What happened
On 30 July 2026 attackers began sweeping Bitcoin from wallets whose seeds had been generated on COLDCARD hardware wallets made by Coinkite. A build error introduced in March 2021 meant the devices had built seeds from MicroPython's deterministic Yasmarang software generator instead of the chip's hardware random number generator, leaving about 40 bits of real entropy on Mk2/Mk3 units and about 72 bits on Mk4, Mk5 and Q units, far short of the roughly 128 bits a seed needs. The first wave emptied 1,196 addresses of 1,082.65 BTC (about $70 million) in 41 minutes.
Loss estimates vary by source and cut-off date: The Hacker News counted 1,367 BTC (about $88.6 million) across 4,585 addresses by 2 August, while rekt.news puts high-confidence thefts at about 1,596 BTC (about $100 million) and $130 million to $145 million if candidate cases are included, taken by at least 15 separate actors by 4 August. Coinkite published a disclosure and patched firmware within about a day, but a firmware update cannot fix an existing seed: affected owners must create a new seed on patched firmware and move their funds. Seeds created with at least 50 private dice rolls or protected by a strong, separately stored BIP-39 passphrase are not at risk.
How it happened
- From firmware 4.0.1 (March 2021) the
libngulibrary guarded its hardware-RNG path with#ifndef MICROPY_HW_ENABLE_RNG. COLDCARD's build defined that macro as0, so the check passed and seed generation silently fell back to MicroPython's Yasmarang PRNG. - Yasmarang was seeded from non-secret device state such as the chip UID and timer/RTC registers. On Mk4, Mk5 and Q the secure elements added some entropy, but the result was still far below 128 bits.
- Attackers enumerated the reduced search space offline, turned each candidate seed into Bitcoin addresses, and matched them against funded addresses on the public blockchain.
- On 30 July 2026 the first actor swept 1,196 matching addresses in 41 minutes using identical 30 sat/vByte fees and no change outputs, a pattern consistent with automated key scanning. Later waves with different fee and output patterns followed through at least 4 August; Wave 3 sent its loot to 293 separate P2WSH addresses instead of the shared collector addresses used in Waves 1 and 2.
- By 3 August about 90% of the stolen BTC had not moved. Limited laundering was seen by 4 August, including 64.9 BTC sent to Wasabi and 200 ETH to Tornado Cash, according to rekt.news.
Protocol details
Evidence
- report @COLDCARDwallet incident report x.com
- report @PeckShieldAlert incident report x.com
- report @glxyresearch incident report x.com
- report Coldcard - REKT rekt.news
- analysis DeFiLlama defillama.com
- analysis Adding to the Public Record on Our Ongoing Investigation blog.coinkite.com
- analysis COLDCARD Security Disclosure History coinkite.com
- analysis Current COLDCARD Security Status coldcard.com
- analysis COLDCARD Entropy Issue: Technical Backgrounder blog.coinkite.com
- analysis Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes thehackernews.com
- analysis A five-year-old Coldcard bug let hackers guess bitcoin wallet keys, Coinkite confirms blockhead.co
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
