Nearly $40 Million in Bitcoin Stolen After COLDCARD Seed Generation Flaw Exposes Hundreds of Wallets

One of the largest hardware wallet security incidents in recent years has sent shockwaves through the Bitcoin community after approximately 594.48 BTC, worth roughly $38 million at the time of the theft, was drained from around 500 wallets in what appears to have been a highly coordinated attack. Blockchain data shows the attacker consolidated funds from 1,324 transaction outputs over a span of roughly 25 minutes, distributing the theft across only three Bitcoin blocks before consolidating hundreds of bitcoin into a single address.

Unlike many cryptocurrency thefts, the attacker did not compromise exchanges, deploy malware, exploit smart contracts, or physically access hardware wallets. Instead, the attack appears to have targeted something far more fundamental: the cryptographic randomness used when generating wallet recovery seeds.

Following the incident, hardware wallet manufacturer Coinkite, the company behind the popular COLDCARD Bitcoin hardware wallets, published an emergency security advisory warning users that seeds generated on affected firmware versions may be vulnerable. While the company has not officially confirmed that the observed theft was caused by this specific flaw, it has urged affected users to migrate funds immediately rather than wait for the ongoing investigation to conclude.

The advisory marks an extraordinary moment for a product widely regarded as one of the most security-focused Bitcoin hardware wallets available. Even more striking is that the underlying firmware has always been open source, demonstrating once again that source code transparency alone cannot guarantee vulnerabilities will be discovered before attackers exploit them.

What happened?

According to Coinkite, every COLDCARD Mk3 running firmware 4.0.1, first released in March 2021, through the latest Mk3 firmware contains a flaw affecting device-generated entropy during wallet creation. The company has since expanded its advisory, confirming that the issue also impacts Mk4, Mk5 and Q devices that generated seeds before newly released firmware updates, although the security impact differs significantly between hardware generations.

For Mk3 devices, the problem is severe enough that Coinkite recommends assuming all affected device-generated seeds are at risk unless users added sufficient independent entropy during wallet creation or protected the wallet using a strong BIP-39 passphrase.

The company further emphasized that installing updated firmware does not repair wallets whose seeds were already generated using affected firmware. The vulnerability exists in the randomness that originally created the wallet, meaning the weakness becomes permanently embedded in the recovery seed itself. Once a weak seed has been generated, no software update can retroactively increase its entropy. Users must instead generate an entirely new seed on fixed firmware and migrate funds using an on-chain transaction.

Why randomness is everything in Bitcoin security

To understand why this incident is so significant, it is necessary to understand how Bitcoin wallets generate private keys.

Modern Bitcoin wallets typically follow BIP-39, a standard that converts cryptographically secure random numbers into a list of human-readable recovery words. Most users encounter these as a 12-word or 24-word recovery phrase.

These words are not chosen from a dictionary at random. Instead, the wallet first generates a large random binary number known as entropy. For a 24-word mnemonic, the wallet produces 256 bits of entropy, appends an eight-bit checksum derived from SHA-256, and divides the resulting 264 bits into twenty-four groups of eleven bits. Each eleven-bit value indexes one of 2,048 predefined English words.

Although users only see twenty-four ordinary words, those words encode the complete cryptographic secret protecting every Bitcoin address derived from that wallet. The security of the wallet therefore depends almost entirely on one assumption: the original random number must be unpredictable.

If an attacker can predict or substantially reduce the possible values that could have been generated, recovering the corresponding private keys becomes dramatically easier. This is why hardware wallet manufacturers devote enormous engineering effort to random number generation.

What is entropy?

In cryptography, entropy measures unpredictability rather than complexity.

A perfectly random 128-bit value has 2¹²⁸ possible combinations.

That number is unimaginably large:

2¹²⁸ ≈ 340,282,366,920,938,463,463,374,607,431,768,211,456 possibilities.

Searching that space with any existing or foreseeable computing technology is effectively impossible. Increasing to 256-bit entropy expands the search space beyond practical comprehension. Conversely, reducing entropy has exponential consequences. A reduction from 128 bits to 72 bits is not a 44 percent reduction in security. Instead, the search space shrinks by a factor of 2⁵⁶, making brute-force attacks incomparably more feasible for well-funded adversaries.

The situation becomes even more severe if entropy falls toward approximately 40 bits, as early community analysis suggests may have occurred for affected Mk3 devices. A 40-bit search space contains roughly 1.1 trillion possibilities, enormous for consumer hardware but within reach of distributed GPU clusters, FPGA farms, or specialized infrastructure over time. Community researchers believe this substantially reduced entropy is what made practical key recovery possible, although Coinkite has not yet published its complete technical analysis.

