- An attacker drained roughly 594 BTC ($38M) from about 500 Coldcard wallets in 25 minutes using a firmware bug that bypassed hardware randomness.
- The flaw, present since March 2021, caused seed generation to rely on a predictable software fallback (Yasmarang) instead of the dedicated TRNG chip.
- Affected models include Mk2, Mk3 (worst case, ~40 bits entropy), and Mk4/Q/Mk5 (still below 128-bit standard, ~72 bits).
- Coinkite urges users to generate new seeds on patched firmware and use a strong BIP-39 passphrase; updating firmware alone does not fix existing seeds.
The recent $38 million Bitcoin heist targeting Coldcard hardware wallets has sent shockwaves through the crypto community. In a coordinated 25-minute sweep, an unknown attacker drained roughly 594 BTC from nearly 500 single-signature wallets, consolidating 562 BTC into a single address that has remained untouched. The incident, confirmed by both Coinkite (the Canadian manufacturer) and Block (Jack Dorsey’s fintech firm), stems from a firmware bug that silently bypassed the device’s dedicated hardware random number generator since March 2021.
This is not just another exchange hack. It strikes at the heart of the self-custody promise — the idea that holding your own private keys eliminates counterparty risk. Bitcoin commentator Guy Swann called it “the worst hit in bitcoin history to the most knowledgeable and ‘properly secured’ bitcoiners.” The vulnerability allowed an attacker to recreate private keys from predictable entropy, effectively turning hardware wallets into ticking time bombs for anyone who generated a seed on affected firmware.
The $38 Million Heist
Block’s security researchers detailed how the attacker moved funds across 500 transactions in a three-block window. Many of the drained wallets had been dormant for years, suggesting the exploit targeted pre-existing vulnerable seeds rather than recently active ones. AnchorWatch CEO Rob Hamilton identified 1,324 individual bitcoin outputs, with 562 BTC consolidated into address bc1qnk… that has not moved since. Block engineer Clay Garrett later flagged an additional 695 transactions with matching signatures, potentially linking another 488 BTC to the same exploit — pushing the total above 1,082 BTC (~$69.5 million).
Coinkite believes the attacker used AI to uncover the flaw. The firm stated it had run one of the best available models over its own code weeks earlier, but the model “did not find this bug or anything serious.” Attackers and defenders have the same tools, Coinkite wrote, but this time “it did not help us, and only helped the bad guys.”
What Went Wrong: The Firmware Bug
The root cause is a preprocessor guard in the cryptographic support library libngu. Coldcard’s firmware correctly defines a macro MICROPY_HW_ENABLE_RNG = 0 to disable MicroPython’s built-in hardware RNG path, because Coinkite wrote its own dedicated TRNG wrapper. However, libngu’s guard condition reads #ifndef MICROPY_HW_ENABLE_RNG — it checks only whether the macro exists, not whether its value is non-zero. Since the macro is defined (even though set to zero), libngu concludes hardware randomness is available and binds to MicroPython’s rng_get() function. But MicroPython sees the value zero and compiles the Yasmarang software fallback — a non-cryptographic pseudorandom algorithm — instead of the STM32 hardware peripheral.
Yasmarang initializes its state from three inputs: the chip’s 32-bit unique identifier, the SysTick timer (a periodic down-counter with at most 80,000 possible values), and the RTC registers. On the Mk3, the RTC oscillator was disabled, meaning those registers likely held static values on cold boot. Once those inputs are fixed, the generator is fully deterministic. The effective search space for an Mk3 seed is about 40 bits — far below the 128-bit minimum that BIP-39 expects. The XOR of two Yasmarang instances with known starting states produces a deterministic output, and SHA256d hashing cannot increase entropy beyond the input.
Which Devices Are Affected?
Coinkite’s advisory confirms the exploit targeted Coldcard Mk2 and Mk3 devices that generated a wallet seed using firmware versions 4.0.0 through 5.0.3 — a window from March 2021 to the final Mk3 release. Mk4, Q, and Mk5 devices were not exploited in Thursday night’s sweep, but Block’s engineering analysis found they also fall short of the 128-bit entropy standard. Their secure-element reseed delivers at most 32 bits to the underlying generator, resulting in approximately 72 bits of effective entropy — better than the Mk3’s 40-bit ceiling, but still 56 bits below the target. Coinkite describes the Mk4/Q/Mk5 situation as “a dangerous fail-open structure.” Tapsigner, Opendime, and Satscard use different codebases and are not affected.
Critically, updating firmware does not repair an existing seed. The seed itself is the compromised artifact. A seed created on an affected Coldcard stays weak even if restored to another brand’s device — a point rival hardware wallet manufacturer Trezor made while telling its own users their funds are safe.
What Coldcard Owners Must Do
Coinkite has shipped emergency hotfixes: version 5.6.0 for Mk4 and Mk5, and 1.5.0Q for the Q. Mk3 owners, whose model is out of support, are pointed to a separate migration path. The safest course: generate a completely new seed on a patched device, verify the backup and a receive address on the device screen, send a small test transaction, then transfer the remaining balance. Do not restore the old seed phrase into a new wallet — the seed itself is weak.
If you used a BIP-39 passphrase that was never typed into a computer or online tool, Coinkite says your funds are at minimal risk from this vulnerability. For Mk3 users without a passphrase, Coinkite recommends adding a strong, unique BIP-39 passphrase as a stopgap while sourcing a replacement device. The company also documents a dice-only seed generation path on firmware 4.1.9 that bypasses the device’s RNG entirely. Mistakes in the recovery process could cause more damage than the vulnerability itself, so proceed carefully.
Broader Implications for Self-Custody
This incident demonstrates that hardware wallet security has two independent requirements: controlling your keys, and ensuring those keys were generated with genuine randomness. The first promise — physical isolation — remained intact; an attacker could not extract private keys over USB or Wi-Fi. But the second promise was silently broken at the moment of wallet creation. Private keys generated from predictable entropy are not secure regardless of how physically isolated the device holding them is.
Analysts argue that users have simply exchanged one set of risks for another. “In practice, consumers have traded counterparty risk for software risk, hardware risk, supply-chain risk, phishing risk, backup risk, and the possibility of losing everything through one mistake,” said Lorenzo Valente, director of digital asset research at ARK Invest. This is the third major documented failure of this class — following the 2023 Milk Sad PRNG incident and the 2026 Ill Bloom mobile wallet vulnerability — and each time the failure occurred at a point the user had no way to verify: the moment of wallet creation.
Bitcoin was trading at approximately $64,315 as of early Friday morning, with little visible market reaction to the theft. The drained 562 BTC consolidated in a single on-chain address has not moved as of this writing. For now, the most urgent takeaway is clear: if you generated a seed on a Coldcard Mk3, Mk4, Mk5, or Q device before the latest firmware hotfix, treat your funds as at immediate risk and follow the migration steps without delay.