Coldcard seed bug led to theft of at least 1,596 BTC

Coinkite, maker of the Coldcard hardware wallet, published a technical bulletin describing a firmware error that routed seed generation to a software pseudo-random number generator instead of the device’s hardware random number generator. The company said the change occurred during a 2021 migration of cryptographic code and persisted until it was found in 2026.

The fault stemmed from a build-time configuration check using the C preprocessor #ifndef with a flag set to zero. Because zero counted as defined, the build did not call the hardware entropy source and fell back to MicroPython’s Yasmarang software generator. On older boards the software generator used predictable inputs such as the device serial number and clock state for its seed.

Coinkite estimates devices affected include Mk2 and Mk3 units running firmware versions 4.0.1 through 4.1.9. On those devices the effective entropy dropped to roughly 40 bits. Newer models that mixed some secure-element randomness into the process had an effective entropy of about 72 bits. The intended security level for seed generation is 128 bits.

A lower bit count reduces the number of possible keys by powers of two. At 128 bits the key space is extremely large; at 40 bits the space is on the order of one trillion possibilities, a range that can be brute-forced by modern hardware. Coinkite and independent analysts concluded the reduced entropy allowed attackers to reconstruct private keys for Coldcard-generated addresses.

Security teams tracking on-chain activity reported three confirmed waves of theft that together removed at least 1,596 BTC from roughly 7,300 addresses. Additional suspected incidents could raise the total to about 2,055 BTC, equivalent to roughly $130 million at recent prices. One concentrated sweep moved approximately $70 million in 41 minutes. Coinkite reported that at least 15 distinct actors have been involved.

Coinkite released fixed firmware for all affected models and provided step-by-step guidance: update firmware, generate a new seed on corrected firmware, verify the device fingerprint, send a small test transaction, then move funds from compromised addresses. The company warned that updating firmware does not change existing seeds; exporting a seed preserves the original weakness and moving a compromised seed to another wallet does not make it secure.

Coinkite’s advisory treats seeds produced with at least 50 independent private dice rolls as not vulnerable to the bug. A developer warned that common dice can have bias and recommended precision dice if used. An analyst calculated that even noticeably biased six-sided dice still yield about 2.55 bits per roll and that 99 rolls provide well over 250 bits of entropy.

The bulletin noted public code reviews had confirmed the presence of a hardware RNG in the source but did not verify at runtime whether the seed generator actually invoked it. Coinkite added: “Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.”