Importantly, the wallet software still displayed a perfectly valid twenty-four-word recovery phrase. Nothing appeared unusual. Nothing warned users. The weakness existed entirely beneath the surface because the randomness used to generate those words was no longer as unpredictable as intended.

The flaw inside COLDCARD’s seed generation

Although Coinkite has not yet released its full postmortem, the advisory identifies the root problem as affecting device-generated entropy.

Update: According to the company, the issue originated during a 2021 migration to Bitcoin Core’s libsecp256k1 library. During that transition, COLDCARD’s seed generation code inadvertently began using MicroPython’s software random number generator instead of the device’s dedicated hardware random number generator.

The mistake occurred because both random number generator functions shared the same name. During the build process, the incorrect implementation was silently selected without triggering compiler warnings or build errors. As a result, the firmware continued to generate valid BIP-39 recovery phrases that appeared completely normal, despite containing significantly less entropy than intended. Coinkite stated that the bug remained undetected because the generated values looked sufficiently random during routine testing, masking the underlying weakness.

Random number generation inside hardware wallets generally combines multiple independent entropy sources before producing a seed. These commonly include hardware random-number generators, secure elements, analog noise, oscillator jitter, timing variations and additional software conditioning designed to ensure no single entropy source can completely determine the output. If implemented correctly, compromising one source should not completely compromise the final random value.

According to Coinkite, firmware beginning with version 4.0.1 introduced a defect that reduced the effective entropy available during seed generation. The exact implementation details remain under investigation, but the company states that Mk3-generated seeds may contain substantially less randomness than intended, while Mk4, Mk5 and Q devices generated approximately 72 bits of entropy instead of the expected 128 bits before fixed firmware became available.

Later hardware generations still incorporated additional entropy sources unavailable to Mk3 devices, making large-scale key recovery considerably more difficult. Nevertheless, Coinkite concluded that even 72-bit effective entropy falls below acceptable security margins for long-term Bitcoin storage and therefore instructed all affected users to regenerate their wallets after updating firmware.

Device Impact

The severity of the vulnerability varies depending on the COLDCARD hardware model.

The COLDCARD Mk3 is the most severely affected. Recovery seeds generated on firmware 4.0.1 through the vulnerable releases are estimated to provide an effective search space of approximately 40 bits, dramatically below the intended 128-bit security level. Users who generated wallets on these firmware versions should migrate their funds immediately.

Newer devices, including the COLDCARD Mk4, COLDCARD Q, and COLDCARD Mk5, incorporated additional entropy from their SE1 and SE2 secure elements during seed generation. While this increased the effective search space to roughly 72 bits, it still falls well short of the intended security target and remains vulnerable to sufficiently resourced attackers.

Why Mk3 appears significantly more vulnerable

The public advisory treats all affected devices seriously, but it also distinguishes between the practical impact across hardware generations. Mk3 devices appear to have suffered the greatest reduction in entropy, while Mk4, Mk5 and Q retained additional randomness from newer hardware architecture.

Community analysis indicates that Mk3 wallets may ultimately have been left with only around 40 bits of effective entropy, although Coinkite has not yet confirmed the precise value pending completion of its investigation. That difference explains why the large-scale theft currently appears concentrated around Mk3 wallets despite the broader firmware advisory.

From an attacker’s perspective, every additional entropy bit doubles the amount of computation required. Moving from roughly forty bits toward seventy-two bits increases the computational effort by approximately 2³², or more than four billion times. That enormous increase likely explains why attackers appear to have prioritized the weakest targets first.

Why open source didn’t prevent this

One of the most surprising aspects of this incident is that COLDCARD firmware has always been open source. Open-source software is frequently promoted using the principle of “don’t trust, verify.” The idea is simple: if anyone can inspect the source code, security flaws should be discovered and corrected more quickly than in proprietary software.

Reality is more complicated. Publishing source code does not guarantee continuous expert review. Hardware wallet firmware is an especially specialized field involving embedded systems, cryptographic engineering, secure boot mechanisms, entropy collection, hardware random-number generators, secure elements and side-channel resistance. Very few developers possess expertise across all of these disciplines simultaneously.

As a result, subtle security regressions can remain unnoticed despite complete public visibility. This incident illustrates an uncomfortable but important lesson for the security community: transparency significantly improves security, but it is not a substitute for formal review, extensive auditing and ongoing cryptographic validation.

One of the most important details in Coinkite’s advisory is that updating the firmware alone does not make an affected wallet safe. That distinction has caused considerable confusion, particularly among users who assume installing the latest firmware automatically removes the risk.

The firmware update fixes the defect in future seed generation, but it cannot change the cryptographic material that already exists.

