$70 Million in Bitcoin Drained from 1,196 Coldcard Addresses
A firmware defect introduced in Coldcard firmware 4.0.0 in March 2021 has been linked to one of the most significant hardware wallet compromises ever documented. On July 30, 2026, an attacker swept 1,082.65 BTC — worth approximately $70.2 million — from 1,196 Bitcoin addresses in just 41 minutes, across six block confirmations.
The attack happened almost 30 hours before wallet manufacturer Coinkite publicly warned its users. Galaxy Research mapped the on-chain sweep and traced it to a systematic enumeration of private keys weakened by the firmware defect.
Crucially: attackers never needed physical access to the devices or the owners' recovery phrases.
The Firmware Flaw
The root cause is a build configuration mistake that caused Coldcard devices to skip their dedicated hardware random number generator (RNG) and fall back to a far weaker software substitute.
What Was Supposed to Happen
Coldcard's firmware is designed to source entropy for BIP-39 seed generation from a dedicated hardware RNG chip — producing cryptographically strong, unpredictable randomness as expected for a 128-bit-secure wallet.
What Actually Happened
Block engineering's post-mortem traced the fault to a single commit on March 1, 2021 that changed seed generation from ckcc.rng_bytes (which correctly reached the STM32 hardware peripheral) to ngu.random.bytes (which routed through a broken libngu path). Firmware 4.0.0 shipped with this change on March 17, 2021.
The production board config defined MICROPY_HW_ENABLE_RNG as zero because Coinkite supplies its own hardware-RNG wrapper. However, the libngu library checked whether the macro was defined (using #ifndef) rather than whether its value was nonzero. Because the macro was defined — even as zero — the build-time #error guard never fired, and key generation silently fell through to MicroPython's Yasmarang software PRNG fallback, initialized from:
- The chip's unique ID (fixed factory metadata, not secret)
- Timer register values (timing state narrowable via external measurement)
Compounding the issue, libngu XORs the Yasmarang output with a second Yasmarang instance seeded from hardcoded public constants, making the combined output fully deterministic from knowable inputs.
No fresh entropy was collected after initialization. The entire keyspace a device could ever produce collapsed from an astronomically large number to a countable, enumerable set.
| Device | Estimated Effective Entropy |
|---|---|
| Coldcard Mk3 (firmware 4.0.1+) | ~40 bits |
| Coldcard Mk4, Mk5, Q | ~72 bits |
| Secure expectation (BIP-39, 12-word) | 128 bits |
At 40 bits of entropy, the keyspace is roughly one trillion keys — computationally scannable with modest resources.
The Attack
Galaxy Research reconstructed the July 30 sweep from on-chain data:
| Metric | Value |
|---|---|
| Total BTC stolen | 1,082.65 BTC |
| USD value at time | ~$70.2 million |
| Addresses drained | 1,196 |
| Time elapsed | 41 minutes |
| Bitcoin blocks involved | 6 (with 3 gap blocks) |
Transactions were broadcast in batches across multiple blocks, indicating a systematic scripted sweep rather than manual operation. The attacker required no physical device access — only the ability to reconstruct private keys by brute-forcing the reduced entropy space seeded from publicly knowable chip data.
Affected Devices
The flaw was present in affected releases from March 2021 through late July 2026 — a five-year exposure window. Exposure depends on the firmware version at the moment the wallet seed was first generated, not the current firmware:
| Device | Affected Firmware | Effective Entropy |
|---|---|---|
| Mk3 | 4.0.1 – 5.0.3 | ~40 bits |
| Mk4 / Mk5 | Before 5.6.0 | ~72 bits |
| Coldcard Q | Before 1.5.0Q | ~72 bits |
| All (secure) | Post-July 31 patch | 128 bits |
That five-year exposure window explains why long-dormant wallets were at risk: owners who hadn't touched their wallets since 2021–2022 may have assumed inactivity indicated safety.
Second Wave
Galaxy Research subsequently identified a second wave of sweeps expanding the total impact to 1,158.81 BTC stolen from 2,673 addresses, held across 7 attacker-controlled addresses. As of reporting, none of the stolen Bitcoin had been moved — an unusual detail researchers attributed to the attacker potentially waiting for attention to diminish or lacking a safe laundering path for a theft of this magnitude.
Emergency Response
Coinkite shipped emergency firmware for all affected models on July 31, 2026 — roughly 30 hours after the initial sweep:
| Device | Patched Firmware |
|---|---|
| Mk3 | 4.2.0+ |
| Mk4 / Mk5 | 5.6.0+ |
| Coldcard Q | 1.5.0Q+ |
The hotfix explicitly excludes MicroPython's fallback PRNG and adds a build-time RNG symbol check. However, patching does not repair a seed that was already generated insecurely. Any wallet created under affected firmware has a private key derived from weak entropy. The fix prevents future seeds from being weak — it does not retroactively strengthen existing ones.
What Affected Users Must Do
If you hold Bitcoin on a Coldcard device that ran firmware 4.0.0 or later before the July 31 emergency patch:
-
Treat your existing seed as compromised. Do not use this assumption as an excuse to delay — act as if the key is already known to an attacker.
-
Generate a new wallet on a patched device (or a different hardware wallet) using freshly generated entropy.
-
Transfer all funds to the new wallet immediately. Do not leave any balance on addresses derived from the old seed.
-
Verify the firmware version on your device before generating a new seed — confirm it is a post-July 31 emergency release.
-
Do not reuse the old seed phrase for any new wallet generation.
Broader Implications
This incident highlights that hardware wallet security depends on the entire firmware supply chain — not just physical tamper resistance. A single misread macro in a build configuration file invalidated the security of devices shipped over five years.
CZ (Changpeng Zhao) and other industry figures publicly warned that hardware wallets are not immune to firmware-level vulnerabilities. Researchers warn that additional vulnerable addresses may still hold funds if owners delay migration.
References
- The Hacker News — Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft
- CoinDesk — How Bitcoin Cold Wallets Lost $70 Million in an Attack That Never Touched the Devices
- Block Engineering Blog — Predictable RNG Fallback in Coldcard Firmware
- Coldcard Entropy Incident — Address Check and Evidence
- Coinpedia — Coldcard Wallet Flaw Exposed: Hacker Quietly Drains 1,082 BTC
- Yellow — Coldcard Loses $70M In 41 Minutes As CZ Warns Hardware Wallets Can Fail
- CryptoTimes — Coldcard Hack Hits $75M After Second Attack Wave
- BitcoinKE — Why This Cold Wallet Exploit Exposes a Big Bitcoin Hardware Security Vulnerability