The Coldcard Seed Flaw: What Happened, and What to Do

On 30 July 2026, attackers began emptying Coldcard wallets, and Coinkite published a security advisory the same day: a flaw in how Coldcard devices generated seed phrases meant that seeds created on affected firmware had far less randomness than the 128 bits users were promised. The weakness let attackers reconstruct affected seeds by brute force and sweep the coins, in bulk, without ever touching a device. The speed and scale of the first sweep suggest the work of reconstructing seeds had begun well before the advisory was public. Coinkite says it was unaware of the bug until that day, and nobody has published who found it first.

The totals differ from tracker to tracker and from day to day, and dollar figures move with the price of bitcoin, so the BTC count is the steadier measure. A figure of about 1,816 BTC across more than 5,200 addresses, which TRM Labs attributed to Galaxy on 5 August, was described as preliminary at the time. Galaxy's count on 21 September was about 1,830 BTC across 9,162 addresses. It also flagged a suspected fourth wave in August that it had not confirmed, and we have found no later confirmation. Coinkite declined to give its own estimate in early August, and we have found none from it since.

This was not one thief. Galaxy estimated in early August that at least 15 separate attackers were exploiting the flaw independently, and TRM Labs saw differences between the waves that pointed the same way. Nor was everything that moved stolen: Galaxy reported on 21 September that white-hat rescuers had swept about 52 BTC out of affected wallets ahead of the thieves and into a trust set up in Wyoming to return it to its owners. What is not in dispute is the mechanism and what owners need to do.

Sources: Coinkite advisory · Coinkite deep dive · Coinkite status page · Coinkite 5.6.1 release · Block analysis · The Hacker News · TRM Labs · CoinDesk · Bloomberg · Galaxy Research brief · Decrypt, 14 Aug · Cointelegraph, 25 Aug · Decrypt, 7 Sep · Cointelegraph, 22 Sep

A seed phrase is nothing more than a very large random number written as words. Its entire security rests on that number being drawn from a space so large that guessing is hopeless — 128 bits of randomness, a number with 39 digits. Hardware wallets carry a dedicated hardware random number generator for exactly this job.

Coinkite's own technical account says the Coldcard was designed to use only that hardware generator for seeds. In March 2021 the firmware moved to a new cryptography library, and a mistake in how the pieces were built together left the seed code wired to a general-purpose software generator that comes with MicroPython, the language runtime the firmware is built on. A check that should have stopped the build asked whether the hardware-randomness setting existed rather than whether it was switched on, so the build went through. That software generator starts from values that are not secret: the chip's ID number and its internal timers. Coinkite is specific that the hardware generator never failed and nothing switched over while the device was running; the wrong code was linked in from the start. Block's independent analysis reaches the same root cause.

Coinkite's preliminary estimates put the effective randomness at about 40 bits on the Mk2 and Mk3 and about 72 bits on the Mk4, Mk5 and Q, instead of the 128 promised, and it says those figures may change as its analysis continues. The newer models did better because, from the Mk4 on, values from the two secure-element chips were also mixed in. In Coinkite's words that “partially reduced the impact on later models but did not restore the intended 128-bit security target”. Block reads the newer models less generously. In its analysis, which it describes as its own opinion pending Coinkite's definitive report, only 32 bits of that secure-element input survive: about 4.3 billion possibilities once the device's other inputs are known. Block adds that its own loose upper bound of roughly 73 bits “is not 73-bit cryptographic security”, because the timer values are related to each other and may be easy to narrow down. It published no measured attack time.

Forty bits is a search a well-resourced attacker finishes. How large the search is on the newer models depends on which of those readings is right, and the public record does not show how many Mk4, Mk5 or Q wallets were emptied: Coinkite's status page says that record “does not support claiming that no Mk4/Mk5/Q wallet was robbed”. Coinkite's guidance treats every affected model the same way: migrate. Because the weakness lives in the seed itself, the device's defenses never come into it. The air gap and the PIN protect the device, and the secure elements protect keys stored on it from someone holding it. None of them can repair a seed that was weak when it was made, and the attacker never needs the device. They reconstruct the seed on their own hardware, derive the addresses, and sweep whatever is there.

Two details make this stark. The flaw was introduced by accident and sat in published source code for five years — Coldcard's firmware is source-available, and nobody caught it. And the public learned of it the worst way possible: the advisory and the first mass theft landed on the same day.

Sources: Coinkite deep dive · Block analysis · Coinkite advisory · Coinkite status page

The single question that matters: what firmware was running when your seed was generated? Not what is installed now. Per Coinkite's advisory, with one place where Block's analysis differs:

If you cannot remember which firmware the device was on when you set it up — and almost nobody can — the date is the practical test. A seed created on a Coldcard from March 2021 until the patched releases of July 2026 should be treated as affected, and so should one created later on a device that had not yet been updated.

Sources: Coinkite advisory · Coinkite migration guide · Block analysis

Until 11 August 2026, our self-custody guide recommended the Coldcard. The link was never an affiliate link, so no revenue rode on the recommendation — but the recommendation was ours, and we are not going to pretend it never existed. We removed it twelve days after Coinkite's advisory, and it stays off the list today. Coinkite's status page, which it calls the living post-mortem for the incident, said when last verified on 1 October 2026 that a separate detailed technical post-mortem “remains in preparation”, and that the independent checks of its fix published so far are “not a complete audit”. We will look at this again when that post-mortem is published. Nobody caught the flaw before the attackers did, and that includes Coinkite, outside reviewers and us: it sat for five years in code anyone could read, and the signals everyone relied on — published source code, a long track record, a security-obsessed reputation — all pointed the right way the whole time.

That is precisely the lesson. Choosing a hardware wallet moves trust from your computer to a vendor, and no amount of reputation reduces that trust to zero. The defenses that actually contained this flaw existed before it was found, and they are the unglamorous ones:

Sources: Coinkite status page · Coinkite advisory · Coinkite 5.6.1 release · Block analysis

And what it does not change: the boring hierarchy of how bitcoin is actually lost. Vendor firmware bugs of this severity have now happened once at scale. Lost backups, phishing, and seeds typed into websites happen every single day, and they do not pause while the news cycle runs. The habits that defend against those — tested backups, on-device verification, buying direct — are unchanged, and they still matter more than which box you buy.