How a 2021 Coldcard firmware change made Bitcoin seeds guessable

On July 30, 2026, an attacker emptied roughly 594.48 BTC — about $38 million — from some 500 single-signature Bitcoin addresses in roughly 25 minutes, according to CoinDesk and the wallet maker Coinkite. AnchorWatch CEO and co-founder Rob Hamilton first flagged the sweep publicly. Coinkite's analysis counted 1,324 spent outputs across 500 transactions, with 562 BTC later funneled into a single address.

Every one of those wallets was a Coldcard hardware device, and every one had a seed phrase that was supposed to be effectively impossible to guess. The cause was not phishing, malware, or a stolen backup. It was a five-year-old bug in how the device generated randomness.

What actually broke

Coinkite traces the flaw to a March 2021 firmware change, version 4.0.0, that migrated seed generation to Bitcoin Core's libsecp256k1 library. In the process the code switched from the device's hardware random-number generator to a call named `ngu.random.bytes()`. A build flag meant to enable the hardware RNG, `MICROPY_HW_ENABLE_RNG`, was set to 0 but checked with `#ifndef` — which tests only whether the macro is defined, not its value.

The result, Coinkite says, is that the build silently fell back to MicroPython's 'Yasmarang' software pseudo-random generator instead of the STM32 hardware chip. Coinkite estimates the effective entropy of an affected 12-word seed at roughly 40 bits on Mk2 and Mk3 devices and about 72 bits on Mk4, Mk5 and Q — against the 128 bits such a seed is supposed to carry. That gap is the difference between uncrackable and, given enough compute, searchable.

The same weak generator touched more than seed phrases. Per Coinkite, it also affected paper-wallet private keys, device-cloning and USB-encryption keys, Key Teleport transfers, Web2FA shared secrets and Secure Notes passwords.

Who is affected

Coinkite's advisory, updated August 1, lists the vulnerable firmware as Mk2 and Mk3 versions 4.0.1 through 4.1.9; Mk4 and Mk5 before 5.6.0 (Edge before 6.6.0X); and Q before 1.5.0Q (Edge before 6.6.0QX). The swept wallets each held more than 0.15 BTC, many had sat dormant for years, and the coins spanned 2021 to 2026 — matching the age of the flaw.

The damage kept growing as analysts traced further waves. Galaxy Research dated its first wave to a 41-minute window and later raised its cumulative estimate, by August 1, to 1,367.05 BTC — about $88.6 million — across 4,585 addresses, while cautioning that attributing everything to a single attacker is an inference. Coinkite and Block disclosed early because the theft was already underway; Bitcoin Magazine and Decrypt reported Coinkite's own belief that AI tooling likely helped industrialize the key search.

The load-bearing point: updating your firmware does not repair a seed that was already generated by the flawed code. A patched device makes new seeds safely, but the old, weak seed stays weak. Coins protected only by that seed remain exposed until they are moved.

What to do now

• Check your firmware. If you own any Coldcard, confirm whether your version falls in the affected ranges above.
• Install the fixed firmware first. Coinkite shipped patched builds around July 31: Mk2/Mk3 4.2.0+, Mk4/Mk5 5.6.0+, and Q 1.5.0Q+.
• Do not stop there. A firmware update alone leaves an already-generated seed just as guessable as before.
• Generate a brand-new seed on the patched device.
• Move your funds on-chain to the new wallet. Per Coinkite, this is the only step that actually resecures at-risk coins.
• Know the exceptions. Coinkite says seeds built from at least 50 fair, independent, private (unrecorded) dice rolls, or protected by a strong, unique BIP-39 passphrase, are not considered at risk from this flaw alone.

If you are unsure whether your seed was device-generated or how it was created, treat it as at risk and migrate. The attackers have already shown they can find weak keys faster than dormant owners tend to react.

— Sources: [Coinkite (technical backgrounder)](https://blog.coinkite.com/entropy-technical-backgrounder/) · [Block Engineering](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware) · [CoinDesk](https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep) · [crypto.news](https://crypto.news/coldcard-bitcoin-losses-rise-to-88-6m-in-third-wave/)