How a Firmware Flaw Compromised Coldcard Bitcoin Wallets, Leading to $70 Million in Losses

The vulnerability began in March 2021 with the release of Coldcard firmware version 4.0.0. The flaw remained in several models for more than five years. Attackers exploited the security gap in July 2026.

1. Coinkite issued emergency firmware updates on July 31, 2026. The patches fix a configuration error that previously bypassed the device's hardware random number generator.

2. The manufacturer instructed users to secure their remaining assets. Users must generate new seeds on the patched firmware to prevent private key prediction.

3. Not every user faces this vulnerability. Coinkite confirmed that seeds generated using at least 50 independent, private dice rolls remain secure from this exploit.

4. Coinkite expanded its list of affected hardware beyond the initial warning for the Mk3. The affected devices include Mk2 and Mk3 units running versions 4.0.0 through 4.1.9. The list also covers Mk4 and Mk5 units with software versions before 5.6.0, as well as Q models with versions before 1.5.0Q.

1. A software vulnerability exposed users for more than five years. Developers introduced the flaw in March 2021. Thousands of digital wallets operated with predictable entropy during this period.

2. The firmware contained a flaw in its random number generator. It relied on a software-based pseudorandom number generator seeded by device IDs and timer registers. These inputs are not secret.

3. Attackers drained 1,082.65 BTC from 1,196 wallets on July 30, 2026. The unauthorized transfer occurred between 01:10 and 01:51 UTC. This operation lasted 41 minutes.

4. Attackers identified targets using external blockchain data. During the theft, they reportedly queried a blockchain data provider to identify vulnerable wallets via source addresses.