When a hardware wallet creates a new wallet, the random seed is generated once and becomes the root secret from which every private key, public key and Bitcoin address is deterministically derived. This follows the hierarchical deterministic (HD) wallet model defined by BIP-32, where a single master seed is used to derive an effectively unlimited number of child keys.

If the original master seed contains insufficient entropy, every key derived from it inherits that weakness. Installing corrected firmware afterwards does not regenerate those keys or increase their randomness. The only effective remediation is to create an entirely new wallet using fixed firmware and transfer funds to addresses derived from the newly generated seed.

That is why Coinkite’s advisory repeatedly instructs affected users to migrate, not simply update.

Why a BIP-39 passphrase changes the attack model

The advisory also distinguishes between a wallet’s recovery seed and its BIP-39 passphrase, which are often confused. A BIP-39 passphrase, sometimes referred to as the “25th word,” is not part of the mnemonic itself. Instead, it is combined with the recovery phrase using the PBKDF2 key derivation function to produce a completely different master seed. The same 24 words can therefore generate entirely different wallets depending on the passphrase supplied. This creates an additional layer of security. Even if an attacker successfully reconstructs the original mnemonic, they still cannot derive the correct wallet without also knowing the passphrase.

However, the effectiveness of this protection depends entirely on the quality of the passphrase. A short phrase, dictionary word, famous quotation, reused password or predictable pattern offers far less protection than a long, randomly generated secret. For that reason, Coinkite advises users not to assume a weak passphrase provides meaningful protection. Even users who employed a strong BIP-39 passphrase are encouraged to migrate to a newly generated seed as soon as practical rather than relying on the passphrase indefinitely.

It is equally important to distinguish the BIP-39 passphrase from the COLDCARD PIN. The device PIN protects physical access to the hardware wallet, but it does not alter the underlying cryptographic seed. If an attacker is able to reconstruct the mnemonic through reduced entropy, the PIN provides no protection because the attack occurs entirely offline without interacting with the physical device.

Why dice-generated entropy remained secure

One of the more reassuring aspects of the advisory concerns users who manually supplemented wallet generation with dice rolls. COLDCARD allows users to contribute their own entropy by entering the results of repeated rolls from a fair six-sided die. Rather than relying exclusively on the device’s internal random number generator, the firmware combines the user-supplied randomness with device-generated entropy during seed creation. Because the vulnerability only affected the device-generated entropy, sufficiently random and independent dice rolls continue to provide cryptographic protection.

According to Coinkite, entering 50 to 98 independent private dice rolls contributes at least 128 bits of entropy, while 99 or more rolls contribute approximately 256 bits. Assuming the rolls were genuinely random, kept private and never recorded digitally, the resulting seed is not considered vulnerable to this RNG issue alone. Users who entered fewer than 50 rolls, cannot remember how many were used, or are uncertain whether the rolls remained private are advised to migrate to a new wallet.

The company also documents an advanced recovery option for users who possess only a Mk3 device. Firmware version 4.1.9 includes a dedicated Import Existing → Dice Rolls workflow that derives a seed directly from manually entered dice values without relying on the affected random number generator. Because this procedure involves alternating between old and new seeds on a single device, verifying wallet fingerprints, restoring backups and confirming test transactions before transferring remaining funds, Coinkite recommends it only for experienced users who fully understand the process.

Dice Rolls and BIP-39 Passphrases May Not Be Enough

Some users manually strengthened their wallets by adding dice rolls during seed generation or protecting their wallets with a BIP-39 passphrase.

While these measures improve security, Coinkite advises affected users to strongly consider migrating unless they are certain they added at least 100 fair, independent dice rolls when creating their original seed. For most users, generating a fresh wallet remains the safest course of action.

How could attackers exploit reduced entropy?

Neither Coinkite nor independent researchers have publicly released an exploitation tool or full technical methodology, and the company has not confirmed that the observed theft resulted from this specific firmware flaw. Nevertheless, understanding the underlying cryptographic principles helps explain why reduced entropy is so dangerous.

Under normal circumstances, brute-forcing a correctly generated 256-bit Bitcoin seed is computationally infeasible. The number of possible combinations is so vast that it remains beyond the reach of modern computing. Reduced entropy changes that equation dramatically.

If an implementation flaw limits the number of possible seeds to a much smaller search space, an attacker no longer needs to search the entire 256-bit keyspace. Instead, they can focus only on the subset of values that could realistically have been produced by the vulnerable firmware.

For each candidate seed, software can deterministically derive the corresponding BIP-32 master key, generate standard Bitcoin address paths, and compare those addresses against the public Bitcoin blockchain. Since all Bitcoin transactions are publicly visible, attackers do not need to compromise a device or intercept network traffic. They simply derive addresses offline until they identify wallets that contain funds.

