The Coldcard Hack: A Timeline of the $38M Entropy Failure, and How to Keep It From Happening to You

• The sweep nobody saw coming
• Hour zero to hour twelve: full panic
• The confusion sets in
• The Coinkite advisory
• The Block report
• Overnight into this morning
• What actually broke, and why it should not shock you
• The one concept that saved people: the passphrase
• What to do right now if you own a Coldcard
• Safety habits that protect any device, from any maker
• The point of all this

594 bitcoin vanished from 500 wallets in about 25 minutes. Nobody’s keys were stolen. Nobody’s device was touched. And that is exactly what makes this one terrifying.

A running timeline of the Coldcard seed-generation disaster, what Coinkite and Block found in the firmware, what every Coldcard owner (not just the Mk3) needs to do this morning, and the safety habits that protect any hardware wallet, no matter who makes it.

You see, most Bitcoin thefts have a villain you can picture. A phishing link. A fake support agent. A five-dollar wrench. Someone tricks you, or someone grabs you, and the coins walk out the door.

This one has none of that. The victims did almost everything right. They bought a respected hardware wallet, wrote their seed words on paper, never typed them into a computer, and left their savings in cold storage for years. Then, in the small hours of July 30, 2026, the coins left anyway. All at once. From hundreds of people who had never met and had nothing in common except one thing: the device that made their keys.

Let me walk you through how this unfolded, because the timeline itself is the lesson.

§The sweep nobody saw coming

At 01:36 UTC on Thursday, July 30, Bitcoin block 960188 confirmed the first batch of what would become one of the most surgical thefts ever recorded on-chain. Over four consecutive blocks, 960188 through 960191, an automated operation swept 500 separate addresses. That is 1,324 unspent outputs, roughly 594.5 BTC, about $38 million at the time. By 01:51 UTC it was finished. The attacker had already funneled 562 BTC into a single consolidation address, where it still sits as of this writing.

Look at the fingerprint of the attack and it tells a story. Every drained address was single-signature. Not one multisig wallet. Not one taproot address. The median victim lost 0.41 BTC (around $26,500), the hardest-hit lost 29.9 BTC (nearly $2 million), and no victim lost less than 0.15 BTC. That floor is a tell: the attacker filtered targets by minimum balance. This was not a spray-and-pray. Someone had a specific wish list.

The whole operation cost about 0.044 BTC in fees. Whoever did this walked away with $38 million and paid roughly $2,800 in postage.

§Hour zero to hour twelve: full panic

The first alarm did not come from a researcher or a company. It came from a victim.

At 13:19 UTC, a user posted to Reddit under the title “Full panic, one of my wallets was drained.” The comments pieced together a heartbreakingly ordinary story: a Coldcard bought in 2021, a 24-word seed generated on the device, savings moved over, then years of quiet. In January 2025 they bought a second Coldcard and re-entered the old words “to make sure they were right.” The seed had never touched a computer. Only the device, a watch-only wallet on Sparrow, and automatic withdrawals from an exchange to the same address. That night, that address got swept along with 499 others.

§The confusion sets in

Here is where it gets messy.

At 17:35 UTC, Kevin Loaec, co-founder of Wizardsardine (the team behind the Liana wallet), asked his followers with a Coldcard to check their balances. His words: “Hoping this is a nothing-burger but doing my job here.” Ninety minutes later the tone had changed completely. “This is not a drill.”

Confirmations rolled in from names the community trusts. The developer known as grubles confirmed a case. Jameson Lopp reported partial thefts, wallets where only some outputs had been pulled, not the whole balance. Loaec noted that the victims included “multiple real and known bitcoiners.” The comforting theory, that one careless person got phished, was dead. Something systemic was in play.

Then the manufacturer spoke, and got it wrong.

