Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes

Summary

An attacker drained 1,196 Bitcoin addresses of 1,082.65 BTC ($70.2M) in 41 minutes on July 30, 2026, exploiting a March 2021 firmware integration error in Coldcard hardware wallets. The flaw routed seed generation to a weak software PRNG instead of the hardware RNG, reducing entropy to ~40 bits (Mk3) or ~72 bits (Mk4/Mk5/Q) versus the required 128 bits. Coinkite released emergency firmware patches on July 31, but users with exposed seeds must generate new ones and move their coins, as patched firmware cannot repair an existing compromised seed.

Full text

Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes Swati KhandelwalAug 01, 2026Vulnerability / Threat Intelligence An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet made by Canadian firm Coinkite. A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator (PRNG) instead of the STM32 hardware random number generator (RNG). Block says an attacker who can determine or sufficiently constrain the device UID, timer state, and prior RNG-call history can reproduce candidate output streams offline without accessing the device. Candidate seeds can then be checked by deriving their addresses and comparing them with public blockchain data. Coinkite shipped emergency firmware for every affected model and release track on July 31, but installing it does not repair an existing seed. Coinkite tells owners with exposed seeds to generate a new one on patched firmware and move their coins. Restoring the old seed to updated firmware or another wallet carries the weakness forward. No public report has reconstructed a victim's seed and matched it to a drained address. Block traced the fault to Coldcard's production config, which defines MICROPY_HW_ENABLE_RNG as zero because Coinkite supplies its own hardware-RNG wrapper. The libngu library checked whether the macro existed rather than whether it was enabled, binding the build to MicroPython's Yasmarang fallback. The MicroPython fallback was initialized from the chip's unique ID and timer registers and collected no fresh entropy after initialization. Coinkite estimates effective entropy at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q, against 128 bits for a 12-word BIP-39 seed. Block does not give one practical figure. It sets conditional ceilings below 240.7 and 273.3 and warns that the latter is not equivalent to 73-bit cryptographic security. It published no brute-force benchmark. Image Source: Galaxy Research The later-model reseed raises the number of candidates, but Block says practical cost depends on available UID information, boot timing, prior RNG calls and derivation cost. Exposure depends on the firmware running when the seed was created, not the version installed now: Mk2 and Mk3: Coinkite lists Mk3 versions 4.0.1 through 4.1.9, fixed in 4.2.0, and does not name Mk2. Block places both Mk2 and Mk3 versions 4.0.0 through 4.1.9 on the vulnerable path. Mk4 and Mk5: anything before 5.6.0. Q: anything before 1.5.0Q. Edge builds: before 6.6.0X for Mk4 and Mk5, before 6.6.0QX for Q. Coinkite says a seed built with at least 50 fair, independent, private dice rolls is not at risk from this bug alone. If the number or privacy of the rolls is uncertain, Coinkite says to migrate. A strong, unique BIP-39 passphrase creates a separate wallet the seed words cannot reach on their own, but the company still recommends replacing the seed. Multisig helps only when the quorum is not built entirely from affected devices. TAPSIGNER, OPENDIME and SATSCARD use different codebases and are unaffected. No one has named the attacker. Galaxy, which mapped the 1,196-address sweep, said it found no other Bitcoin transactions in the previous 30 days with the same 30 sat/vB, no-change signature. It warned that the pattern identifies the operator, not the theft, because a sweep "looks the same as if a coin owner chose to move coins." The disclosure follows Coinspect's Ill Bloom research in early July, a separate weak-PRNG flaw in older software wallets tied to more than $5 million drained from addresses across Bitcoin, Ethereum, Tron, Rootstock and Polygon since May. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Bitcoin, cryptocurrency, cryptography, Cybercrime, Firmware Security, hardware security, Threat Intelligence, Vulnerability ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• malware — Coldcard firmware flaw (PRNG entropy weakness)

Entities