Coldcard Weak-Entropy Seed Exploit

Beginning July 30, 2026, attackers systematically drained Bitcoin from Coldcard hardware wallets, extracting roughly 1,816 BTC (~$116 million) from more than 5,200 addresses across four waves. The root cause was not a compromised device or a phishing lure but a five-year-old firmware build error that quietly weakened the randomness behind users' wallet seeds — making the private keys brute-forceable offline, without ever touching the hardware.

What happened

A firmware build shipped in March 2021 (version 4.0.1) set the compile-time macro MICROPY_HW_ENABLE_RNG to zero. With the flag disabled, Coldcard seed generation fell back on MicroPython's software pseudo-random number generator instead of the device's hardware true random number generator. The practical effect was catastrophic: the entropy behind an affected seed collapsed from the intended 128 bits to as little as ~40 bits — a key space small enough to enumerate on commodity GPUs.

Attackers exploited this entirely off-chain. They derived candidate seeds from the weakened generator, computed the corresponding addresses, matched them against the public Bitcoin ledger, and reconstructed the private keys for any funded wallet. Galaxy Research traced the first wave to 1,082.65 BTC stolen from 1,196 addresses in a 41-minute window — roughly $70 million drained before Coinkite's public advisory even landed. Three further waves followed over the next several days. On-chain patterns suggested multiple independent actors were exploiting the same flaw in parallel; TRM Labs declined to attribute the theft to any single group.

Aftermath

• Coinkite disclosed the flaw and shipped patched firmware on July 30, 2026, but the fix only protects newly generated seeds. Any wallet created on the affected firmware between March 2021 and the patch remains permanently exposed, so users were urged to generate a fresh seed and migrate funds immediately.
• Laundering activity concentrated in early August, including a 64.9 BTC deposit to Wasabi and 200 ETH routed through Tornado Cash.
• The incident stands as the third-largest crypto theft of 2026 and the dominant loss of the month, dwarfing the DeFi protocol exploits reported over the same period.

Why it matters

Coldcard is a stark reminder that key strength is only as good as the randomness that produced it — a lesson that echoes Wintermute, where the Profanity vanity-address tool seeded keys from a 32-bit space and let an attacker brute-force a live admin wallet. It also mirrors the mass wallet-tooling drains of Slope Wallet and Atomic Wallet: when a single library or firmware defect touches thousands of self-custodied wallets, the blast radius is the entire user base, not one protocol. Most sobering, the flaw sat dormant for five years before being weaponized — proof that a silent entropy regression can be far more dangerous than a loud smart-contract bug, because there is no on-chain trace until the keys are already broken.