The entire premise of a hardware wallet is a single promise: your private keys are generated inside a tamper-resistant secure element using true hardware randomness, and they never leave that device. On July 30, 2026, that promise was proven hollow for thousands of Coldcard owners. An attacker swept 1,082.65 BTC — roughly $70.2 million — out of 1,196 Bitcoin addresses in 41 minutes without touching a single device. By August 5, Galaxy Research had mapped four attack waves totaling over 1,600 BTC (north of $100 million) drained from more than 5,200 addresses. The cause was not phishing or a compromised supply chain. It was a firmware bug introduced in March 2021 — five years ago — that silently routed seed generation through a weak software pseudo-random number generator instead of the hardware entropy source. Coinkite halted shipments, destroyed affected stock, and warned owners to migrate funds immediately. For a device category whose value proposition is "your keys are random," this is the worst possible failure.
How a PRNG Bug Defeats a Hardware Wallet
Every Bitcoin wallet starts with a seed: a 128-to-256-bit random number from which every private key is deterministically derived via BIP32/BIP39. If the seed is truly random and secret, the wallet is secure. If the seed is predictable, every key is already gone — you just do not know it yet. Hardware wallets use certified secure elements with hardware TRNGs precisely to guarantee unpredictability.
The Coldcard bug, analyzed by Wizardsardine and confirmed by Galaxy Research's on-chain tracing, was that firmware 4.0.1 (March 2021) caused seed generation to fall back to a software PRNG seeded with far less entropy than the 128-bit BIP39 minimum — in some code paths, as few as 32 bits on the Mk4, which only injects 32 bits of real hardware randomness at boot via its secure-element "reseed." That is 2^32 — about 4.3 billion — possible seeds for the entire keyspace of affected wallets. The attacker did not brute-force these in real time. They enumerated possible seed values, derived the BIP39 mnemonic, computed the extended public key, and watched the blockchain for matching addresses. When funds landed in a vulnerable wallet, the attacker already had the private key. The 41-minute drain was the time to broadcast sweep transactions, not to crack keys. The keys were already cracked.
The catastrophic asymmetry: users did everything right. They bought a dedicated device, generated seeds on-device, stored mnemonics on steel plates. None of it mattered, because the randomness that produced the seed was not random. This is a bank vault with a combination lock ranging from 0000 to 9999 — the vault is real, but the attacker can try every combination.
Affected Models and the On-Chain Timeline
Based on Coinkite advisories, Wizardsardine's analysis, and Galaxy Research's address correlation:
- Coldcard Mk2 and Mk3 (firmware 4.0.1–5.0.3): Fully affected. Seeds generated on these versions used the weak PRNG. If you created a seed on a Mk3 in this window, it is compromised.
- Coldcard Mk4, Mk5, and Q: Partially affected. The secure-element reseed only added ~32 bits in some code paths. Seeds created before the patched firmware are at elevated risk and should be migrated.
Galaxy Research's Alex Thorn mapped four attack waves: an initial 594 BTC sweep in July, the largest strike on July 30 (1,082.65 BTC from 1,196 addresses in 41 minutes), expansion to ~4,585 addresses (~$89M) in early August, and a fourth wave (389 BTC, ~$25M) on August 3–4. Because vulnerable seeds were pre-computed, the sweeps were limited only by broadcast rate, not key-cracking time. There was no ransom, no interaction — funds moved and were gone. This validates that air-gapped cold storage is not a magic bullet: the Coldcard signs via SD card, never connecting to a network, but the vulnerability was in key generation, not key use. Seed-generation entropy auditability is now the single most important property of any hardware wallet.
For users seeking an alternative platform — a rational response to a five-year-old entropy bug — the Ledger hardware wallet lineup uses a dual-chip architecture with a certified EAL5+ secure element and independent entropy verification, and has not been linked to this vulnerability class. See our Best Hardware Wallet for DeFi 2026 guide for the full comparison.
What Every Hardware Wallet User Must Do Now
1. If you have a Coldcard, determine your exposure immediately. Check your firmware version and when you generated your seed. If you created a seed on affected firmware, do not wait. Generate a new seed on fully patched firmware (or a different wallet) and migrate all funds. Do not reuse old addresses. The attacker is still actively sweeping — wave 4 happened days after public disclosure. Updating firmware does not fix a seed already generated with weak entropy — the patch secures future generation, but your existing seed is already predictable.
2. Stop equating "air-gapped" with "secure." The Coldcard is fully air-gapped and it did not matter. Evaluate wallets on entropy generation and auditability, not just connectivity model.
3. Demand verifiable, audited entropy. The best wallets publish their entropy path, allow user-contributed entropy (dice rolls, external TRNG), and have third-party RNG audits. The Coldcard bug survived five years because the entropy path was opaque. Coldcard itself supports dice-roll entropy contribution — a feature that would have prevented this attack if affected users had used it.
4. Use multisig for significant holdings. A 2-of-3 multisig with keys on different hardware from different vendors means an attacker must compromise multiple devices' entropy. The Coldcard attack would not have succeeded against a multisig wallet where other keys were on unaffected hardware.
5. Choose wallets with independently audited secure elements. Look for EAL5+ or higher with published RNG certification and dual-chip entropy verification. The Ledger wallet family uses a ST33J2M0 secure element (EAL5+) with published independent security audits — a standard this incident will make table stakes for the industry.
The Broader Lesson
This is a supply-chain attack that happened entirely inside the device — no malicious firmware push, no tampered hardware, no phishing. The "supply chain" was a code path that ran when a user clicked "New Wallet," introduced by Coinkite's own engineers, likely as an innocent change that silently weakened entropy under a fallback branch. It is the hardest vulnerability class to detect: a latent engineering defect in a security-critical path that no one re-audited for five years. The industry expectation going forward must be that seed-generation entropy is not a black box. Vendors must publish their entropy architecture, subject it to independent audits, and build in user-verifiable entropy contribution. Coinkite has responded responsibly — halting shipments, destroying stock, emailing customers. But a five-year-old bug in the most security-critical function of a security-focused product will reshape buyer expectations for the entire category. The era of "trust us, it uses a secure element" is over. The era of "show us the entropy path and prove it is audited" begins now.
Get weekly AI & security infrastructure guides
Join the GeniusTechLab newsletter for hardware wallet reviews, entropy analysis, and custody best practices — one email a week, no spam.
Subscribe to the newsletter →