkite, a Canadian company—designed to operate without internet connectivity. The breach did not involve phishing attempts, malware, or physical theft; instead, attackers deduced the private keys.
Galaxy Research has identified over 1,596 BTC that have been stolen across three confirmed incidents, with an additional suspected wave that could increase the total to around 2,055 BTC, equating to roughly $130 million at current market rates. One incident alone saw $70 million transferred in just 41 minutes. Coinkite has indicated that at least 15 different attackers have exploited this vulnerability.
On August 1, Coinkite released a detailed technical explanation outlining the problem. The document candidly reveals that for eight years, the wallet was effectively using faulty randomness without detection.
Understanding the Issue
In 2021, Coinkite transitioned Coldcard's cryptographic framework to libsecp256k1, the same library utilized by Bitcoin Core, which was a wise choice. However, this switch inadvertently redirected seed generation from the hardware random number generator to a software fallback known as Yasmarang, designed for devices lacking any randomness chip.
🚨LOSSES FROM COLDCARD HACK EXCEED $100M
High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents.
If we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).
More in the thread below 👇 pic.twitter.com/RAl3ib67qa
— Galaxy Research (@glxyresearch) August 3, 2026
Despite Coldcard being equipped with a randomness chip, it was no longer utilized due to a minor coding error. A build guard using #ifndef checked for the existence of a setting rather than its activation. Coinkite had set this parameter to zero, which was interpreted as "off." Since zero is a defined value, the safety check passed, and the build proceeded without issues. Both versions of the function appeared identical, masking the underlying problem.
As Coinkite articulated, "The majority of randomness on the COLDCARD was derived from a PRNG that I was unaware existed within the source code base," referring to a pseudo-random number generator that produces seemingly random numbers based on a predetermined recipe. Utilizing the same initial value yields identical results consistently.
On Mk2 and Mk3 models running firmware versions 4.0.1 to 4.1.9, the starting value was sourced from the device's serial number and clock, leading to an estimated search space of about 40 bits. Newer devices incorporated some secure-element entropy, raising their effective search space to around 72 bits.
Neither of these levels meets the expected 128 bits.
The significance of this discrepancy cannot be overstated. Bits function as exponents; a 128-bit search space offers more combinations than there are atoms in the observable universe, while 40 bits equates to about a trillion combinations—a number that a standard laptop can efficiently process. Each lost bit effectively halves the workload required.
Block's engineering team, which provided its own analysis, estimated that the effective secure-element search space for newer devices was around 2^32 candidates, averaging roughly 2^31 trials. Their assessment of older models is more blunt: for a known device ID, timer state, and call history, wallet generation becomes predictable.
Predictability stands in stark contrast to randomness, which is vital for secure cryptographic practices.
Predictable, Not Weak
Coinkite speculates that the vulnerability may have been discovered through automated means, stating, "We must assume that someone utilized AI to examine previous firmware versions and uncovered this flaw," while noting that they had recently tested their code with a leading AI model, which did not reveal the issue. "Both attackers and defenders have access to the same AI tools, but today it did not assist us and only aided the attackers."
Firmware updates have been released for all affected models, although these fixes do not rectify any existing seeds; users must generate new seeds and transfer their funds. Decrypt has reported on how air-gapped storage is impacted following such an exploit and has tracked losses exceeding $114 million.
The Concept of Entropy
Entropy refers to the degree of uncertainty from an attacker's perspective.
Essentially, it quantifies uncertainty in bits. One bit represents one coin flip: two possible outcomes, with a guesser achieving accuracy 50% of the time. Ten bits equate to 1,024 outcomes. Each additional bit doubles the complexity for the guesser.
A Bitcoin wallet contains a very large secret number, from which the address for receiving coins is mathematically derived, functioning in a one-way manner—keys can be converted to addresses, but not vice versa.
Thus, the security of any wallet hinges on one crucial question: How many combinations would an attacker need to attempt?
If the number was generated with 128 bits of entropy, the answer is "more than physics allows." If it was generated with only 40 bits, the response is "just give me some time." This property also raises concerns regarding the potential threat posed by quantum computing, as a quantum machine could exploit the mathematics linking keys to addresses. However, the Coldcard vulnerability rendered the keys guessable without needing to delve into that math.
The terminology can be confusing. A pseudo-random generator produces outputs that pass statistical randomness tests, thus appearing valid under typical scrutiny. However, this output is fully determined by its seed value, meaning it may seem random but is not genuinely so.
Statistical randomness and cryptographic unpredictability are distinct characteristics, and Coldcard's output would have successfully passed the former test while failing the latter entirely.
True randomness must be derived from physical phenomena, such as electrical noise in a circuit, thermal variations, or radioactive decay. This was the intended function of the hardware chip in the Coldcard, which was rendered inactive due to the coding error.
Dice as a Solution
As users rushed to regenerate their seeds, many resorted to a straightforward low-tech solution. Coldcards permit users to roll physical dice and input the results as entropy. Coinkite recommends that seeds generated using at least 50 independent dice rolls are not at risk from the bug.
This may sound simplistic, but Coinkite actually markets a set of "100 cute and tiny little dice" to facilitate this process.
On July 31, Bitcoin Core developer Luke Dashjr issued a warning: "Many individuals are suggesting or employing dice to mitigate the Coldcard vulnerability. Note that standard dice are not designed to be cryptographically secure. If you choose to do this, it is advisable to purchase precision casino dice. Even then, have an additional source of entropy."
Reactions on Bitcoin Twitter were mixed.
"lol now you can't even roll dice," one user quipped. Another inquired if he should hire someone with Parkinson's to roll them. (Not a kind comment.)
should I hire someone with parkinsons to throw the dice?
— Murern (@Bitcoin_Murern) July 31, 2026
Developer Justin Sharp provided a more constructive response by calculating the potential cost of an unreliable die:
"Overkill. A perfect d6 yields 2.585 bits per roll. A notably biased die, such as one that lands on one face 20% of the time instead of 16.7%, still produces about 2.55 bits. Across 99 rolls, this difference results in approximately 256 bits versus 252 bits of entropy."
Four bits out of 256. That represents the total penalty for using a visibly unfair die.
While Dashjr’s point about the bias of inexpensive dice is valid—due to manufacturing inconsistencies—he is mistaken about the stakes involved. Losing four bits from a total of 256 leaves you with 252. In contrast, the Coldcard issue reduced users to just 40 bits.
Underlying his advice is a more significant argument: it is essential not to rely on a single source. The Coldcard's failure stemmed not from slightly biased entropy but from a single component that silently ceased to function without detection.
Next Steps
If you generated a seed on a compromised Coldcard without using dice rolls (seriously) or a strong BIP-39 passphrase, that seed is at risk.
Update the firmware, create a new seed, confirm the fingerprint, conduct a test transaction, and then transfer all assets. Coinkite's advisory provides a detailed guide for each model. Transferring a flawed seed to a different wallet application does not resolve the issue.
For others, the lesson here is not to conclude that hardware wallets are unreliable or that using dice is a poor choice.
Rather, it emphasizes that the term "random" is simply a claim, and such claims require verification. The Coldcard's source code has been publicly accessible all along. The intended hardware RNG was present in the binary, yet reviewers verified its existence without determining whether the seed generator actually utilized it.
Eight years of audits focused on the correct code, but no one confirmed that it was operational.