Coldcard’s dual secure element chips were never broken into. The theft that hit Coldcard wallets from 30 July 2026 exploited a flaw one layer below the chip, in the software that manufactures
Coldcard’s dual secure element chips were never broken into. The theft that hit Coldcard wallets from 30 July 2026 exploited a flaw one layer below the chip, in the software that manufactures the seed before that seed is ever handed to the secure element for safekeeping, according to BIT’s technical review of the incident published 7 August 2026. A secure element can be flawless at resisting physical extraction and still guard a key that was weak from the moment it was born.
Coldcard is built by the Canadian firm Coinkite. Its two secure elements, a Microchip ATECC608 and a Maxim DS28C36B, are tamper-resistant chips meant to survive lab-grade extraction attempts, per BIT. The seed those chips store, though, has to come from somewhere, and that is where the fault sat.
According to a report from Block cited by The Hacker News on 1 August 2026, Coldcard’s production configuration set a macro called MICROPY_HW_ENABLE_RNG to zero, because Coinkite supplies its own hardware-RNG wrapper. A supporting library, libngu, checked only whether that macro existed rather than whether it was switched on, which bound the firmware to MicroPython’s fallback random number generator, known as Yasmarang. CoinDesk’s report, published 31 July 2026, describes the same defect: a build setting told the device to skip its hardware randomness generator, and a check in a supporting library tested only whether the setting existed, not whether it was active. Block traced the change to a commit dated 1 March 2021, per CoinDesk.
Outlets differ slightly on what fed that fallback generator. The Hacker News, citing Block, says it was initialised from the device’s unique ID and timer registers and collected no fresh entropy afterward. CoinDesk describes the same inputs as the chip’s serial number and clock registers, calling them non-secret. BIT’s account, published 7 August 2026, describes two Yasmarang instances XORed together, with one seeded from public, hardcoded constants. The outlets are not contradicting each other on the outcome, only on how precisely each traced the internal detail, which is itself a reminder that this is one incident being reconstructed from the outside by several independent technical teams, not one being explained by Coinkite line by line in public.
The practical result, per Coinkite’s own estimate as cited by The Hacker News, BIT and crypto.news, is that seeds built under the bug carry roughly 40 bits of effective entropy on the Mk2 and Mk3, and roughly 72 bits on the Mk4, Mk5 and Q, against a 128-bit design target for a standard BIP-39 seed. Block itself, per The Hacker News, declined to give one practical brute-force figure, setting conditional ceilings and warning that the higher of the two is not equivalent to genuine 73-bit cryptographic security. No public report in evidence has published a brute-force benchmark, and none has reconstructed a specific victim’s seed and matched it to a drained address, per The Hacker News.
BIT’s review states the boundary directly: the secure element “does not verify that the seed was generated with sufficient randomness” in the first place. It protects a seed after creation. It has no way to judge whether the seed was any good when it arrived.
That boundary matters for comparing wallets. Coldcard’s two-chip design means an attacker attempting physical extraction has to beat two independently sourced chips plus the main processor, a higher bar than a single-element design, according to BIT. Ledger and Trezor, per BIT, use a single secure element each. A comparison published by Spark Money, which carries no publication date in the version reviewed for this article, describes Ledger’s chips as STMicroelectronics parts certified to Common Criteria EAL5+ or EAL6+ depending on model, and Trezor’s Safe 3 and Safe 5 as using Infineon’s OPTIGA Trust M. The same Spark Money comparison states that Trezor’s secure element documentation is public, so independent researchers can audit it, while Ledger’s secure element firmware remains closed under a non-disclosure agreement with STMicroelectronics, even though Ledger’s application-layer software is largely open. Coldcard, by contrast, publishes its firmware source in full, per Spark Money and BIT alike.
None of that openness stopped the March 2021 error from running undetected for over five years. Coldcard’s firmware being auditable did not mean it was, in fact, audited closely enough to catch this specific class of bug: a guard that checks whether a setting is defined instead of what it is set to. That is the limit a secure element, and open-source firmware generally, cannot close on its own.
Five outlets in evidence give five different numbers for the same unfolding event, and none of them is simply wrong; they are snapshots taken at different times using different methods.
The gap between these figures is mostly a gap in scope and cutoff date, not disagreement about facts. CoinDesk and crypto.news describe the opening sweep only. The Hacker News and BIT describe cumulative totals as Galaxy Research kept mapping addresses over subsequent days. Galaxy Research itself, per The Hacker News, cautioned that its findings rest on on-chain pattern analysis and that it has not computationally confirmed every flagged address was actually generated with weak Coldcard entropy. It also said the activity remained ongoing as of its update, and that it had reported roughly 600 suspected attacker-controlled addresses to investigators, which means the total in any of these figures could move again.
No source in evidence gives one settled loss figure. Treat 594 BTC, 1,082.65 BTC, 1,367.05 BTC and 1,816 BTC as measurements at different dates and different scopes, not as competing final answers.
Coinkite’s own claim that an attacker likely used AI to find the flaw, and that its own AI review of the same code weeks earlier found nothing serious, is reported by crypto.news, which itself calls the claim “plausible but unverified.” No independent confirmation of that attribution appears in the evidence reviewed here.
No public report has reconstructed a specific stolen seed and matched it to a drained address, per The Hacker News. The pattern Galaxy Research used to attribute waves to a common operator identifies transaction behaviour, not a confirmed cause, and Galaxy explicitly declined to treat Wave 3 as linked to Waves 1 and 2.
Coinkite’s own advisory names Mk3 firmware 4.0.1 through 4.1.9 as the vulnerable range and does not name Mk2. Block’s separate analysis, per The Hacker News, places both Mk2 and Mk3 versions 4.0.0 through 4.1.9 on the vulnerable path, a broader range than Coinkite’s own advisory covers, and this page cannot say which scope is definitive.
This page also cannot tell a reader whether Ledger’s or Trezor’s seed-generation code has had the same kind of outside technical review Block conducted on Coldcard’s, because no equivalent report is in the evidence gathered here. crypto.news reported on 1 August 2026 that Block, Trezor and Ledger had confirmed their own products were unaffected by this specific flaw, which is a statement about this bug, not a general audit of either company’s randomness code.
Every fact above is attributed to one of these reports. Where they disagree, the article says so.
The post Coldcard vs Ledger: what a secure element protects, and why it didn’t stop the theft appeared first on TheCoinrise.com.