At 18:10 UTC, NVK (Rodolfo Novak), founder and CEO of Coinkite, the company that makes Coldcard, responded: “No need to panic. Someone loaded a compromised seed onto a Coldcard and/or their seed leaked. This is part of a broader attack involving 500 private keys from different wallets.” In other words: not our device, these were bad seeds from elsewhere.

I want to be fair to NVK here, because I think he was doing what a founder does at hour sixteen of a crisis with incomplete data. He was pattern-matching to the last hundred incidents, which usually are leaked seeds. But he was wrong, and to his credit he said so. As the picture sharpened he pulled back the initial call, telling followers he did not want bad information circulating while people were at risk, and put the whole team on it. “We are all hands on deck doing a deep dive on everything, technical post soon.”

Meanwhile the on-chain analysts were closing in on the real answer. Rob Hamilton, CEO of AnchorWatch, ran the numbers: 1,324 outputs, all single-sig, dating from 2021 to 2026, not one taproot. His read: “At first glance, it appears there was faulty entropy in wallet generation somewhere along the path.”

Faulty entropy. Hold onto that phrase.

§The Coinkite advisory

By the end of the day on July 30, Coinkite published a formal Mk3 Security Advisory. No more hedging. The warning was blunt: any user who generated a seed on a Coldcard Mk3 running firmware version 4.0.1 (March 2021) or later should treat their funds as at risk. The flaw runs through firmware 5.0.3, the final release that supported the Mk3.

The advisory carried one piece of very good news and one clear set of instructions.

The good news: if you protected your Mk3 seed with a BIP-39 passphrase, Coinkite’s early analysis said your funds are at minimal risk. Why? Because the passphrase is the one ingredient the device does not generate. More on that shortly, because it’s the single most important concept in this whole affair.

The instructions: if the Mk3 is your only device, create a strong, unique BIP-39 passphrase on it and move funds to the new passphrase-protected wallet as an interim measure. For a cleaner fix, generate a fresh seed on an unaffected Coldcard (Mk4, Q, or Mk5) or, for the advanced and careful, use the Mk3’s dice-only import path with at least 99 rolls of a fair die, which bypasses the device’s broken generator entirely. And the line that should be tattooed on every self-custody guide ever written: migrate calmly. “Rushing a wallet migration can create a more immediate risk than the issue you are trying to address.” Verify every backup, every address, every fingerprint, and send a small test transaction before you move the rest. Personally I also want to test sending from the new wallet before I move all my funds (which I calmly did last night because I too have mk3 that’s potentially at risk).

Alongside the advisory, Coinkite published a companion technical backgrounder, and it contains one of the most disarmingly honest admissions I have ever seen from a hardware maker mid-crisis. NVK wrote that most of the randomness on the Coldcard was coming from a software PRNG “that I didn’t know was actually in the source code base,” inherited from a MicroPython submodule. The hand-built hardware TRNG he had carefully written was still running, but “just by chance, and only for less important things.” Sit with that. The founder of one of the most respected names in Bitcoin self-custody did not know which random number generator his own seeds were actually using. Not because he was careless, but because two functions shared the same name and the wrong one quietly won.

Coinkite said Mk4, Q, and Mk5 were not affected based on early analysis. That turned out to be true for this specific theft, but incomplete for the underlying bug. Enter Block.

§The Block report

On the same day, Block’s Bitcoin engineering and security teams published an independent technical analysis, written with anonymous security researchers. This is the document that turns a scary headline into an understandable failure. And it is worth slowing down for, because the mechanism is a small masterpiece of how big disasters hide inside tiny mistakes.

Here is the chain of events, in plain language.

A Coldcard is supposed to generate your seed using a true hardware random number generator, a dedicated circuit in the STM32 chip that produces genuine physical randomness. Coinkite wrote their own wrapper for that hardware, which is good practice. To avoid a conflict, the production build sets a configuration flag, MICROPY_HW_ENABLE_RNG, to zero, telling the underlying MicroPython system “don’t use your built-in RNG, we’ve got our own.”

