Some Coldcard seeds have just 40 bits of randomness, not 128

What Is the Coldcard Entropy Flaw?

A hardware wallet's entire security model rests on one assumption: that the 12 or 24 words it hands you were drawn from genuinely unpredictable randomness. For five years, some COLDCARD devices quietly broke that assumption — and by early August 2026 attackers had swept thousands of Bitcoin from the addresses those seeds protected.

The Coldcard entropy flaw is a seed-generation defect in COLDCARD hardware wallet firmware that caused recovery phrases to be created with far less randomness than the BIP-39 standard requires. Coinkite, the Bitcoin-only manufacturer behind COLDCARD, published its advisory on July 30, 2026 and updated it on August 1, 2026 at 2:35 p.m. EDT . Seeds generated on affected firmware carry roughly 72 bits of entropy on Mk4, Mk5 and Q devices, and an estimated 40 bits on Mk2 and Mk3 — instead of the 128 bits a standard 12-word BIP-39 seed should provide .

Quick Answer: A March 2021 COLDCARD firmware change silently replaced the hardware random number generator with a weak software PRNG during seed creation. Affected Mk2/Mk3 seeds hold roughly 40 bits of entropy instead of 128. Galaxy Research has confirmed 1,596 BTC swept from about 7,300 addresses .

The root cause traces to March 2021, when Coinkite integrated a new cryptographic library into COLDCARD firmware 4.0.x. Because of a configuration check that tested whether a macro existed rather than whether it was enabled, affected builds fell through to a deterministic software PRNG instead of the STM32 hardware random number generator — seeded only from the chip's unique ID and timer registers, with no fresh entropy collected afterward .

Two clarifications matter for anyone assessing personal exposure. First, this is a seed-generation defect, not a remote takeover: the devices were never compromised over a network, and funds are only at risk if the seed itself was created weakly. Second, the weakness follows the recovery phrase, not the hardware — importing the same words into a different wallet brand changes nothing .

The practical consequence is already measurable on-chain. Galaxy Research has tracked programmatic sweeps of vulnerable single-signature addresses totalling 1,596 confirmed BTC from roughly 7,300 addresses, a figure that rises toward 2,055 BTC if a suspected fourth wave flagged on August 3, 2026 is verified . Coinkite shipped fixed firmware on July 31, 2026, but the advisory is explicit that updating does not repair an existing seed .

How a Silent Fallback to a Weak PRNG Broke Coldcard's Randomness

The defect was a build-configuration mismatch, not a broken algorithm: COLDCARD firmware believed it was calling the STM32's hardware random number generator while it was actually calling a deterministic software PRNG. Coinkite integrated a new cryptographic library, libngu, into COLDCARD firmware 4.0.x in March 2021 . From that release onward, seed generation on affected builds drew from a predictable source, and neither the device screen nor the resulting BIP-39 words gave any outward sign of it .

The mechanism turns on a single preprocessor macro. COLDCARD's production board configuration defines MICROPY_HW_ENABLE_RNG as zero, because Coinkite supplies its own hardware-RNG wrapper rather than relying on MicroPython's built-in implementation. The libngu library, however, checked whether that macro existed rather than whether it was enabled — an #ifdef-style test where a value test was required. Because the macro was defined, just defined to zero, the check passed for the wrong reason and the build compiled without the hardware path .

What the build fell through to was MicroPython's Yasmarang, a small deterministic pseudo-random number generator intended for general-purpose scripting rather than key material. Yasmarang was seeded only from the chip's unique ID and timer registers at startup and collected no fresh entropy afterward . Both of those inputs are constrained: a chip unique ID is fixed per device and partially structured by wafer and lot, while timer register values at seed-generation time fall within a narrow, enumerable band. A deterministic generator seeded from constrained inputs produces a search space bounded by those inputs, not by the 128 bits a 12-word BIP-39 phrase nominally encodes.

