The Coldcard Seed Flaw: What Happened, and What to Do

On 30 July 2026, Coinkite published a security advisory: a flaw in how Coldcard devices generated seed phrases meant that seeds created on affected firmware had far less randomness than the 128 bits users were promised. The same day, wallets started being drained. The weakness let attackers reconstruct affected seeds by brute force and sweep the coins, in bulk, without ever touching a device — and the speed and scale of the first sweep suggest the work of reconstructing seeds had begun well before the advisory was public, though nobody has published who found the flaw first.

The running totals differ from tracker to tracker and from day to day, which is itself worth knowing: at the time of writing nobody, including Coinkite, can state the full size of this. What is not in dispute is the mechanism, the affected firmware ranges, and what owners need to do.

Sources: Coinkite, Coldcard security advisory (30 July 2026) · The Hacker News, Coldcard flaw linked to $70M theft in 41 minutes (1 Aug 2026) · TRM Labs, inside the $116M Coldcard hack (5 Aug 2026) · CoinDesk, Coldcard urges users to move bitcoin as exploit continues (4 Aug 2026) · Bloomberg, Coinkite declines to estimate losses (6 Aug 2026)

A seed phrase is nothing more than a very large random number written as words. Its entire security rests on that number being drawn from a space so large that guessing is hopeless — 128 bits of randomness, a number with 39 digits. Hardware wallets carry a dedicated hardware random number generator for exactly this job.

According to the root-cause analysis published by Block and summarized in security reporting, a March 2021 build change meant the Coldcard firmware stopped using that hardware generator for seeds. The build configuration asked whether the hardware-randomness setting existed rather than whether it was switched on, and so the code silently fell back to a software generator seeded from predictable values — the chip's serial number and its internal timers. Coinkite's own estimates, as reported by The Hacker News, put the effective randomness at roughly 40 bits on Mk3-era devices and roughly 72 bits on the Mk4, Mk5 and Q, instead of the 128 promised. Block deliberately declined to reduce it to a single practical figure.

Forty bits is a search a well-resourced attacker finishes. Seventy-two bits is a vastly harder search, and it is not public how far the attackers got against the newer models — but it is still far below what was promised, and Coinkite's advisory treats every affected model the same way: migrate. Because the weakness lives in the seed itself, none of the Coldcard's celebrated defenses apply: the air gap, the secure elements, the PIN — all of them protect the device, and the attacker never needs the device. They reconstruct the seed on their own hardware, derive the addresses, and sweep whatever is there.

Two details make this stark. The flaw was introduced by accident and sat in published source code for five years — Coldcard's firmware is source-available, and nobody caught it. And the public learned of it the worst way possible: the advisory and the first mass theft landed on the same day.

Sources: The Hacker News, Coldcard flaw linked to $70M theft in 41 minutes (1 Aug 2026) · Coinkite, Coldcard security advisory (30 July 2026)

The single question that matters: what firmware was running when your seed was generated? Not what is installed now. Per Coinkite's advisory:

If you cannot remember which firmware the device was on when you set it up — and almost nobody can — the date is the practical test. A seed created on a Coldcard from March 2021 until the patched releases of July 2026 should be treated as affected.

Source: Coinkite, Coldcard security advisory (30 July 2026)

Until 11 August 2026, our self-custody guide recommended the Coldcard. The link was never an affiliate link, so no revenue rode on the recommendation — but the recommendation was ours, and we are not going to pretend it never existed. We removed it while the exploit is active and the post-mortem is pending, and we will reassess when Coinkite publishes its full account. Nobody outside Coinkite caught the flaw, and that includes us: it sat for five years in code anyone could read, and the signals everyone relied on — published source code, a long track record, a security-obsessed reputation — all pointed the right way the whole time.

That is precisely the lesson. Choosing a hardware wallet moves trust from your computer to a vendor, and no amount of reputation reduces that trust to zero. The defenses that actually contained this flaw existed before it was found, and they are the unglamorous ones:

And what it does not change: the boring hierarchy of how bitcoin is actually lost. Vendor firmware bugs of this severity have now happened once at scale. Lost backups, phishing, and seeds typed into websites happen every single day, and they do not pause while the news cycle runs. The habits that defend against those — tested backups, on-device verification, buying direct — are unchanged, and they still matter more than which box you buy.