Now the bug. A separate library the firmware relies on, called libngu, needed to check whether that hardware RNG was available. It checked whether the flag was defined, not whether it was enabled. The flag was defined. Its value was zero, meaning off, but the check only asked “does this exist?” and the answer was yes. So the build completed with no error and no warning, and quietly wired seed generation to MicroPython’s software fallback instead of the hardware chip.

And what is that fallback? A small, non-cryptographic pseudo-random generator called Yasmarang, seeded from the chip’s fixed serial number and a couple of timer registers. Those are not secrets. The serial number is factory-set metadata. The timers are predictable startup state. Feed a predictable input into a predictable algorithm and you get a predictable output that merely looks random. It passes the eye test. It fails reality.

Block laid out the consequences by device, and this is where it gets worse than the Coinkite advisory suggested:

On the Mk2 and Mk3 running the v4 firmware, there is essentially no real cryptographic entropy at all. For a known device and startup state, seed generation is effectively deterministic. Coinkite’s own follow-up put the effective search space around 2⁴⁰ (40 bits), against the 2¹²⁸ (128 bits) a 12-word seed is supposed to have. An attacker with the right setup does not guess your seed out of an impossible ocean of possibilities. They compute it.

On the current Mk4, Q, and Mk5, it is better but still broken. A boot-time reseed pulls entropy from the secure elements, but the code keeps only 32 bits of it. That caps the meaningful search space at about 2³², roughly four billion possibilities, or around 2⁷² (72 bits) total once you account for the timing states. Four billion sounds like a lot until you remember that modern hardware chews through numbers like that for breakfast. Coinkite calls this a material improvement that still does not reach the target, which is a polite way of saying “do not rely on it.”

So let me be blunt about the scope, because the early headlines fixated on the Mk3 and that is genuinely misleading. This is not an Mk3 problem. It is a Coldcard problem. Every current model, the Mk4, the Q, and the Mk5, generated weakened seeds too, just with more entropy than the Mk3’s near-deterministic worst case. The theft happened to hit Mk3-era single-sig wallets, so the Mk3 grabbed the spotlight, but if you generated a seed on any Coldcard from March 2021 onward, you are in scope. What is genuinely clear? The Mk1, any Mk2 or Mk3 seed made on firmware before v4.0.0 (those used the real hardware generator), and the non-Coldcard products Tapsigner, Opendime, and Satscard, which run different code entirely. Everything else made in the last four-plus years should be treated as suspect until you have migrated.

The regression entered in a single commit dated March 1, 2021, shipped in firmware v4.0.0 on March 17, 2021, and the partial Mk4 reseed was added a year later in March 2022 without ever fixing the root cause. For over four years, seeds were being born weak, and nobody noticed. The same weak generator also touches paper-wallet keys, seed XOR masks, cloning and USB encryption, Key Teleport, Web2FA, and Secure Notes passwords. The rot ran deep because everything drank from the same poisoned well.

One correction worth making, since it is already circulating wrong: you will see an “eight-year-old bug” figure in some coverage. That is not quite right, and Coinkite pushed back on it directly. The vulnerable MicroPython fallback code was added upstream back in May 2018, so the code is eight years old, but it did not enter Coldcard’s seed generation until the March 2021 migration. Affected seeds go back a little over four years, not eight. The distinction matters if you are trying to figure out whether your own wallet is exposed.

And here is the part that should keep every auditor up at night. Coldcard’s firmware is fully open source and has been reviewed, including by Coinkite itself. So how did this survive years of eyes on the code? Because the reviews confirmed the correct hardware TRNG was present in the compiled binary, but never verified which of the two identically-named functions the seed-generation path actually reached. The good code was in the building. It just wasn’t the code that answered the door. Present is not the same as used, and an audit that checks the former while assuming the latter can pass a broken system with flying colors.

§Overnight into this morning

So where do we stand as of Friday morning, July 31?