That is why the practical exposure differs by hardware generation. Coinkite puts Mk4, Mk5 and Q seeds generated on affected firmware at roughly 72 bits of effective entropy, and the Mk2/Mk3 case at roughly 40 bits . Block's researchers described conditional search-space ceilings below 2^40.7 and 2^73.3, while cautioning that the higher figure "is not equivalent to 73-bit cryptographic security" — the reproducible search space on Mk4/Mk5/Q works out to roughly four billion possibilities, a workload ordinary consumer hardware can enumerate .

Three characteristics of the fault explain how it survived more than five years in open-source firmware:

• It lived in board configuration, not cryptographic code. Auditing the seed-derivation logic alone would not surface it; confirming the hardware RNG was actually being called required reading the production build configuration .
• It produced valid-looking output. Yasmarang emits well-formed 12- and 24-word phrases that pass checksum validation, so no device warning, wallet import or address check would flag them.
• It failed closed on the wrong side. A missing macro would have raised a build error; a macro defined to zero passed silently, which is the failure mode most likely to reach production.

Block's security researchers traced and documented the fault and pinned its origin to the 2021 firmware change, with Core Lightning developer Dustin Dettmer contributing to that timeline reconstruction . As of publication no CVE identifier has been assigned, and Coinkite has said a full technical review is still pending — meaning the authoritative account of exactly which build artifacts shipped with the fallback path remains outstanding .

Which Coldcard Models and Firmware Versions Are Affected?

Every COLDCARD hardware wallet model is affected by the entropy defect, but the vulnerable firmware ranges and the fixed releases differ by generation. Mk2 and Mk3 units are affected on firmware 4.0.x through 4.1.9 inclusive and were repaired in 4.2.0 . Mk4 and Mk5 are affected on anything before standard release 5.6.0, or before Edge 6.6.0X. The Q is affected on anything before standard 1.5.0Q, or before Edge 6.6.0QX. All fixed releases carry a build date of July 31, 2026 .

The split between roughly 40 bits on Mk2/Mk3 and roughly 72 bits on Mk4/Mk5/Q matters for triage. Coinkite describes the Mk2/Mk3 case as the more severe of the two, at an estimated 40 bits against the 128 bits a 12-word BIP-39 seed should carry . Block's researchers framed the exposure as conditional search-space ceilings below 2^40.7 and 2^73.3, while cautioning that the higher figure "is not equivalent to 73-bit cryptographic security" . In practice, the reproducible search space on Mk4/Mk5/Q works out to roughly four billion candidate seeds — a figure enumerable on ordinary consumer hardware, which is why the newer models are not meaningfully safer than the older ones in this specific failure mode .

Coinkite's other products sit outside the blast radius. TAPSIGNER, OPENDIME and SATSCARD run different codebases and never integrated the affected library, so they are officially unaffected . That distinction is worth stating plainly, because the NFC cards share branding with the COLDCARD line and have been swept into the general alarm.

Two practical points govern how to read the version table. First, the relevant firmware version is the one that was running when the seed was created, not the version on the device today. A Mk4 updated to 5.6.0 last week still holds a weak seed if that seed was generated on 5.5.x. Second, COLDCARD's download pages now explicitly label vulnerable versions, so users who kept a record of their setup firmware can check the build against the published list rather than relying on memory . Owners who cannot establish which firmware generated their seed should treat it as affected and plan a migration.

The exposure window is wide by any measure: the defect entered the codebase with the March 2021 integration and remained live until the July 31, 2026 releases, spanning more than five years and three hardware generations . Any COLDCARD seed created inside that window on the models listed above should be assumed vulnerable until proven otherwise.

How Much Bitcoin Has Been Stolen So Far?

Galaxy Research has confirmed 1,596 BTC drained from roughly 7,300 COLDCARD-generated addresses across three verified sweep waves, with a suspected fourth wave pushing the estimate to about 2,055 BTC . The sweeps began at 02:14 UTC on July 30, 2026 — the same day Coinkite published its advisory — and have run in discrete bursts rather than as a continuous trickle . Dollar-value estimates across outlets remain unsettled, so the BTC counts are the firmer figure.

