Coldcard Firmware Flaw Linked to $70 Million in Bitcoin Drained From Wallets
Hardware wallets are supposed to be the safe option, the place long-term bitcoin holders keep coins they never plan to touch. This week, owners of one of the best-known brands learned that a five-year-old firmware bug may have left their keys open to anyone with enough computing power to guess them.
Over the past three days, attackers have swept bitcoin from more than a thousand wallets created on Coldcard devices, made by Canadian company Coinkite. Galaxy Research has linked 1,196 addresses to the incident and counted 1,082.65 BTC taken, worth about $70.2 million at the time, according to Cointelegraph. That figure is likely to change: reports of further sweeps were still coming in on Saturday, and neither Coinkite nor independent researchers have published a final total.
How the keys became guessable
The problem is not that devices were hacked remotely. According to Coinkite’s security advisory, first published July 30 and updated on August 1, a firmware bug weakened how some devices created new seed phrases, the master secret behind every wallet. Attackers did not need physical access. They could regenerate private keys offline and then move the coins.
Block, the payments company led by Jack Dorsey, published a technical report the same day. Its Bitcoin engineering and security teams said they began investigating after reports of wallets being drained remotely, and traced the issue to a build setting introduced in March 2021. That setting told the firmware not to use the device’s built-in hardware random number generator. A supporting library then checked only whether the setting existed, not whether it was turned on, and quietly fell back to a predictable software generator seeded from values such as the chip’s serial number and internal clocks. None of those values are secret.
Block said it released its findings before completing full testing because “active exploitation is under way,” and that it had disclosed them to Coinkite first. It added that no Block products, including its own Bitkey wallet, were affected.
Which devices are at risk
Coinkite’s advisory now covers more models than its first warning. Seeds created on the Mk2 and Mk3 using firmware 4.0.1 through 4.1.9 are the most exposed. Independent analyses put their effective strength at around 40 bits, far below the 128 bits a seed phrase is designed to have.
Initially, Coinkite said its newer Mk4, Q and Mk5 models did not appear to be affected. Its updated advisory says seeds made on those devices before Mk4 and Mk5 firmware 5.6.0 (or Edge 6.6.0X) and Q firmware 1.5.0Q (or Edge 6.6.0QX) carry roughly 72 bits of entropy. Block’s researchers argue the protection on those models may be weaker still, since only about 32 bits of fresh randomness reaches the final seed in their analysis.
The exposure depends on which firmware was running when the seed was created, not when the device was bought. Seeds generated with at least 50 private dice rolls are not at risk from this flaw alone, Coinkite said, and a strong, unique passphrase adds protection. TAPSIGNER, OPENDIME and SATSCARD products are not affected.
What Coinkite says owners should do
Patched firmware is available, including version 4.2.0 for the Mk3. But Coinkite and Block both stress that updating does not repair a seed that already exists. A weak seed stays weak even if it is imported into another brand of wallet, and a multisig setup made only of affected devices is still exposed.
Coinkite’s guidance is to install the fixed firmware first, generate a brand new seed, verify the backup, send a small test transaction, and only then move the remaining funds. Co-founder Rodolfo Novak said on X on Friday that the company “takes responsibility for the firmware bug” and is still working to establish the full scope, Cointelegraph reported. Ledger and Trezor both issued statements saying their devices are not affected.
Why it matters
In one sweep examined by CoinDesk, the drained wallets were single-signature setups, many of them dormant for years, holding coins received as far back as 2021. That is exactly the profile of a cautious holder who bought a hardware wallet, wrote down a seed phrase and left it alone. Early estimates, including one from AnchorWatch chief executive Rob Hamilton, put the first losses at about 594 BTC before Galaxy’s larger mapping.
The incident is a reminder that self-custody depends on the quality of code most users never see. The bitcoin network itself was not broken, and the market barely moved: bitcoin traded above $64,000 on Friday, according to CoinDesk. But a single configuration error went unnoticed through five years of releases on one of the most respected devices in the industry.
The attackers have not been identified. Galaxy noted that the transactions it tracked shared a pattern, including identical fees and no change outputs, but warned that future sweeps may look different. Coinkite’s guidance is that funds behind any seed created on affected firmware without enough dice rolls should be moved to a new seed, whether or not those coins have been touched yet.