Their Bitcoin Was in a Safe. The Thief Never Needed to Go Near It

A firmware bug shipped in March 2021 quietly stopped Coldcard devices from using their own randomness chip. For five years the wallets generated seed phrases a computer could guess. On July 30 somebody guessed thousands of them at once.

A 2021 firmware bug made Coldcard seed phrases guessable. Nobody had to touch a device.

Every drained wallet was offline. That is the part that broke people. The devices sat in safes, in drawers, in a Toronto safety deposit box that had never been connected to anything. None of them were touched. None of them needed to be.

Coldcard is a Bitcoin-only hardware wallet built by the Canadian firm Coinkite, and its entire pitch is the one job a hardware wallet exists to do: keep the key away from the internet, and generate a key so random that guessing it is pointless. On July 30, 2026, the second half of that promise turned out to have been broken since March 2021.

The bug is almost stupid in its simplicity. Coldcard's production build sets MICROPY_HW_ENABLE_RNG to zero, because Coinkite supplies its own wrapper around the STM32 chip's hardware random number generator. The libngu library checked whether that macro existed rather than whether it was switched on. It existed. So the build quietly fell through to MicroPython's Yasmarang software fallback, a deterministic pseudorandom generator seeded from the chip's unique ID and its timer registers, collecting no fresh entropy after startup. The change traces to a single commit on March 1, 2021, which swapped the seed-generation call from ckcc.rng_bytes, which correctly reached the hardware peripheral, to ngu.random.bytes, which routed through the broken path. Firmware 4.0.0 shipped it on March 17, 2021, and nobody noticed for five years.

The consequence is that the pool of keys a Coldcard could ever produce collapsed from unimaginably vast to countable. A 12-word BIP-39 seed is supposed to carry 128 bits of entropy. Coinkite's own estimate puts the affected devices at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5, and Q. Security teams put the practical search space on the newer models at around four billion possibilities. Four billion is an enormous number to a human being and a rounding error to a machine.

From there the attack requires nothing clever. The attacker generates candidate seeds on their own hardware, derives the Bitcoin addresses each seed would produce, and checks those addresses against the public blockchain that anyone can download. Every step runs on the attacker's computer. The victim's Coldcard is not involved at any point in the process and could be powered off, in a vault, on another continent.

Galaxy Research mapped the first sweep: 1,196 addresses drained in full for 1,082.65 BTC, worth roughly $70.2 million, between 01:10:20 and 01:51:26 UTC on July 30, across six blocks. Early reports had put it at 594 BTC and around 500 wallets, about $38 million, because the initial view caught only part of the operation. By August 1, Galaxy was tracking three suspected waves totaling roughly 1,367 BTC across 4,585 addresses, approximately $88.6 million. The third wave behaved differently from the first two, routing funds into 293 separate P2WSH vaults instead of a handful of collector addresses, which either means the attacker restructured after the sweeps went public or a second party found the same pool of vulnerable keys. Blockchain records alone cannot tell you which.

The victim profile is the tell. Every drained address was single-signature. Not one multisig wallet. Not one taproot address. No victim lost less than 0.15 BTC. Someone filtered targets by minimum balance before pulling the trigger, which means this was a shopping list, not a spray. The median loss was 0.41 BTC, about $26,500. The largest single loss was 29.9 BTC, nearly $2 million. Total transaction fees for the entire operation came to roughly 0.044 BTC, about $2,800. Whoever did this walked off with tens of millions and paid less than three thousand dollars in postage.

The address formats give the game away. Of the drained wallets, 1,183 used the modern native segwit format, seven used an older standard, and six an older one still. Nobody targets a specific person across three address formats at once. That is a scanner working through candidate seeds and checking every derivation path each one might have produced, and its operator can widen the search, refine it, and come back whenever they feel like it. Galaxy warned that further waves are likely for anyone who has not moved their funds.

There is also no way for an owner to check. No test exists that you can run against your own wallet to find out whether your seed sits inside the reproducible range. You either migrate on the assumption that you are exposed, or you wait and hope.

Coinkite's first public response was wrong, and it cost people hours. At 18:10 UTC on the first day, before the firmware flaw was understood, CEO Rodolfo Novak posted that there was no need to panic, that somebody had loaded a compromised seed onto a Coldcard or leaked their own words, and that this was part of a broader attack involving 500 keys from various wallets. Not our device. By then Kevin Loaec of Wizardsardine had already told his followers to check their balances, first with "hoping this is a nothing-burger" and ninety minutes later with "this is not a drill." Confirmations were arriving from developers the community trusts. Jameson Lopp reported partial thefts where only some outputs had been pulled. Loaec noted the victims included multiple well-known Bitcoiners. The one-careless-user theory was already dead when the manufacturer offered it.