The first wave was the most concentrated. A single entity swept 594 BTC from approximately 500 single-signature wallets in 25 minutes . Counting all activity that day, the broader July 30 sweep drained 1,196 addresses of 1,082.65 BTC in 41 minutes . That throughput — thousands of addresses enumerated, checked and spent inside an hour — is consistent with the roughly four-billion-possibility search space researchers described for Mk4, Mk5 and Q seeds, which is enumerable on ordinary consumer hardware .

The later waves show a different profile: broader and shallower. Wave 2 on August 1 took 284.4 BTC from 2,889 addresses — nearly six times the address count of the opening burst for roughly half the Bitcoin — and a third wave the same day took 207.73 BTC from a separate cluster . That pattern reflects who is doing the sweeping. Galaxy counts at least 15 distinct attackers, indicating copycats piling onto a publicly documented weakness rather than one coordinated crew working through a private list .

"An active sweep attack is underway against all single-signature Coldcard addresses created after the March 2021 firmware update," wrote Alex Thorn, head of research at Galaxy, on August 1, describing the sweeps as programmatic and "probably orchestrated with a large language model" (source: Cointelegraph, 2026-08).

Two on-chain details shape what happens from here. First, roughly 90% of the stolen Bitcoin remains unmoved, and none of the coins from the first three confirmed waves have shifted since the sweeps . That leaves the funds visible and traceable, which is why Galaxy has reported roughly 600 suspected attacker-controlled addresses to federal investigators, compliance firms and cross-industry cyber investigators . Second, the drained coins had been dormant for an average of 3.18 years, meaning the victims skewed heavily toward long-term holders who set up a device years ago and stopped touching it .

The practical implication for anyone still holding an unmigrated seed: dormancy offers no protection here. Attackers are deriving addresses from an enumerated key space and checking them against the chain, so an address that has never moved a satoshi since 2021 is exactly as reachable as one used last week. The relevant variable is whether the seed came from affected firmware — not how quietly the wallet has been sitting.

How to Check If Your Seed Is at Risk — and Migrate Safely

A Coldcard seed is at risk if it was generated on affected firmware and did not come from a sufficient dice-roll sequence — and the only remedy is generating a new seed and moving the funds. Coinkite's advisory is explicit on the point that trips up most users: "Updating the firmware does not change or repair an existing seed" . Patching stops the flawed random number generator from producing new weak seeds; it does nothing for private keys already derived from one. Restoring the same recovery phrase onto a different wallet brand does not help either, because the weakness travels with the phrase, not the hardware .

Two carve-outs narrow the affected population. The first is dice. Seeds created from at least 50 fair, independent, private six-sided dice rolls bypass the broken code path entirely, because the dice-only workflow hashes the roll sequence directly with SHA-256 rather than drawing from the device's PRNG . Each D6 roll contributes roughly 2.585 bits of entropy, so 50 rolls clear the 128-bit threshold and 99 or more approach about 256 bits . The qualifiers matter: fewer than 50 rolls, an unknown roll count, rolls performed in view of a camera or another person, or simple uncertainty about what you did in 2022 all place the seed back in the migrate column .

The second carve-out is a BIP-39 passphrase, and it is weaker than it sounds. A strong, unique passphrase is an independent barrier that an attacker enumerating the seed space still has to defeat, but Coinkite frames it as temporary cover pending migration rather than a resolution . Passphrases that are short, reused from another service, patterned, drawn from a quotation, or otherwise common are treated as guessable — and an adversary who has already reduced the base seed to a tractable search space can layer a passphrase dictionary on top of it at modest additional cost .

Coinkite's published migration sequence runs in a specific order, and skipping steps is how people lose funds twice:

• Confirm exposure. Establish whether the seed was generated on affected firmware — check the firmware version in use at seed creation, and whether a qualifying dice sequence was used .
• Update firmware first. Install the fixed release for your model before generating anything new; all patched builds are dated July 31, 2026, and Coldcard's download pages now label vulnerable versions explicitly .
• Generate a replacement seed on the patched device — not a derivative of the old one.
• Verify the new backup and the wallet fingerprint before any funds move, so a transcription error surfaces while the wallet is still empty.
• Verify a receive address on the device screen, comparing it against what your desktop or mobile software displays.
• Send a small test transaction and confirm it arrives and can be spent.
• Move the remaining funds to the new wallet.
• Retain the old backup until the migration is fully confirmed — the compromised seed still controls anything left behind, including change outputs and forgotten accounts .

