$89 Million Gone in 41 Minutes: The Coldcard Firmware Exploit That Broke Bitcoin Self-Custody

A five-year-old bug in Coldcard hardware wallet firmware allowed an attacker to reconstruct private keys and drain nearly 1,367 BTC – worth approximately $89 million – from 4,585 Bitcoin addresses across three coordinated waves of theft between July 30 and August 2, 2026. The attacker never touched a single physical device.

What Happened

Between 01:10 and 01:56 UTC on July 30, 2026, an unknown attacker swept 1,082.65 BTC ($70.2 million) from 1,196 Bitcoin addresses in just 41 minutes. The coins were drained from wallets secured by Coldcard hardware wallets manufactured by Canadian company Coinkite. Every drained wallet was single-signature and held more than 0.15 BTC.

The theft moved 1,324 chunks of bitcoin across 500 transactions inside a three-block window. 562 BTC were then consolidated into a single address that has not moved since. The attacker paid elevated fixed transaction fees and left no change outputs – meaning each address was emptied completely.

Chainalysis traced the sweep and found it was planned. The attacker hit the highest-value wallets first, including one holding $1.8 million, and collected about $30 million inside the first ten minutes.

Three Waves of Attacks

Galaxy Research identified three distinct waves of theft tied to the same vulnerability:

• Wave 1 (July 30): 1,082.65 BTC from 1,196 addresses in 41 minutes – the largest single sweep
• Wave 2 (August 1): 76.16 BTC from 1,478 addresses – targeting smaller balances
• Wave 3 (August 2): 207.73 BTC from additional addresses – attacker changed transaction patterns to avoid tracing

Total observed losses across all three waves: 1,367.05 BTC, approximately $89 million, drained from 4,585 addresses. Galaxy Research believes each wave was the work of a single operator but cannot confirm whether the same person is behind all three.

The Root Cause: One Line of Wrong Code

The vulnerability was not a break in Bitcoin’s cryptography. It was a firmware integration error that caused Coldcard wallets to use a predictable software random number generator instead of the hardware random number generator built into the device’s STM32 chip.

Here is what happened at the code level:

Coldcard’s production board configuration correctly defined a macro to disable MicroPython’s built-in hardware RNG because Coinkite had written its own separate hardware RNG implementation:

// We have our own version of this code.
#define MICROPY_HW_ENABLE_RNG (0)

The libngu cryptographic library was supposed to check whether this hardware RNG was active. Instead, it checked whether the macro existed:

#ifndef MICROPY_HW_ENABLE_RNG
#error "get a HW TRNG plz"
#endif

The problem: #ifndef only checks whether a macro is defined – not whether its value is zero. The macro existed (set to 0), so the check passed. But because the value was zero, MicroPython compiled the software fallback – a deterministic generator called Yasmarang – instead of the hardware RNG.

The Yasmarang generator initialized with three values: the device’s fixed UID, the SysTick timer, and the RTC clock. These are not cryptographic entropy sources. The UID is permanent device metadata, while SysTick and RTC are observable or predictable timing values. Once an attacker knows these values and the number of prior RNG calls, the entire random stream is deterministic.

Even worse: libngu tried to mask the problem by XORing the weak output with another Yasmarang generator using public constants. But XOR does not create entropy. If both inputs are reproducible, their XOR is reproducible.

The result: wallet seeds carried roughly 72 bits of entropy instead of the 128 bits normally expected. For a fixed fallback state and call history, there were at most 2^32 possible output streams – and for Mk2/Mk3 devices, there was no secure reseed at all. An attacker could enumerate candidate seeds offline and validate them against public blockchain addresses.

When the Bug Was Introduced

Firmware v3.2.2 generated wallet entropy using the correct hardware path:

seed = bytearray(32)
rng_bytes(seed)  # Uses ckcc.rng_bytes -> STM32 hardware RNG

Commit b18723dd, dated March 1, 2021, changed the generation to:

seed = random.bytes(32)  # Uses ngu.random -> falls back to Yasmarang

This change first appeared in released firmware v4.0.0 on March 17, 2021. For the next five years, every seed generated on affected firmware carried the weakness.

