11
$70M Bitcoin Heist: Coldcard Flaw Cracks Wallet in 41 Min
Coldcard Hardware Wallet Bug: $70 Million in Bitcoin Drained in 41 Minutes
What Happened?
On July 30, 2026, someone stole 1,082.65 Bitcoin (worth about $70.2 million at the time) from 1,196 different addresses — all in just 41 minutes.
The theft was traced to a firmware bug in Coldcard, a popular Bitcoin-only hardware wallet made by the Canadian company Coinkite.
Important: This wasn’t a hack of the blockchain or Bitcoin itself. It was a mistake in how the wallet created secret "seeds" — the master keys that control your Bitcoin.
The Root Cause: A Tiny Configuration Mistake
How It Started (March 2021)
When Coinkite built the firmware for Coldcard devices, they made a small but critical error in the configuration settings.
| What Should Have Happened | What Actually Happened |
|---|---|
| Use the STM32 hardware random number generator (RNG) — a physical chip that creates truly unpredictable numbers | The code checked if a setting name existed instead of if it was turned on |
| Result: Strong, unpredictable seeds | Result: Fell back to MicroPython’s "Yasmarang" software PRNG (Pseudo-Random Number Generator) |
Why Software PRNGs Are Dangerous for Wallets
- PRNG = Predictable if you know the starting conditions
- The Yasmarang PRNG used only:
- The chip’s Unique ID (UID) — same for every boot
- Timer registers — predictable at boot time
- No fresh entropy after startup
ELI5 Analogy:
Imagine a "random" number generator that always starts from the same page of a book, then just reads the next line each time. If you know the book and the starting page, you can predict every "random" number forever.
Which Devices Are Affected?
The vulnerability depends on the firmware version running when you created your seed — not what’s installed now.
Affected Models & Versions
| Model | Vulnerable Firmware Versions | Fixed In |
|---|---|---|
| Mk2 & Mk3 | 4.0.0 – 4.1.9 | 4.2.0+ |
| Mk4 & Mk5 | Before 5.6.0 | 5.6.0+ |
| Q | Before 1.5.0Q | 1.5.0Q+ |
| Edge Builds (Mk4/Mk5) | Before 6.6.0X | 6.6.0X+ |
| Edge Builds (Q) | Before 6.6.0QX | 6.6.0QX+ |
Unaffected Devices:
TAPSIGNER, OPENDIME, SATSCARD — they use completely different code.
How Bad Is It? (Entropy Explained Simply)
Entropy = how many guesses an attacker needs to crack your seed.
| Device | Effective Entropy | Standard (BIP-39 12-word seed) |
|---|---|---|
| Mk3 | ~40 bits | 128 bits |
| Mk4, Mk5, Q | ~72 bits | 128 bits |
Block (the researchers) warns:
Even "72 bits" isn’t the same as 72-bit cryptographic security. Real-world attack cost depends on:
- Whether the attacker knows your device’s UID
- Exact boot timing
- How many times the RNG was used before seed creation
- Computing power available
No public report has yet reconstructed a victim’s seed and matched it to a drained address — but the math says it’s possible.
What Should You Do? (Step-by-Step)
If You Created a Seed on Vulnerable Firmware
- Update firmware immediately to the latest fixed version for your model
- Generate a brand new seed on the updated firmware
- Move all your Bitcoin to addresses from the new seed
- Never reuse the old seed — even on patched firmware or another wallet
Critical:
Restoring the old seed on new firmware carries the weakness forward. The seed itself is compromised.
Special Cases
| Situation | Recommendation |
|---|---|
| You used ≥50 fair, private dice rolls to create the seed | Not at risk from this bug alone |
| Dice rolls were fewer, not private, or you’re unsure | Migrate to a new seed |
| You have a strong BIP-39 passphrase | Creates a separate wallet, but still replace the seed |
| You use multisig | Only helps if not all devices in the quorum are affected |
The Attack Itself: What We Know
- 1,196 addresses swept in 41 minutes
- All transactions used 30 sat/vB fee rate, no change output, same signature pattern
- Galaxy Research mapped the sweep — no other transactions in prior 30 days matched this pattern
- Attacker unknown — the pattern identifies the operator, not necessarily the thief (a sweep looks identical to an owner moving coins)
Related: The "Ill Bloom" Flaw
This disclosure followed Coinspect’s "Ill Bloom" research (early July 2026) — a separate weak-PRNG flaw in older software wallets linked to > $5 million drained across Bitcoin, Ethereum, Tron, Rootstock, and Polygon since May.
Two different bugs. Same root cause: bad randomness.
Summary
- A 2021 firmware config error made Coldcard wallets use a predictable software RNG instead of the hardware RNG
- Seeds created on vulnerable firmware have drastically reduced entropy (40–72 bits vs. 128 bits expected)
- $70M+ stolen in one 41-minute sweep from 1,196 addresses
- Fix: Update firmware → generate new seed → move funds
- Old seeds are permanently compromised — never reuse them
- Multisig helps only if not all signers are affected
- TAPSIGNER, OPENDIME, SATSCARD are safe
FAQ
1. Was Bitcoin itself hacked?
No. The Bitcoin network and blockchain are secure. The flaw was in how one brand of wallet generated secret keys.
2. I updated my Coldcard firmware. Am I safe?
Only if you also created a new seed after updating. The old seed remains vulnerable even on new firmware.
3. How do I know if my seed was created on vulnerable firmware?
Check the firmware version at the time you created the seed. If unsure, assume it’s vulnerable and migrate.
4. Can I just add a passphrase to fix this?
A strong passphrase creates a different wallet, but Coinkite still recommends replacing the seed entirely for maximum safety.
5. Are other hardware wallets affected?
This specific bug is only in Coldcard (Mk2, Mk3, Mk4, Mk5, Q on certain firmware). Other brands like Ledger, Trezor, BitBox, etc., are not affected by this flaw — but always verify your device’s security advisories.