Two practical notes on timing. Because sweeps have run programmatically since 02:14 UTC on July 30, 2026, migration is a race rather than a chore for anyone holding a plain single-signature balance on an affected seed . And the physical assurances buyers rely on — tamper-evident bags with matching bag numbers, the clear case, firmware-signature checks and the GENUINE LED — verify that the device is authentic and unmodified . None of them can retroactively add entropy to a seed that was created with too little of it.

The Phishing Wave Riding on the Coldcard Panic

A secondary attack wave is now targeting Coldcard owners through social engineering rather than cryptography. Proofpoint documented a campaign impersonating Coldcard that invites users to complete a fabricated "coordinated hardware audit," steering them to a cloned website whose "Start Hardware Audit" button downloads a GitHub-hosted batch file . That file installs ScreenConnect — a legitimate remote-access tool — which hands the operator control of the victim's machine for data theft, financial theft or follow-on ransomware . The lure works because it mirrors the exact action legitimate advisories are asking users to take right now: check your device, urgently.

The operation is staffed, not automated. Proofpoint found a real human — not a chatbot — working the fake site's support chat, walking victims through the installation step by step . That detail matters for defenders: live operators adapt to hesitation, answer objections and manufacture legitimacy in ways a static phishing page cannot. A user who pauses at a security warning gets a reassuring reply instead of a dead end.

Note the shape of the attack chain. Nothing here exploits the entropy defect at all. The sweeps described earlier require no contact with the victim; this campaign requires the opposite — full cooperation from a frightened owner. ScreenConnect is signed, commercially licensed software that antivirus tools are unlikely to block, so the malicious step is not the binary but the consent that installs it.

Rival vendors moved quickly to publish the counter-rules. Trezor warned users to enter a wallet backup only on the device itself, never into a website, chat window or desktop application . Foundation stated flatly that it will never ask for a recovery phrase and will never tell users to install software . Distilled into checks a user can apply in the moment:

• No vendor runs an "audit" that needs your computer. Firmware checks happen on the device screen, not through a downloaded executable.
• A recovery phrase is only ever typed into the hardware wallet itself. Any web form, chat agent or support app requesting one is hostile, without exception .
• A GitHub-hosted file is not a trust signal. Attackers use the platform precisely because the domain looks credible .
• Reach advisories by typing the vendor's domain manually. Coinkite's own advisory and its version-labeled download pages are the reference points — not links arriving by email, DM or search ad .
• Urgency is the tell. Migration is time-sensitive, but no legitimate process collapses if you verify the source first.

The practical risk is compounding: an owner whose seed was generated on unaffected firmware, or protected by 50-plus dice rolls, faces no cryptographic exposure at all — yet can still lose everything by responding to the panic through a fraudulent support channel . During a disclosure event, the incident itself becomes the phishing pretext, and the second wave often catches people the first one never touched.

How Ledger, Trezor and Foundation Are Positioning Against Coldcard

Competing hardware wallet vendors have responded to the Coldcard entropy failure by publicising their own randomness architectures, each arguing that a different structural safeguard would have caught the fault. Ledger points to certified silicon, Trezor to multi-source entropy mixing, and Foundation to reproducible open-source builds. The common thread across all three statements is that no vendor claims Coldcard's specific defect was unique in kind — only that their designs add a second check that a single silently-failing code path cannot bypass .

Ledger's director of product security, Vincent Bouzon, said the company draws entropy from a true random number generator embedded inside a certified Secure Element, with that entropy certified under the AIS-31 PTG.2 standard and Common Criteria evaluation. His framing was deliberately narrow rather than triumphal: "This Coldcard incident was a failure in one specific implementation, not a verdict on secure self-custody" . The implicit argument is that third-party certification forces an external party to test the entropy source, which is precisely the step that never happened for a build flag that silently evaluated the wrong condition.

