Attackers have drained a nine-figure sum of Bitcoin from Coldcard hardware wallets by exploiting a random number generator defect in Coinkite firmware that made supposedly unguessable seed phrases computationally enumerable. The root cause has been documented publicly by Block's Bitcoin Engineering and Security teams and confirmed by a Coinkite security advisory that shipped fixed firmware for every affected model. Loss estimates vary widely and are still moving: Galaxy Research put the total at roughly $88.6 million as of August 1 (reported by BleepingComputer and Infosecurity Magazine), CBC News cited "more than $100 million US," TechCrunch reported Galaxy's figure had reached about $130 million by August 4, and a BingX flash-news summary of Galaxy and Chainalysis data cites $116 million. Elliptic co-founder and chief scientist Tom Robinson told TechCrunch the ~$130 million estimate was "roughly correct." Treat any single total as a snapshot of an ongoing incident, not a final number.
What Happened
The first confirmed wave hit on July 30, 2026. Galaxy Research mapped 1,082.65 BTC, worth roughly $70 million, swept from 1,196 addresses between 01:10 and 01:51 UTC in a 41-minute window spanning six blocks, with three intervening empty blocks suggesting batched broadcast rather than continuous spending. CoinDesk noted that this figure was nearly double what was reported when the theft first surfaced, because early reporting captured only one of the four attacker-controlled destination addresses.
BleepingComputer reports the 41-minute sweep occurred roughly 30 hours before Coinkite publicly disclosed the flaw. On August 1, Galaxy identified second and third waves, raising the running total to 1,367 BTC, approximately $88.6 million. Victim address counts differ between outlets covering the same Galaxy report: BleepingComputer states 4,585 addresses while Infosecurity Magazine states 4,385. Both cite the same underlying research, so the discrepancy is most likely a transcription error in one of the two, but neither figure should be presented as settled.
TechCrunch adds a complication that materially changes the threat model: according to Galaxy Research, this is not one actor. At least a dozen different hackers are said to be targeting Coldcard owners, and it is unclear who is behind the thefts. Because the vulnerability lets anyone who understands it enumerate keys independently, the incident is better understood as a race among multiple parties than as a single intrusion.
What Was Taken
Bitcoin only, taken directly from on-chain addresses whose private keys were derived from weak seeds. No personal data breach, no customer database, and no device compromise is alleged in any source. Coinkite's product does not custody funds, so what was lost is the funds themselves rather than records about them.
Volume by report: 1,082.65 BTC (~$70M) in wave one across 1,196 addresses; 1,367 BTC (~$88.6M) cumulative across 4,385 to 4,585 addresses after waves two and three; and higher running totals of $100M+ (CBC), $116M (BingX summarizing Galaxy and Chainalysis), and ~$130M (TechCrunch, August 4) as the sweeps continued.
Chainalysis found the attacker prioritised high-value wallets, taking roughly $30 million in the first ten minutes and $1.8 million from a single victim, which BleepingComputer notes suggests the affected wallets were identified and studied before the sweep began. As of Galaxy's report, the proceeds sat unmoved in four attacker-controlled addresses. Galaxy said it has reported approximately 600 addresses believed to hold stolen funds to federal investigators, industry compliance firms, and cross-industry cyber investigators.
On geographic distribution, the BingX flash-news item is the only source in this set that breaks losses down by country. It reports Canadian holders as the largest identifiable group at 25% of geographically attributable losses, linked to Coinkite's Toronto base, with Australia next at roughly 15% to 20% and the United States and Thailand each in the 10% to 15% range, plus fallout across Western Europe, Latin America, Nigeria, and South Africa. That breakdown is single-sourced and OTHER-tier; it should be treated as an unconfirmed claim attributed to that report rather than an established fact.
Why It Matters
The defensive premise of a hardware wallet is physical and network distance: keep the key on a device that never touches the internet and remote attackers cannot reach it. As CoinDesk framed it, this attack never touched the devices. The keys were reconstructed offline from a defect in how they were created. Air-gapping is worthless when the entropy source behind the secret is broken, because the attacker does not need access to the secret, only the ability to regenerate it.
The second lesson is dwell time. The Mk2/Mk3 defect dates to firmware shipped in March 2021. Galaxy Research characterised the flaw as silently falling back to a weaker generator, leaving users unaware that their keys were being produced with low entropy. Roughly five years of seeds were generated under a broken assumption with no error, no warning, and no observable symptom, and the exposure only became visible when someone monetised it. Any control whose failure mode is silent should be assumed to be failing until proven otherwise.
Third, the loss is not containable by patching. Coinkite's advisory states plainly that updating firmware does not change or repair an existing seed. Every wallet generated on affected firmware remains at risk until funds are migrated to a new seed, which means the population of exposed wallets shrinks only as fast as individual owners act. TechCrunch, citing TRM Labs, places this against a backdrop of more than 200 crypto-sector hacks so far in 2026 totalling over $950 million.
