Key Takeaways
In late July, 2026, Coldcard maker Coinkite disclosed a firmware flaw that caused some devices to generate Bitcoin seeds with far less randomness than intended, making a subset of wallets guessable by an attacker who never touched the device.
On-chain researchers linked the disclosure to a rapid sweep of roughly 594 BTC (about $38 million) from around 500 single-signature wallets. Coinkite has published the advisory but has not formally declared the sweep and the bug to be the same event.
Updating firmware does not repair a seed that was already created weakly. Affected users need to generate a new seed on fixed firmware and move funds carefully, following official guidance.
A hardware wallet is supposed to do one thing above all else: keep your private keys away from the internet and generate them from strong, unpredictable randomness. In late July 2026, a widely used Bitcoin hardware wallet, the Coldcard, became the center of a security incident that tested exactly that promise. This article explains what happened, why it happened, and what the event teaches about self-custody, in plain language and without hype.
What happened
On July 30 and 31, 2026, Coinkite, the Canadian company that makes the Coldcard, published a security advisory warning that seeds created on certain Coldcard models and firmware versions may contain weak randomness. According to on-chain data cited in the advisory and in independent reporting, an attacker swept roughly 594 BTC, worth about $38 million, out of approximately 500 single-signature wallets in a very short window, reportedly inside a handful of Bitcoin blocks.
Security researchers, including teams at Block and independent Bitcoin developers, examined the pattern and concluded that weak seed generation was the most plausible explanation. A Bitcoin Core contributor reproduced key parts of the flaw on a physical device. Coinkite stated it had been unaware of the issue until that day. It is worth being precise here: the advisory and the theft appeared close together in time and the technical link is widely accepted, but at the time of writing Coinkite had not issued a formal statement declaring the two to be definitively the same event.
The root cause: a random number generator that was not random enough
Every Bitcoin wallet is built on a secret number. If that number is truly random, there are so many possibilities that no computer on Earth could guess it. If the number is drawn from a small set of possibilities, an attacker can simply try them all.
Coldcard devices contain a dedicated hardware true random number generator (TRNG) built into their STM32 chip. That is one of the reasons hardware wallets command a price premium. The reported flaw is that, during seed creation, affected firmware did not use that hardware source as intended. Instead, a code path inside a library called libngu fell back to a software pseudo-random number generator (PRNG) named Yasmarang. A PRNG produces numbers that look random but are calculated from a starting value. If that starting value is drawn from predictable things such as a serial number, an internal clock, or button presses, the output is predictable too.
Researchers described the effect in stark terms. Rather than the intended 128 bits of entropy for a standard 12-word phrase, affected Coldcard Mk3 seeds carried only around 40 bits, and newer models were reduced to roughly 72 bits. The change traces to a single code change made in March 2021 that redirected seed generation away from the hardware source. It then sat undetected in open-source firmware for years, a reminder that "many eyes" review is helpful but not a guarantee.
How much does "40 bits" actually matter?
The jump from 40 or 72 bits to 128 bits is not a small technical detail. Each additional bit doubles the number of possibilities. The table below shows why the gap is the difference between "practically impossible to guess" and "guessable by a determined attacker."
Effective entropy | Approximate number of possibilities | Practical meaning |
|---|---|---|
40 bits (affected Mk3) | About 1 trillion | Searchable by a motivated attacker with modern hardware |
72 bits (affected Mk4 / Mk5 / Q) | About 4.7 sextillion | Very hard, but far weaker than intended and a real concern |
128 bits (intended 12-word seed) | About 340 undecillion | Considered infeasible to brute-force with any known technology |
256 bits (intended 24-word seed) | Astronomically larger still | The upper end of common wallet security |
Which devices and firmware are affected
The severity depends on the model and firmware. The figures below reflect the advisory and public reporting; always confirm the current details on the official Coinkite advisory before acting, as the investigation is ongoing.
