An attacker drained roughly 594 bitcoin, worth about $38 million, from around 500 Coldcard-generated wallets between 01:31 and 01:56 UTC on July 31, 2026. The seeds were guessable because the devices never used their hardware randomness generator.
Key Takeaways
- Coldcard firmware 4.0.0, shipped in March 2021, told the device to skip its own hardware randomness generator during seed creation.
- Block’s Bitcoin engineering and security teams traced the fault to a single commit dated March 1, 2021.
- Seed strength fell from the intended 128 bits to 72 bits, which brings the search space within reach of an attacker.
- Every drained wallet used a single signature and held more than 0.15 BTC, and many had sat untouched for years.
- Seeds created with a BIP-39 passphrase or at least 50 dice rolls are not considered at risk under the incident notes.
What Happened?
The sweep moved 1,324 chunks of bitcoin across 500 transactions inside a three-block window. A single address then absorbed 562 BTC of the proceeds, and those coins have not moved since. Every wallet hit was single-signature.
Coldcard is a bitcoin-only hardware wallet built by the Canadian firm Coinkite, a standalone device that keeps keys offline, away from internet-connected computers. Mk2, Mk3, Mk4, Q and Mk5 are successive generations of the product.
Exposure tracks the firmware version the device was running when the wallet was first created. The purchase date has no bearing on it. The drained coins spanned 2021 to 2026 and many of the wallets had been dormant for years, a range that matches the flaw’s age almost exactly.
COLDCARD Mk3 Security Advisory
— COLDCARD (@COLDCARDwallet) July 30, 2026
If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.
Mk4, Q and Mk5 are not affected based on our early analysis.
Read the advisory and migrate carefully:https://t.co/3vgPHOjMS7
How a Build Setting Broke the Randomness?
A seed is meant to be drawn at random from a pool so large that guessing it is hopeless. Coldcard’s firmware was not doing that.
Block’s report describes two faults stacked on each other. A build setting told the device to skip its own hardware randomness generator, and a check inside a supporting library tested only whether that setting existed rather than whether it was switched on. Key generation then fell through to a basic software substitute.
That substitute drew its seed material from the chip’s serial number and its clock registers. The serial number is fixed factory metadata, and the clock values are timing state an attacker can measure on a device of their own. Effective seed strength dropped from the intended 128 bits to 72 bits.
Two Versions of the Affected List Are Circulating
Coinkite has warned users who created seeds on Mk3 devices running firmware 4.0.1 or later, while stating that Mk4, Q and Mk5 appear unaffected so far. The incident notes published around the same advisory draw a wider circle.
Those notes place Mk3 firmware 4.0.1 through 5.0.3 in scope, along with Mk4 and Mk5 devices before firmware 5.6.0 and Q devices before 1.5.0Q. They also name fixed releases: 5.6.0 for Mk4 and Mk5, and 1.5.0Q for Q. A device family cannot be both unaffected and patched at 5.6.0, and that gap is unresolved.
Several questions stay open. How the attacker assembled the target list, whether the 500 swept wallets represent the full exposed set, how many seeds generated across the 2021 to 2026 range ran on affected firmware, and which of the two device lists Coinkite will stand behind.
Holders can check which device generated the seed and which firmware it was running at the time, then confirm whether a BIP-39 passphrase or at least 50 dice rolls were used. Anyone checking should avoid entering a seed phrase into any website or unknown tool offering to test for the flaw.
Implications for Self-Custody
Private key compromise already accounts for 35% of tracked attack vectors in crypto exchange hack and security data, and personal wallet compromises reached 158,000 incidents affecting at least 80,000 unique victims in 2025. This sweep lands in that bucket with one unusual property. No key was ever taken from a user.
Single-signature setups concentrate the entire risk in one seed. Multisig spreads approval across several keys, so a single weak seed may not be enough to move funds on its own. Cold wallet ownership among retail users rose 34% year on year in 2025, according to hardware wallet market data, widening the population a device-level entropy fault can reach.
A hardware wallet’s premise is that the device generates the secret where nothing else can observe it, which makes device-side entropy the one link a user has no way to inspect. Incidents like the Korean tax service seed phrase leak begin with someone exposing a secret. This one began with a secret that was never strong enough, and the total rivals the largest crypto exchange hacks with no company breached.
CoinLaw’s Takeaway
This failure sits underneath everything a careful holder controls. Backup discipline, passphrase hygiene and air-gapped signing all assume the seed was drawn from real randomness. When the device quietly substitutes a predictable source, every layer built on top inherits the weakness, and the holder gets no signal that anything is wrong.
The dormancy pattern carries the longest tail. Coins created as far back as 2021 sat untouched until the sweep, which left an exposed holder no behavioral tell and no suspicious transaction to review. The 0.15 BTC floor across every drained wallet points to an attacker filtering by value before spending effort on smaller balances, and the 562 BTC parked in one unmoved address leaves the size of the remaining exposed set unknown.