The Attack Technique
Block's engineering write-up describes the mechanism precisely, while noting the caveat that its teams had not completed full empirical testing to confirm exploitability and published early because active exploitation was already under way.
Coldcard firmware contains an RNG integration error causing ngu.random to use MicroPython's deterministic Yasmarang fallback instead of the STM32 hardware RNG. The production board configuration defines MICROPY_HW_ENABLE_RNG as zero, because Coldcard supplies its own hardware-RNG wrapper. Libngu incorrectly checks whether that macro is defined rather than whether it is enabled. The build therefore succeeds silently and libngu binds to MicroPython's rng_get(), which with the macro set to zero is a Yasmarang software generator seeded from the MCU UID and timer registers. Natalie Newson, Senior Blockchain Investigator at CertiK, likewise pointed to the MICROPY_HW_ENABLE_RNG value of zero as the reason standard checks failed to catch the issue.
Consequences differ by device, per Block:
- Mk2/Mk3 v4: no cryptographic entropy is added to
ngu.random. For a known UID, timer state, and call history, wallet generation is deterministic. - Mk4/Q/Mk5: boot adds secure-element entropy but hashes it and retains only four bytes.
reseed()then replaces only one 32-bit Yasmarang state word, giving at most 2^32 securely distinguished output streams for a fixed fallback state and call history.
Coinkite's advisory corroborates the second case, stating that seeds generated on Mk4, Q, and Mk5 before the fixed firmware carry about 72 bits of entropy rather than the expected 128. Block notes that hashing the resulting 32 bytes during wallet generation cannot increase the number of possible seeds. The practical result: the search space collapses from infeasible to enumerable, and an attacker grinds candidate keys offline, checks them against the public blockchain, and sweeps whatever is funded.
The on-chain signature supports automation over manual theft. Galaxy noted every sweep paid an identical hardcoded 30.0 sat/vB, a 30x to 75x overpay against that week's 0.4 to 1.0 sat/vB median, and left no change output. In Galaxy's words, "That looks like an automated tool spending keys it already held, not owners moving funds."
What Organizations Should Do
- Migrate first, patch second. If a seed was generated on affected firmware, move the funds now. Coinkite is explicit that a firmware update does not repair an existing seed. Galaxy's public guidance on August 2 was to move Coldcard single-sig funds to safe locations immediately.
- Install the fixed firmware and match the release track. Per Coinkite: Mk2/Mk3 version 4.2.0 or later; Mk4/Mk5 standard 5.6.0 or later; Q standard 1.5.0Q or later; Mk4/Mk5 Edge 6.6.0X or later; Q Edge 6.6.0QX or later. Standard and Edge are separate tracks. Do not assume an older Edge 6.x build is fixed simply because its version number exceeds the standard release. Do not generate a new seed on any affected model until the update is installed.
- Check the two documented exceptions honestly. Coinkite states funds are at risk unless the seed was created with at least 50 fair, independent, private dice rolls, or the wallet is protected by a strong, unique BIP-39 passphrase. A passphrase reduces immediate exposure but does not repair the affected seed. Affected range for Mk2/Mk3 is version 4.0.1 (March 2021) through 4.1.9 inclusive.
- Assume you cannot self-attest. Security firms cited by CoinDesk warn that owners often cannot reliably determine which firmware generated a given seed. Where provenance is unknown, treat the seed as compromised and rotate.
- Re-derive entropy assumptions across your own build systems. The defect was a compile-time macro checked for definition rather than value, producing a successful build and a silently degraded generator. Audit any code path where a hardware entropy source has a software fallback and make fallback a hard build failure or a loud runtime error, never a default.
- Reduce single-point-of-failure key custody. The concentration of loss in single-sig wallets is the reason multisig and MPC arrangements are being reassessed. A key derived from one vendor's entropy implementation is only as strong as that implementation, which no user can independently verify.
- Monitor and report. Galaxy has forwarded roughly 600 suspected attacker addresses to federal investigators and compliance firms. Organisations holding affected assets should preserve transaction evidence and coordinate with investigators rather than acting alone.
Sources: Canada Accounts for 25% of Attributed Losses in Coldcard Wallet Exp... | COLDCARD wallet RNG flaw likely linked to $88 million ... | Hackers steal over $130 million by exploiting bug in offline hardwa... | What we know about ongoing Coldcard hack that's stolen over $100M w... | Coldcard Users Lose $89m After Bitcoin Wallet Is Hacked - Infosecur... | Coldcard Security Advisory COINKITE Blog | Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware Bl... | How bitcoin cold wallets lost $70 million in an attack that never t...