Model | Affected if seed generated before | Fixed firmware | Reported severity |
|---|---|---|---|
Mk3 | versions 4.0.1 through 4.1.9 | 4.2.0 or later | Most severe (about 40 bits) |
Mk4 / Mk5 (standard) | standard 5.6.0 | 5.6.0 or later | Serious (about 72 bits) |
Mk4 / Mk5 (Edge) | Edge 6.6.0X | 6.6.0X or later | Serious (about 72 bits) |
Q (standard) | standard 1.5.0Q | 1.5.0Q or later | Serious (about 72 bits) |
Q (Edge) | Edge 6.6.0QX | 6.6.0QX or later | Serious (about 72 bits) |
Coinkite also stated that its Tapsigner, Opendime, and Satscard products are built on different codebases and are not affected by this issue. Standard and Edge are separate release tracks, so a higher Edge version number does not automatically mean it contains the fix.
Who was protected, and why
Not every Coldcard seed created on affected firmware is at equal risk. Several optional practices added independent randomness that the flaw did not touch:
Dice rolls added during setup. Coldcard lets users mix in their own dice entropy. According to the advisory, at least 50 fair, private, independent rolls contributed enough randomness on their own that the resulting seed is not considered at risk from this flaw alone, and 99 or more rolls added even more.
A strong BIP-39 passphrase. A passphrase (sometimes called a "25th word") is an extra secret combined with the seed. A long, unique passphrase adds an independent barrier. A short, common, or reused passphrase does not, and should not be relied on.
Multisig across different vendors. A multisignature wallet that requires keys from several independent devices is only broken if enough of those devices are vulnerable. A quorum built from a mix of vendors is far more resilient.
What affected users should do
Coinkite's guidance stresses one point repeatedly: move carefully. Rushing a wallet migration can create a bigger and more immediate risk than the flaw itself. Updating firmware alone does not fix an already-weak seed, because the weakness is baked into the seed, not the software. The general shape of a safe migration looks like this:
Confirm whether your seed was generated on affected firmware, and whether you used dice, a strong passphrase, or multisig.
Install the fixed firmware for your exact model and release track, and verify the version on the device screen.
Generate a brand-new seed on the updated device. Record and verify its backup and wallet fingerprint before depositing anything.
Verify a fresh receive address on the device screen and send a small test transaction first.
Only after the test confirms should you move the remaining funds, and keep the old backup until every coin has arrived and confirmed.
Because these steps involve your actual keys, follow the official Coinkite advisory for your specific device rather than any third-party checklist, and never enter your seed words into a website or a tool that claims to check whether you are vulnerable. Those "checkers" are a classic follow-on scam after any wallet incident.
Why this matters beyond Coldcard
The lesson is not that hardware wallets are unsafe or that Bitcoin was broken. Bitcoin's cryptography worked exactly as designed. The failure was in how one product produced randomness. That distinction matters. A hardware wallet makes two separate promises: that keys never leave the device, and that keys are born from strong entropy. This incident kept the first promise and broke the second.
For everyday users, the practical takeaways are durable: prefer setups that do not depend on a single device or a single codebase, add independent entropy where a device allows it, and treat firmware and seed generation as things worth understanding rather than trusting blindly. Self-custody gives you final control over your money. That control is powerful, and it is unforgiving of hidden weaknesses.
Frequently asked questions
Does updating my Coldcard firmware fix my existing wallet?
No. The fixed firmware corrects future seed generation, but it cannot repair a seed that was already created on affected firmware. If your seed is affected, you need to generate a new one and migrate your funds.
I used dice rolls when I set up my Coldcard. Am I safe?
According to the advisory, if you entered at least 50 fair, private, independent dice rolls, the resulting seed is not considered at risk from this flaw alone. If you are unsure how many rolls you used or whether they were kept private, treat the seed as affected and migrate.
Are Tapsigner, Opendime, or Satscard affected?
Coinkite stated that these products run on different codebases and are not affected by this specific issue.
How was $38 million stolen if the keys never left the device?
The attacker did not extract keys from any device. Weak randomness meant the secret numbers behind some wallets fell into a small, guessable range, so an attacker could reconstruct them offline from public blockchain data and then move the funds.
Should I stop using hardware wallets?
This article is educational and not financial or security advice for your specific situation. Hardware wallets remain a widely recommended tool. The incident is a case for understanding how your seed was generated, keeping firmware current, and reducing reliance on any single device, rather than for abandoning cold storage.
Disclaimer: This content is for educational and informational purposes only and is not financial advice. Nothing here is a recommendation to buy or sell any asset or use any platform. Do your own research and manage your risk.
What Is the Jaywan Card? The UAE's first national payment card
AscendEX Is Shutting Down: What Happened and What Users Should Do Now