Which Devices Are Affected

Exposure depends on the firmware version used when the secret was generated – not the device’s manufacturing date. Upgrading firmware does not repair an existing seed.

Fully vulnerable (no secure reseed):

• Coldcard Mk2 running firmware v4.0.0 through v4.1.9
• Coldcard Mk3 running firmware v4.0.0 through v4.1.9

Partially vulnerable (fallback present, but limited 32-bit reseed from secure element):

• Coldcard Mk4 running production firmware v5.0.0 and later
• Coldcard Q – all production firmware
• Coldcard Mk5 – all production firmware

Not affected:

• Coldcard Mk1 – all released firmware through v3.0.6
• Coldcard Mk2 and Mk3 running firmware through v3.2.2 (used direct STM32 hardware RNG)

Also affected (same generator output): Coldcard paper wallet private keys, seed-splitting masks, device cloning keys, and Key Teleport transfers generated on vulnerable firmware.

Who Is Behind the Attack

No one has named the attacker. Block’s engineers, working alongside Coinkite, traced the attacker’s on-chain activity and discovered one critical mistake: the operator used a paid account at a well-known blockchain data provider to query source addresses during the sweeps. Block researcher Clay Garrett called this an “extraordinary” operational security failure.

Chainalysis is actively monitoring the exploiter wallet and a consolidation address where 562 BTC were merged into a single output that has not moved since the theft.

Coinkite CEO Rodolfo Novak, known as NVK, suggested that artificial intelligence may have helped the attacker discover the vulnerability. He said Coinkite’s own AI review of the same code weeks earlier had turned up nothing. Bitcoin Magazine reported that AI was “likely involved” in finding the exploit.

Galaxy Research believes all three waves were the work of a single operator, but the blockchain does not reveal whether separate sweeps are coordinated. Wave 3 showed different transaction patterns, which could indicate either the same attacker adapting their approach or a second actor entering after the vulnerability was made public.

How the Attacker Operated

The attack model is straightforward and chilling in its simplicity:

1. The attacker knew which firmware versions were vulnerable and understood the deterministic RNG fallback
2. They generated candidate seeds on their own machine, reproducing the weak random stream
3. For each candidate seed, they derived the corresponding Bitcoin addresses
4. They checked those addresses against the public blockchain, where every wallet’s balance is visible to anyone
5. For wallets holding funds, they recreated the private key and swept the coins

At no point did the attacker need physical access to any Coldcard device. The physical device might as well have been locked in a vault the entire time. The weakness was in the small pool of numbers the broken firmware could have picked, and that pool still contained the victim’s seed – regardless of which device it was imported into afterward.

Bitcoin Core developer instagibbs independently reproduced the vulnerability using a fresh Mk3 device, confirming the affected code path described in Block’s research.

What Coinkite Said

On July 31, Coinkite issued a security advisory acknowledging the vulnerability. CEO NVK apologized publicly and said the company accepted full responsibility for the firmware failure.

The company’s official advisory states: “Funds from affected Coldcard seeds are at risk if the seed lacks 50 independent, private dice rolls and the wallet lacks a strong, unique BIP-39 passphrase.”

Coinkite released firmware v4.2.0 as a hotfix. The patch corrects new seed generation going forward. However, it does not fix seeds already generated on vulnerable firmware. Users who generated seeds on affected devices must create entirely new seeds on the patched firmware and move their funds.

The company urged users to migrate cautiously: generate a new seed on updated hardware, verify wallet backups and addresses, and test transfers before moving larger balances.

Notably, Coinkite switched their code from open source to “source verifiable” in 2021 – the same year the bug was introduced. Critics on Reddit and in the security community have argued that keeping the code fully open source might have led to earlier discovery of the flaw.