The first formal advisory landed roughly 30 hours after the sweep finished. Block's Bitkey engineers had already published their own technical breakdown by then, and did so without completing full exploitability testing, because the exploitation was already under way and waiting seemed worse.

Novak reversed within a day. "I'm sorry and I'm devastated," he wrote on July 31, taking full accountability for the firmware bug and acknowledging that Coinkite's own review process had failed to catch it. The scope took longer to settle and is still not fully resolved. Coinkite's first advisory named the Mk3 on firmware 4.0.1 onward and said the Mk4, Q, and Mk5 were "not affected based on our early analysis." Block's engineers disagreed, describing the newer models' construction as a dangerous fail-open structure whose secure-element reseed adds only about 32 bits, and placing the Mk2 in scope as well. On July 31 the advisory was updated to add fixed firmware for every model and extend the affected scope to seeds generated on the Mk4, Mk5, and Q. The practical guidance from Nunchuk was blunter: treat any seed generated on-device on a Coldcard since 2021 as suspect until Coinkite publishes its full report.

The patch does not help anyone already hit, because fixed firmware protects future seeds and cannot repair one that already exists. The only remedy is a brand-new seed on patched hardware and a full migration of funds.

The randomness function that failed was not confined to seed generation either. Coldcard's paper wallet private keys, seed-splitting masks, device cloning keys, USB encryption keys, Key Teleport transfers, and Web2FA codes all drew on the same broken source.

The attacker did make one mistake. Clay Garrett of Block's engineering and security team said the operator used a paid account at a well-known blockchain data provider to query the source addresses while the sweeps were running, and that the provider's internal logs matched the suspected workflow with what he called extraordinary specificity, down to the number, timing, and sequence of the requests. The provider appears to have been supplying ordinary service to requests that carried no indication of what they were for. Block has passed the information to authorities. It is the only thread anyone has, and it exists because somebody who built an offline attack against offline wallets paid for an online lookup with an account attached to them.

The money has not moved. Every coin taken is still sitting unspent in a handful of attacker-controlled addresses, reported variously as four to seven as the mapping widened. Galaxy called that unusual for a theft this size and offered two readings: the operator is waiting for attention to fade, or there is no viable way to launder a sum this visible. A decade ago it would have been through a mixer within hours.

No government agency has publicly announced an investigation. Block says it handed its findings to authorities but has not named which. Coinkite is based in Toronto, and neither Canadian police nor any US agency has confirmed a case. What victims have instead is the FBI's standard advice to report crypto theft through IC3, and, in at least one documented instance, a police force that would not take the report at all: Jonathan Goodman, who lost 18.25 BTC, walked into a Toronto station and was told to file online, then had the online filing rejected for being too large with instructions to attend a station. American plaintiff firms have already published solicitation pages for Coldcard victims. No class action had been filed at the time of writing.

Zach Herbert, CEO of competing hardware wallet maker Foundation Devices, added an uncomfortable detail about where the bug came from. The March 2021 rewrite that introduced it was the same 120-file commit that stripped Coldcard's remaining GPL-licensed code, after Coinkite moved to a source-available license. Herbert was careful to say there is no evidence the license change itself caused the defect, and noted the rewrite delivered real improvements including Bitcoin Core's libsecp256k1 and reproducible builds. The observation stands anyway: the commit that removed the open-source dependencies is the commit that broke the randomness.

Novak also floated a theory about how the flaw was found: that an attacker used AI to scan Coinkite's publicly available firmware history and surface the weak randomness path. He offered it as a warning to other developers, arguing that AI-assisted review can now find latent bugs faster than experienced human experts. There is no evidence establishing how the bug was actually discovered. The uncomfortable footnote is that Coinkite had itself run a review using a leading AI model, and that review missed it.

This is the third documented failure of exactly this class. Milk Sad exposed a broken PRNG in 2023. Coinspect's Ill Bloom research surfaced weak seeds in software wallets in early July 2026, draining 431 wallets for $3.14 million from a flaw that had been sitting there since 2018. Now Coldcard. In every case the failure happened at the moment of wallet creation, the one moment a user has no way to independently verify, no matter how carefully they behave for every year afterward.