Coinkite shipped an emergency hotfix overnight: firmware 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q. It adds no new features. It just generates entropy correctly, and it does so with a fix that is almost poetic in how directly it answers the bug: the build now explicitly refuses to include the MicroPython fallback and adds a compile-time check that fails unless the correct hardware RNG is the one actually wired in. The exact blind spot that let this ship for four years is now a build error. Critical caveat, and please do not miss it: updating your firmware does not repair a seed that was already created on the broken version. The weak seed already exists. A patch stops the bleeding going forward, it does not heal the wound. Anyone with funds under an affected seed still needs to migrate to a brand-new seed generated on patched hardware. The Mk3 is out of support, so its owners are pointed to the separate migration path in the advisory.

Block’s hardware lead, Max Guise, urged anyone exposed to move funds as soon as they safely can, and confirmed that no Block products are affected. Trezor, a competitor, told its own users their funds are safe, while making a point that deserves emphasis: a seed created on an affected Coldcard stays weak even if you restore it onto a different brand of device. The weakness lives in the numbers, not the hardware. You cannot launder a bad seed by moving it.

There is a strange, quiet coda to all of this. The stolen 594 BTC has not moved. 562 sit untouched in that consolidation address, another 32 on an intermediate hop, and not a single satoshi has gone toward an exchange or a mixer. The attacker is sitting on $38 million in the open, and the next time those coins twitch will be the first real clue to who holds them. I also don’t think it will be so easy for the theif to even use is stolen funds. He may also be noticing how much attention he received and planning his next moves more carefully.

And then there is the detail that makes 2026 feel like 2026. Coinkite says it has to assume the attacker used AI to comb through old versions of its open-source firmware and find the flaw. The gut-punch: the company says it ran one of the best available AI models over its own code just weeks earlier, and the model “did not find this bug or anything serious.” Same tools, both sides of the fight. This time, in Coinkite’s words, “it did not help us, and only helped the bad guys.”

§What actually broke, and why it should not shock you

Let me pull back from the timeline, because the mechanism here is older than Bitcoin.

Ayn Rand built her entire philosophy on three words: A is A. A thing is what it is, regardless of what you wish it to be, regardless of how it looks. Reality does not bend to hope. Her constant instruction to the confused was “check your premises,” because when you hit a contradiction, there is either a lie or an error in your data or something wrong with your starting assumptions.

That is this whole disaster in a sentence. Everyone in the chain assumed a premise that was false. The library assumed a defined flag meant an enabled flag. The build assumed no error meant no problem. And hundreds of users trusted that a number which looked random was random without taking any steps to increase that randomness (myself included). But a predictable number wearing a costume of randomness is still predictable. A is A. The seed looked like 2¹²⁸ of entropy and behaved like 2⁴⁰, and reality, in the form of an attacker with a script, collected the difference.

This is why the Austrian tradition is so allergic to appearances standing in for substance. Randomness cannot be faked, only genuinely produced or genuinely absent. There is no in-between that survives contact with a determined adversary. The seed is the foundation your entire financial sovereignty rests on, and a foundation is not “probably solid.” It either is or it isn’t.

§The one concept that saved people: the passphrase

Here is the part most Coldcard owners are about to get wrong, so read slowly.

Your PIN is not your passphrase. The PIN unlocks the physical device. It has nothing to do with this bug. The BIP-39 passphrase, sometimes called the 25th word, is completely different: it is an extra secret you supply that gets combined with your seed to derive an entirely separate wallet. Change one character and you get a totally different wallet.

Why did a passphrase protect people here? Because the device never generates it. You do. It is the one input the broken random number generator never touched. An attacker can recompute your weak seed from public data all day long, but without the passphrase that lives only in your head and your backup, the recomputed seed unlocks an empty wallet. The passphrase survived the entropy failure precisely because it never depended on the device’s entropy in the first place.