Trezor chief technology officer Tomáš Sušánka described a different approach: the device blends its own randomness with randomness supplied by the host computer, then runs entropy checks during wallet creation. "The takeaway for the whole industry is that randomness cannot depend on a single source," he said . Foundation chief executive Zach Herbert said Passport combines randomness drawn from separate hardware components and ships open-source firmware with reproducible builds, while making the sharper point about detection latency: "The bug itself was specific to Coldcard... The larger warning is that this went unnoticed for more than five years" .

Beyond the wallet makers, exchange and custody voices pushed for standards rather than marketing claims. Kraken chief security officer Nick Percoco proposed industry-specific assurance standards that would include independent entropy validation, while Onramp Bitcoin head of product Michael Tanguma argued the durable answer is structural: "Today, realistically, you want multisig and independently generated entropy... The mitigation that actually scales is architectural: setups where no single device, vendor or institution being wrong can lose the funds" . Developer Jameson Lopp noted that RNG failures have historical precedent in this industry, and Core Lightning developer Dustin Dettmer helped pin the origin of the defect to the March 2021 firmware change .

Coinkite's own posture has been contrition without remediation funding. Chief executive Rodolfo Novak apologised publicly on X, taking "full accountability for the firmware bug," and no compensation programme has been announced for affected holders . Several Bitcoin developers separately criticised the company's track record on handling vulnerability reports and its lack of a conventional bug bounty programme . For readers evaluating these competing pitches, the useful filter is not which vendor sounds most confident but which safeguard is externally verifiable: certification reports, reproducible build attestations and user-supplied entropy are all checkable by a third party, whereas an assurance that a hardware RNG is being called is not.

What Happens Next for Coldcard and Hardware Wallet Security

The immediate engineering work is finished and the institutional work has barely started. Coinkite has patched all three affected product lines, with fixed releases dated July 31, 2026 , and its download pages now label vulnerable versions explicitly . What remains unresolved is accountability: no compensation programme has been announced, CEO Rodolfo Novak's public apology on X accepting "full accountability for the firmware bug" is the company's only formal gesture so far, and several Bitcoin developers have criticised Coinkite's track record on vulnerability reports and its absence of a conventional bug bounty .

The investigative track is now running in parallel. Galaxy Research has referred roughly 600 suspected attacker-controlled addresses to federal investigators, compliance firms and cross-industry cyber investigators . That referral matters more than usual here because Galaxy counts at least 15 distinct attackers rather than one crew, so any recovery effort has to trace multiple independent clusters instead of a single actor's cash-out path .

Three concrete metrics will tell readers whether this incident is closing or widening over the coming weeks:

• Wave 4 confirmation. The suspected fourth wave flagged on August 3, estimated at 448.7 BTC from 709 addresses, would lift Galaxy's total from 1,596 BTC to roughly 2,055 BTC if verified .
• Movement of dormant proceeds. Roughly 90% of the stolen Bitcoin has not moved, and none of the coins from the first three confirmed waves have shifted at all . Flows toward exchanges or mixing services would signal attackers testing liquidation routes despite the address referrals.
• Whether new sweeps continue. Drained coins had been dormant for an average of 3.18 years , which means the remaining unmigrated victims are the least likely to be watching their addresses.

The industry-level consequence extends well past one vendor. Kraken CSO Nick Percoco has proposed sector-specific assurance standards that include independent entropy validation, and Foundation CEO Zach Herbert framed the durable problem as duration rather than severity: the fault "went unnoticed for more than five years" . Open source did not catch it, because verifying that the hardware RNG was actually invoked required reading a production board configuration file. Expect pressure on multi-source randomness design, third-party reproducible test vectors and factory entropy testing across vendors — not only at Coinkite. Onramp's Michael Tanguma put the architectural case plainly: the mitigation that scales is a setup "where no single device, vendor or institution being wrong can lose the funds" .

