Coldcard is a physical device used to store the private keys that control bitcoin holdings offline, away from internet-connected computers. When a user sets up the device, it generates a recovery seed, a sequence of words that functions as the master password for the wallet. That seed is meant to be produced using a hardware-based random number generator built into the device’s chip, a process designed to make the resulting seed effectively impossible to guess.
According to an advisory released by Coinkite, along with a technical review published by the engineering team at payments company Block, a code change made in March 2021 firmware caused certain Coldcard models to rely on a software-based random number generator instead of the hardware one. Block’s review determined that on Mk3 devices, the flaw reduced the effective randomness of newly generated seeds to roughly 40 bits, far short of the 128 bits expected of a standard recovery seed.
Coinkite stated that seeds generated on Mk4, Mk5, and Q devices carried roughly 72 bits of randomness before the defect was corrected, a smaller reduction but one the company still described as serious.
With sufficiently reduced randomness, an attacker does not need to access a wallet owner’s device or account. Seeds can instead be reconstructed offline by generating candidate values and checking them against addresses recorded on the public bitcoin blockchain.
Devices Affected
According to Coinkite’s advisory, the defect affected Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9, released beginning in March 2021. It also affected Mk4 and Mk5 devices running firmware earlier than version 5.6.0, and Coldcard Q devices running firmware earlier than version 1.5.0Q, along with corresponding versions on the company’s separate Edge release track. Coinkite said the severity of the defect on Mk4, Mk5, and Q devices was lower than on Mk2 and Mk3, but still significant enough to warrant migration.
Galaxy Research reported that the first wave of thefts occurred in a 41-minute window on July 30, during which 1,196 addresses were emptied of 1,082.65 bitcoin, worth about $70.2 million at the time. Coinkite published its initial advisory roughly 30 hours after the theft began. By Aug. 1, Galaxy Research had revised its count upward to 1,367.05 bitcoin, worth about $88.6 million, taken from more than 4,585 addresses. Bitcoin traded near $62,900 on Aug. 1, within the range it had held for the preceding week.
Coinkite released corrected firmware for all affected models and release tracks between July 30 and July 31: version 4.2.0 for Mk2 and Mk3 devices, version 5.6.0 for Mk4 and Mk5, and version 1.5.0Q for the Coldcard Q.
In its published advisory, Coinkite stated that installing the corrected firmware does not repair a seed generated under the earlier, defective version. The company said any wallet whose seed was created on affected firmware should be treated as compromised, unless the seed was generated using at least 50 independent dice rolls for additional randomness, or the wallet is protected by a strong, unique BIP-39 passphrase.
For all other affected wallets, Coinkite’s guidance calls for generating an entirely new seed on updated firmware and transferring funds to it. The company said its TAPSIGNER, OPENDIME, and SATSCARD products use different codebases and are not affected by the defect.
Funds Not Disbursed
As of Aug. 1, Galaxy Research reported that none of the stolen bitcoin had been moved from the addresses controlling it. The firm noted that a theft of this size is typically followed by rapid efforts to launder the proceeds, and it offered two possible explanations for the delay: The party responsible may be waiting for scrutiny to subside, or may not yet have a viable method of moving funds this large without detection.
Galaxy Research separately said it had identified a pattern in the transactions used to sweep the wallets that indicated a single operator was responsible, though it cautioned that the pattern identifies the operator’s activity rather than the underlying vulnerability itself.
Clay Garrett, an engineer at Block, wrote that investigators had traced an unusual pattern in the sweep transactions to a paid account at a blockchain-services provider, which he said the operator had used to query source addresses during the theft. Garrett said the matter had been referred to law enforcement.
NVK, a cofounder of Coldcard, wrote in a public statement that artificial intelligence-assisted code review is increasingly capable of identifying latent software defects at a pace that outstrips manual audits by experienced engineers. He said developers whose firmware has ever been made public should assume it is already under review by both defenders and potential attackers using such tools.
Peter Todd, a Bitcoin Core contributor, separately noted that certain multi-signature wallets combining Coldcard devices with unaffected hardware could face additional risk if the underlying transaction script is revealed on the blockchain before a transfer is confirmed, since that disclosure could give an attacker time to construct a competing transaction.
The defect affected Coldcard firmware distributed between March 2021 and July 2026, spanning five device models. Coinkite has not identified the party responsible for the theft, and no law enforcement action has been announced as of publication.