Once the correct seed is recovered, spending those funds requires only valid cryptographic signatures generated from the reconstructed private keys.

This type of attack leaves no forensic evidence on the victim’s hardware wallet because the device itself is never accessed. The attack is directed entirely at the mathematics underpinning the wallet’s seed generation.

AI May Have Helped Discover the Bug

In its technical write-up, Coinkite also acknowledged that artificial intelligence may have played a role in helping the attacker identify the vulnerability.

Interestingly, the company revealed that it had previously used AI tools to review its own codebase, but those reviews failed to detect the flaw. The incident highlights both the growing effectiveness of AI-assisted vulnerability research and the continued importance of comprehensive manual code reviews and security audits.

The coordinated theft

Blockchain observers noted that approximately 594.48 BTC was transferred from roughly 500 wallets during a highly coordinated operation lasting around 25 minutes. The stolen funds originated from 1,324 transaction outputs before being consolidated into a smaller number of addresses, with more than 562 BTC reportedly aggregated into a primary destination wallet.

The speed of the operation suggests careful preparation rather than opportunistic exploitation.

Rather than discovering wallets individually, the attacker appears to have identified a large set of vulnerable private keys in advance before executing synchronized transactions within a narrow time window. Such coordination reduces the opportunity for victims to notice suspicious activity and move funds before the remaining wallets are drained.

Although some reports have speculated that the attacker subsequently attempted to obscure the trail through additional transactions, Coinkite has not linked any specific laundering activity to the incident, and publicly attributing later fund movements would be premature without blockchain analysis confirming that relationship.

Likewise, while the timing strongly suggests a connection between the advisory and the observed thefts, Coinkite has deliberately stopped short of stating that the RNG flaw has been conclusively identified as the root cause. The company continues to describe its investigation as ongoing, and additional technical findings are expected in a future postmortem.

Who is affected?

Based on Coinkite’s current guidance, users should evaluate their wallets according to the firmware version that generated the recovery seed rather than the version currently installed.

Seeds generated on COLDCARD Mk3 using firmware 4.0.1 or later should be considered potentially vulnerable unless they were protected by at least 50 independent private dice rolls or a sufficiently strong BIP-39 passphrase.

Seeds generated on Mk4 or Mk5 before firmware 5.6.0, and on COLDCARD Q before firmware 1.5.0Q, should also be regenerated after installing the fixed firmware, as these devices produced less entropy than intended.

Coinkite confirmed that TAPSIGNER, SATSCARD, and OPENDIME are not affected, as they are based on different codebases and do not share the vulnerable implementation.

What users should do now

For affected users, the recommended response is straightforward but should be carried out carefully to avoid introducing new risks during migration.

First, verify that the device is running the corrected firmware appropriate for the hardware model. Next, generate an entirely new recovery seed, record and verify the backup, confirm a receive address directly on the device’s screen, and perform a small test transaction before transferring the remaining balance. The previous seed backup should not be destroyed until the migration has been fully verified and all funds have been successfully moved.

Users relying on a Mk3 as their only available device should follow Coinkite’s documented migration procedures with particular care. Rushing a wallet migration or making backup errors can result in permanent loss of funds that is entirely unrelated to the vulnerability itself.

Lessons for the hardware wallet industry

The COLDCARD incident serves as a reminder that cryptographic security depends not only on strong algorithms but also on the quality of their implementation.

Bitcoin’s underlying cryptography has not been broken. BIP-39, BIP-32 and the elliptic curve algorithms used to derive private keys remain fundamentally secure. Instead, the weakness appears to have originated during one of the earliest stages of wallet creation: generating sufficiently unpredictable entropy.

It also highlights the limits of open source as a security guarantee. Publicly available code enables independent review, but it does not ensure that every line will receive expert scrutiny. Complex cryptographic software, particularly firmware designed for dedicated security hardware, requires continual auditing, extensive testing and rigorous validation to identify subtle regressions before they reach production devices.

Finally, the incident reinforces the value of layered security. Independent entropy sources, strong BIP-39 passphrases, reproducible builds, formal code reviews and prompt security advisories each provide separate barriers against catastrophic failure. No single safeguard should be expected to carry the entire burden of protecting high-value cryptocurrency holdings.

As Coinkite continues its investigation, users should avoid waiting for definitive attribution before taking action. If a recovery seed was generated under one of the affected firmware versions, the safest course remains exactly what the advisory recommends: install the fixed firmware, generate a new seed on the updated device, verify the backup, and migrate funds to the newly created wallet. When the integrity of a wallet’s root secret is in doubt, replacing that secret is the only reliable way to restore confidence in the security of the funds it protects.