What You Should Do Now

If you generated a Coldcard seed on firmware v4.0.0 through v4.1.9 (Mk2/Mk3) without dice rolls or a BIP-39 passphrase: Your seed is compromised. Move your funds immediately to a new seed generated on patched firmware (v4.2.0+). Do not import the old seed into a new wallet – the weakness is in the seed itself, not the device.

If you used 50 or more independent dice rolls during seed generation: Your risk is substantially lower. The dice rolls added entropy independently of the firmware’s RNG, making the seed resistant to this specific attack.

If you used a strong, unique BIP-39 passphrase (not the Coldcard PIN): Coinkite indicates your risk is minimal. The passphrase adds entropy that the attacker cannot guess from the firmware’s weak output alone.

If you use a multisignature setup: You are safe. The attacker would need to compromise multiple independent keys, which this vulnerability does not enable.

Critical reminder: Updating your Coldcard firmware does NOT fix an existing compromised seed. The seed was generated with weak randomness at creation time. Importing that same seed into a Trezor, Ledger, or brand-new Coldcard changes nothing – the attacker is not searching devices, but searching the small number of possible seeds the broken firmware could have produced.

Market Impact and the Self-Custody Debate

Bitcoin traded above $64,000 during the attack with widespread drain appearing to have little immediate impact on price. However, the exploit triggered a notable shift in investor behavior: unlike the FTX collapse, the Coldcard exploit is driving bitcoin back onto exchanges as holders seek temporary safety. Data from CryptoQuant and Timechainindex confirms the inflow.

The exploit reignited debate about whether self-custody has become too risky for ordinary users. Security experts noted that the attack highlights growing operational risks as cyber threats evolve. Strike CEO Jack Mallers called it “one of the most serious” Bitcoin hacks in recent memory.

Bitcoin Foundation highlighted that Block’s security researchers found the affected devices may have generated wallet seeds using “predictable periodic down-counter” including the device’s serial number and internal clock, instead of sufficient hardware-generated randomness.

Key Numbers

• Total stolen: ~1,367 BTC (~$89 million)
• Addresses affected: 4,585
• First wave duration: 41 minutes
• Bug duration: ~5 years (March 2021 – July 2026)
• Seed entropy: ~72 bits (instead of 128+)
• Brute-force space: ~2^31 candidate trials (~2 billion)
• Largest single wallet stolen: $1.8 million
• Stolen in first 10 minutes: ~$30 million

Timeline

1. March 1, 2021: Commit b18723dd introduces the bug – switches from hardware RNG to ngu.random
2. March 17, 2021: Firmware v4.0.0 released with the vulnerable code path
3. 2021-2026: Users generate seeds on affected firmware, unaware of the weakness
4. July 29, 2026: Users on X begin reporting unauthorized bitcoin movements
5. July 30, 2026, 01:10 UTC: First wave begins – 1,196 addresses drained in 41 minutes
6. July 31, 2026: Coinkite issues security advisory. CEO NVK apologizes. Firmware v4.2.0 hotfix released
7. August 1, 2026: Second wave identified – Galaxy Research tracks total to $75 million
8. August 2, 2026: Third wave brings total to 1,367 BTC / $89 million across 4,585 addresses

Sources

• Block Engineering Blog – “Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware” (July 30, 2026)
• Coinkite Blog – “Coldcard Security Advisory” and “Technical Deep Dive into the Entropy Issue”
• Galaxy Research – Wave analysis via CoinDesk (August 2, 2026)
• Chainalysis – On-chain monitoring of exploiter wallet
• CoinDesk – “Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep” (July 31, 2026)
• Bitcoin Magazine – “COLDCARD SECURITY RISK: IMMEDIATE ACTION REQUIRED”
• The Hacker News – “Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft” (August 2, 2026)

Author: Pulse Of Nations Wire Desk

Post Views: 42