The concrete takeaway: if you hold a seed generated on a Coldcard after March 2021 without at least 50 private dice rolls, migrate now rather than waiting for a compensation announcement or a CVE — neither has materialised, and roughly 7,300 addresses have already been drained . For balances large enough that a single vendor error is unacceptable, the structural answer is multisig with independently generated entropy across different device brands, so no one implementation defect can sweep the whole position.

Frequently asked questions

Is my Coldcard seed affected by the entropy flaw?

Check which firmware version was running on the device at the moment the seed was first generated, not the version installed today. Affected ranges are Mk2/Mk3 firmware 4.0.x through 4.1.9 inclusive, Mk4/Mk5 anything before standard 5.6.0 or Edge 6.6.0X, and Q anything before standard 1.5.0Q or Edge 6.6.0QX . Seeds created before the March 2021 firmware release that introduced the defective library are outside the exposure window . Seeds built from at least 50 fair, private, independent six-sided dice rolls are also outside this path, since each D6 roll contributes 2.585 bits and the dice-only workflow hashes the roll sequence directly with SHA-256 . If the roll count is unknown, the rolls were exposed, or the original firmware version cannot be established, treat the seed as exposed and migrate.

Does updating Coldcard firmware fix an already-generated seed?

No. Coinkite states plainly that "updating the firmware does not change or repair an existing seed" . The patched releases dated July 31, 2026 secure future seed generation only; entropy that was never collected cannot be added retroactively to keys already derived from a weak recovery phrase . Restoring the same phrase onto a different wallet brand does not help either, because the weakness travels with the phrase rather than the hardware. The only remedy is to update firmware first, generate a replacement seed on the patched build, verify the new backup and wallet fingerprint, confirm a receive address on the device screen, send a small test transaction, then move the remaining balance and keep the old backup until migration is fully confirmed.

Are TAPSIGNER, OPENDIME or SATSCARD affected?

No. Coinkite confirms that TAPSIGNER, OPENDIME and SATSCARD are officially unaffected because they run on different codebases and never included the `libngu` build path that silently fell back to MicroPython's Yasmarang PRNG . The defect was specific to COLDCARD firmware from the 4.0.x series onward, where the production board sets `MICROPY_HW_ENABLE_RNG` to zero and the library checked whether that macro existed rather than whether it was enabled . Owners of those card products do not need to migrate funds on account of this advisory, though the phishing campaigns impersonating Coldcard support target the wider Coinkite customer base indiscriminately .

Does a BIP-39 passphrase protect an affected seed?

A strong, unique BIP-39 passphrase forms an independent barrier that an attacker enumerating the weak seed space would still have to defeat, but Coinkite frames it as temporary protection pending migration, not a permanent substitute . The company treats weak, reused, patterned, quoted or otherwise common passphrases as guessable, which removes the barrier entirely for anyone who chose a memorable phrase . That matters because the underlying search space is small: researchers put the reproducible space on Mk4/Mk5/Q at roughly four billion possibilities, enumerable on ordinary consumer hardware, with Mk2/Mk3 seeds estimated at around 40 bits versus the 128 bits a 12-word seed should carry . Use the passphrase to buy time, then migrate to a newly generated seed.

How much Bitcoin has been stolen in the Coldcard sweeps so far?

Galaxy Research's confirmed total is 1,596 BTC drained from roughly 7,300 addresses as of early August 2026, rising to approximately 2,055 BTC if a suspected fourth wave flagged on August 3 — estimated at 448.7 BTC from 709 addresses — is verified . The first wave began at 02:14 UTC on July 30, 2026, when a single entity swept 594 BTC from about 500 single-signature wallets in 25 minutes, part of a same-day total of 1,082.65 BTC across 1,196 addresses in 41 minutes . Galaxy counts at least 15 distinct attackers and reports that roughly 90% of the stolen Bitcoin remains untouched, with none of the coins from the first three confirmed waves having moved. Dollar-denominated totals cited across outlets vary widely, so the BTC figures are the more stable reference point .

Enjoyed this article? Subscribe to get new stories by email whenever they're published.

Subscribe