The Coldcard Flaw: When Your Hardware Wallet Fails You

What Happened on July 31

On July 31, 2026, Coinkite — the Canadian company that makes the Coldcard, a hardware wallet favored by security-minded Bitcoin holders — published a security advisory admitting that its firmware had been generating weak wallet seeds since March 2021.

The disclosure and the theft arrived almost simultaneously. In a window of roughly 25 to 41 minutes, attackers emptied about 500 wallets of roughly 594 BTC — near $38 million — consolidating much of it into a single address holding 562 BTC. Over the following days, across what researchers believe were three separate waves, the total climbed past 1,367 BTC, or about $88.6 million, spread over 4,585 addresses.

That escalating count matters: it suggests attackers weren't working from a stolen list. They were scanning the blockchain in real time for wallets bearing the fingerprint of the flaw.

The Bug Was One Line of Code

A commit on March 1, 2021, shipped in firmware 4.0.1, changed which function the Coldcard called to generate randomness. It moved from ckcc.rng_bytes — which correctly pulled from the chip's dedicated hardware random number generator — to ngu.random.bytes, which routed through a different path in Coinkite's crypto library.

That library contained a subtle mistake. A guard condition checked #ifndef MICROPY_HW_ENABLE_RNG — asking only whether a setting was defined, not whether it was turned on. Coinkite's builds defined that setting as zero, because the company used its own hardware RNG wrapper instead. Defining it as zero unintentionally satisfied the flawed check and silently switched on a fallback nobody intended to use.

Think of a smoke detector that tests whether a battery is installed rather than whether the battery has any charge. The light stays green. The alarm never sounds.

The fallback was MicroPython's built-in software pseudo-random generator, nicknamed "Yasmarang." It was seeded at boot from the chip's unique ID and timer registers — then never fed fresh randomness again.

Why 40 Bits Isn't Random Enough

A standard 12-word BIP-39 seed phrase is supposed to carry 128 bits of entropy — a number so large that guessing it is physically impossible with any conceivable computer. As we explain in our guide to what a private key actually is, that unguessability is the entire foundation of crypto ownership.

Under the flaw, effective entropy collapsed to roughly 40 bits on Mk3 devices and about 72 bits on pre-fix Mk4, Mk5, and Q devices. Per Coinkite's advisory, Mk2 and Mk3 seeds generated on firmware 4.0.1 through the final 5.0.3 release are the most severely affected tier.

Forty bits is roughly a trillion possibilities. That sounds enormous. It is not — a well-resourced attacker can work through a trillion candidate seeds and check each one against the blockchain.

Picture a bank vault sold with a "random" combination, except the randomizer quietly reused the same small handful of starting values on every vault it shipped. Your vault door is still steel. Your combination is still secret. And anyone who reverse-engineers the generator can open it in an afternoon.

Users who did everything right — wrote the words on paper, stored them in a safe, never photographed them — were still exposed, because the compromise happened before those words ever reached the screen.

The Misconception That Will Cost People Money

If you take one practical thing from this article, take this: patching the firmware does not fix an affected seed.

Coinkite has shipped corrected firmware across all four hardware lines — 4.2.0 and later for Mk3, 5.6.0 and later for Mk4 and Mk5, and 1.5.0Q and later for Q — and the advisory states plainly that the update repairs future seed generation only. A seed created under the flawed code is permanently weak. Updating and stopping there leaves you exactly as exposed as before, with the added danger of feeling protected.

Anyone who generated a Coldcard seed between March 2021 and the July 31, 2026 patch needs to create a new wallet on patched firmware and move funds to it. One documented exception: users who supplemented setup with at least 50 private, independent dice rolls layered in enough of their own entropy to escape the flaw.

What This Means for Your Own Setup

The honest conclusion is not "abandon hardware wallets." Exchange custody carries its own well-documented failure modes, and our Bitcoin self-custody guide covers why holding your own keys still makes sense for most long-term holders. It does mean treating setup as a repeatable process rather than a purchase.

Use your own dice. Most serious hardware wallets let you mix in dice rolls during seed generation. Fifty rolls is tedious. It is also the one step in this entire incident that reliably protected people.

Check vendor advisories on a schedule. Firmware bugs get disclosed; nobody emails you personally. Once or twice a year, visit your manufacturer's security page — the same instinct that helps you recognize a crypto scam applies to maintaining tools you already own.

Buy direct and set up deliberately. Whether you're provisioning a replacement Coldcard on patched firmware or a device from any other manufacturer, order from the maker rather than a reseller, verify the device on first boot, and record when the seed was generated. If a future advisory names a date range, you'll know instantly whether it applies to you.

The Lesson: Single Points of Failure

"Not your keys, not your coins" is good advice. It also carries a hidden assumption — that the process which created those keys was trustworthy. This incident is what it looks like when that assumption fails silently, for five years, across an entire product line.

Randomness is not a philosophical abstraction. It is a real engineering component, built by people, capable of breaking like any other. The users who lost money here weren't careless. They trusted one component they had no practical way to inspect.

The defense isn't paranoia. It's layering: your own entropy alongside the vendor's, your own periodic checks alongside their disclosures, and a clear-eyed understanding that no single device — from any manufacturer — deserves unlimited trust. Spreading holdings across more than one wallet and seed follows the same logic your estate planning should already use.

Hardware wallets remain one of the better tools ordinary people have for protecting Bitcoin. They are tools, though — not guarantees.