Most people know their PIN. Far fewer set a passphrase. That gap is the entire attack surface. Every single drained wallet was a passphrase-free single-sig seed.

§What to do right now if you own a Coldcard

Calm and careful beats fast and panicked. A rushed migration is its own attack vector. Work through this deliberately.

1. Figure out which firmware made your seed.

   Exposure depends on the firmware version in use when the seed was generated, not the device’s age or its current firmware. Mk2 or Mk3 seeds from v4.0.0 through v5.0.3 are the highest risk. Mk4, Q, and Mk5 seeds are reduced-but-real risk (roughly 2⁷², or 72 bits).

2. If you have a BIP-39 passphrase, you are in far better shape. Keep protecting it. Never type it into a website, phone, or computer. It is doing the heavy lifting.

3. Migrate to a fresh seed on patched hardware. Update to the hotfix (5.6.0 on Mk4/Mk5, 1.5.0Q on Q), then generate a new seed. Better yet, add entropy you control: at least 99 dice rolls, a strong passphrase, or both.

4. Verify before you trust. Record the new wallet’s fingerprint, verify a receive address on the device screen, and send a small test transaction. Confirm it arrives before moving the rest. Keep your old backup until the migration is fully confirmed.

5. Remember a bad seed stays bad. Moving it to a Trezor, a Ledger, or a new Coldcard does not fix it. You need a genuinely new seed.

If your affected wallet is already empty and you have moved on to a fresh seed elsewhere, you are done. The risk lives only in wallets still holding funds under a seed the broken firmware produced.

§Safety habits that protect any device, from any maker

Zoom out one more level, because Coldcard is not uniquely cursed. Milk Sad (2023) exposed wallets built with a tool that used a timestamp as its only entropy. Randstorm exposed millions of browser wallets from 2011 to 2015. Just three weeks ago, the Ill Bloom disclosure hit five separate wallet implementations with weak seed generation. Different vendors, same failure mode, again and again. So harden your setup in ways that do not depend on any one company getting it perfect:

Add a passphrase. It layers a secret the device can never leak, and as we just saw, it is the difference between a scare and a catastrophe. Contribute your own entropy with dice when you can, so you are not trusting a black box to be honest about its randomness. Always verify receive addresses on the device’s own screen, never on your computer. Test every new wallet with a small amount before you commit real savings and make sure you can both send and receive from the new device before commiting all of your funds. Buy hardware directly from the manufacturer and verify firmware signatures. Keep firmware current, but understand what a patch can and cannot undo.

And the big one, the structural fix: multisig, ideally across multiple vendors. Look back at the Coldcard sweep. Not one multisig wallet was touched. A two-of-three setup spread across different manufacturers means a flaw in any single device, or any single firmware, or any single company’s random number generator, cannot drain you on its own. It is the “don’t trust, verify” principle turned into architecture. You stop betting your entire stack on one team’s code review, and this month showed us that even excellent teams, running AI over their own code, miss things.

Treat your custody as a practice, not a purchase. The 2021 buyers who got swept did the setup once and never looked back. Sovereignty is not a product you own. It is a discipline you keep.

§The point of all this

The whole promise of self-custody is that you remove your dependence on trusted third parties. No bank, no exchange, no custodian standing between you and your money. That promise is real, and it is worth everything. Bitcoin is still the only major asset that lets an ordinary person hold bearer wealth with no permission slip and no counterparty, a point I made back in By the Time They Let You In, the Money’s Already Made.

But trustless does not mean effortless. When you fire the middleman, you also inherit his job. The Coldcard failure is not an argument against self-custody. It is an argument for doing it with the seriousness it deserves: verify your entropy, layer your defenses, and never let a thing’s appearance stand in for its substance. A is A. Your keys are only truly yours when no one else can compute them.

Not your keys, not your coins. And not real entropy, not your keys.

At Bitcoin Well, we build for the person who wants to hold their own keys the right way, with self-custody that puts you in control instead of a costume of it.