A firmware flaw in Coldcard hardware wallets has cost Bitcoin holders over $130 million since July 30. The bug traces back to a 2021 firmware change that quietly weakened how the device gener
A firmware flaw in Coldcard hardware wallets has cost Bitcoin holders over $130 million since July 30. The bug traces back to a 2021 firmware change that quietly weakened how the device generated private keys. In response, a growing number of Bitcoin users are ditching hardware-generated randomness and going back to dice.
Coldcard devices, made by Toronto-based Coinkite, were built with STM32 chips that include a hardware-based true random number generator. That component draws on physical processes inside the chip to produce unpredictable seed phrases, the 12 or 24 word strings that control a Bitcoin wallet.
Starting with firmware version 4.0.1, released in March 2021, the device stopped properly using that hardware generator. Instead it fell back on MicroPython's Yasmarang pseudorandom number generator, a software routine that produces far more predictable output.
Security researchers at Block estimated the resulting seeds carried only 40 bits of entropy on Mk2 and Mk3 models, and roughly 70 bits on Mk4, Mk5, and the Q. A secure 12-word seed needs 128 bits. That gap made brute-forcing private keys mathematically feasible.
Coinkite disputes that this was a deliberate fallback. Bitcoin journalist Hodlnaut has argued the bug likely came from careless coding rather than an intentional flaw. Some users on X have raised the possibility of a backdoor, though no evidence confirms that theory.
Attackers began sweeping funds on July 30, draining roughly 1,082 BTC worth about $70 million from nearly 1,200 addresses in a 41-minute window, according to Galaxy Research. A second wave the next day pushed losses to $75 million. A third wave on August 2 brought the total to $89 million across 4,585 addresses.
By August 3, a fourth wave lifted the figure to about $116 million from over 5,200 addresses, with Galaxy Research noting the sweep rate hit 45 times the pre-incident baseline. TechCrunch later put combined estimates from multiple monitoring firms above $130 million, with signs that more than one attacker group is involved.
James O'Beirne set up a tracking site called cktripwire, using honeypot addresses to see which wallet types attackers target successfully. The pattern is clear: wallets relying purely on Coldcard's built-in randomness are vulnerable. Wallets built with extra dice-based entropy, or protected by a BIP-39 passphrase and a nonstandard derivation path, have largely stayed safe.
Despite the scale of the theft, Bitcoin and Ethereum prices moved less than 1% in the days following disclosure. TRM Labs data shows this fits a broader pattern, with over 200 crypto hacks in the first half of 2026 alone, though total losses this year remain below 2025's pace.
The core lesson circulating among Bitcoin holders is old but newly urgent: don't trust, verify. A hardware random number generator is a black box. Verifying it properly means inspecting the chip and auditing the firmware, work almost no ordinary user can do.
Dice offer the opposite. Anyone can watch dice fall, record the results, and understand exactly how those results turn into a seed phrase. That transparency removes a single point of failure that a hidden software bug can exploit.
The most common method converts roughly 100 dice rolls into entropy for a 24-word seed phrase, cross-checked with a SHA-256 hash. Simpler paper tools, like a lookup table published by wallet maker Bitbox, let users pair six dice rolls and a coin flip with a specific BIP-39 word, no electronics involved.
More advanced approaches exist too. The codex32 worksheet uses a von Neumann extractor, a manual technique that can correct for biased dice and still produce secure results. Some users skip dice entirely, printing BIP-39 words on paper, cutting them up, and drawing them at random, a method products like Seedsticks and Entropia are built around.
Hardware projects such as Frostsnap try to split entropy generation across multiple devices, so no single unit holds full control over the outcome. None of these methods eliminate the need to trust something eventually, but they shrink the range of places where trust is required.
Once a seed phrase is generated through physical entropy, users can still cross-check their setup. Importing the resulting extended public key into a second device confirms the receiving addresses match. Signing an identical transaction on two separate devices and checking for the same RFC 6979-compliant signature can catch a nonce leak even across an airgap.
None of this fixes wallets that were already generated under Coldcard's flawed firmware. As former Binance CEO Changpeng Zhao noted, developers can patch future firmware, but they cannot reach into wallets already created on isolated devices. Users who never learn about the bug remain exposed indefinitely.
Coinkite has confirmed the flaw affects Mk3 through Q models built after the March 2021 update and is urging affected users to move funds immediately. For the broader self-custody community, the episode has not ended the practice of holding your own keys. It has instead pushed serious users toward removing hardware as the last word on randomness, and putting that responsibility back in their own hands.
