A configuration mistake introduced into Coldcard's firmware in March 2021 quietly disabled the hardware random number generator on one of Bitcoin's most trusted cold-storage devices, and on 3 August 2026 the resulting theft entered its fourth organised wave. Galaxy Research tracked roughly 448.73 BTC moving out of victim wallets in 218 transactions across about 2.5 hours, bringing the running total since 30 July to approximately 1,816 BTC — worth around 115 million US dollars — taken from more than 5,200 addresses.
Manufacturer Coinkite published an emergency security advisory and shipped patched firmware for every affected model on 31 July. The patch closes the hole for new seeds. It does nothing for the ones already generated.
Key Highlights
- A single 2021 build-configuration error routed Coldcard seed generation to a deterministic software pseudo-random generator instead of the STM32 hardware RNG.
- Coinkite estimates effective seed entropy fell to about 40 bits on Mk3 devices and about 72 bits on Mk4, Mk5 and Q — against a 128-bit target for a 12-word BIP-39 seed.
- The first sweep on 30 July drained 1,196 addresses in 41 minutes, taking 1,082.65 BTC, then worth about 70.2 million dollars.
- Patched firmware — 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, 1.5.0Q for Q, with matching Edge builds — does not repair an existing seed. Affected users must generate a new one and move their coins.
- Coldcard co-founder Rodolfo Novak, known as NVK, attributed the discovery climate to AI-assisted code review, warning that frontier models now surface latent bugs faster than veteran human auditors.
What Actually Broke
The failure was not a cryptographic break. It was a build flag that nobody checked.
Coldcard's production configuration defines the MicroPython macro that enables the built-in RNG as zero, because Coinkite supplies its own wrapper around the STM32 hardware peripheral. The libngu library, however, tested whether that macro was defined rather than whether it was enabled. Seeing the symbol present, the build silently fell back to MicroPython's Yasmarang pseudo-random generator.
That fallback seeds itself once, from the chip's unique ID and a handful of timer registers, and collects no fresh entropy afterwards. A commit dated 1 March 2021 changed the seed-generation call from the hardware path to the library path, and from that day every affected device produced seed phrases drawn from a search space small enough to enumerate.
The financial-technology firm Block traced and disclosed the fault to Coinkite in late July. Public discussion began on the afternoon of 30 July; fixed firmware landed at 9:33 a.m. EDT on 31 July.
Who Is Exposed
Coinkite's advisory lists affected ranges by model: Mk2 and Mk3 on versions 4.0.1 through 4.1.9, Mk4 and Mk5 Standard before 5.6.0, Mk4 and Mk5 Edge before 6.6.0X, Q Standard before 1.5.0Q, and Q Edge before 6.6.0QX. The TAPSIGNER, OPENDIME and SATSCARD product lines are not affected.
The company's own risk test is blunt: funds are at risk if the seed was created without at least 50 independent, private dice rolls and the wallet is not protected by a strong, unique BIP-39 passphrase. Users who supplied their own dice entropy are outside the blast radius of this particular bug. Passphrase users get a second barrier that the attacker must still guess, but Coinkite is explicit that a passphrase "does not repair the affected seed" and that those holders should migrate as soon as practical.
The company also told users not to generate any new seed on an affected model until the update is installed, destroyed vulnerable inventory, and halted shipments while the fix propagated.
Why It Keeps Happening
Each wave is a batch of the attacker working through recomputed keys. Galaxy Research's Alex Thorn flagged the fourth wave while transactions were still sitting unconfirmed, posting that similar transactions remained in the mempool and that previously confirmed ones signalled RBF opt-in — a narrow window in which some victims could still outbid the thief and rescue their coins.
Galaxy has reported roughly 600 suspected attacker-controlled addresses to federal investigators and compliance firms. Researchers tracking the sweeps expect every vulnerable, unmigrated seed to be drained eventually, because the attacker does not need to breach anything: the keys were always derivable.
Loss estimates published over the past four days range from 88.6 million dollars across 4,585 addresses to about 118 million across 5,294, depending on the snapshot and the Bitcoin price used. All of them are floors, not final counts.
The AI Angle
The most uncomfortable detail for engineering teams has little to do with Bitcoin. Novak framed the episode as "a sober reality of the new AI paradigm," warning that AI-assisted code review can now find latent bugs at a speed outpacing even the industry's most seasoned experts, and advising developers to assume their codebases are being audited simultaneously by attackers and defenders running frontier models.
The bug survived five years of open-source scrutiny on a device marketed specifically on the strength of its auditability. What changed in 2026 was not the code. It was the cost of reading it carefully.
That inverts a comfortable assumption behind a lot of security posture. "Nobody has found it in five years" has quietly stopped being evidence of anything — for wallet firmware, and for any dependency-heavy codebase where a build-time fallback can substitute a weaker primitive without emitting a single warning.
What's Next
Coinkite has committed to a technical backgrounder on the entropy failure and continues to publish advisory updates. For holders, the remediation path is unchanged and urgent: update firmware, generate a fresh seed on the patched device, verify the backup and the receive address on-screen, send a test transaction, then move the remaining balance and retain the old backup until migration is confirmed.
For everyone else, the durable lesson is a testing one. A random number generator that has silently degraded still returns bytes, still passes functional tests, and still ships. Verifying that entropy comes from the source you think it does — at build time, on the device, in CI — is the check this incident says nobody was running.
Source: Coinkite Security Advisory