Coldcard entropy failure

A check tested whether a configuration setting existed rather than whether it was enabled. The check passed, the hardware random number generator was bypassed, and the firmware fell back to a software generator seeded from guessable values. On newer models a secure-element reseed exists but retains only four bytes. Coinkite added on August 4 that the defect sat at a boundary between two unrelated submodules, "not in the parent code, and not in the cryptographic or Bitcoin-specific logic that are the subject of most internal and third-party reviews", and that because the flag check looked correct it went unnoticed while its impact grew with every release. Its own disclosure record attributes the random-byte fallback to a library migration.

Coinkite's advisory, updated August 1, states that seeds generated on Mk4, Q and Mk5 before the fixed releases are also affected, with about 72 bits of entropy rather than the expected 128. Mk2 and Mk3 are estimated at about 40 bits. Block quantifies the newer-model weakness differently, reporting that the reseed contributes at most 32 bits. Both agree on scope; they differ on magnitude.

The affected range begins at firmware v4.0.1, released March 2021, and the defect remained in publicly readable open-source code for roughly five years.

Galaxy Research confirms 1,596 BTC, just over $100M at August 4 prices, taken from roughly 7,300 addresses across three attack waves plus fourteen smaller incidents. Galaxy states the total is based on victim reports and on-chain analysis and that it holds the figure with high confidence. Around 73 victims have come forward. Read "confirmed" as one firm's assessment corroborated by victim reports, not as audited or adjudicated: 73 reports anchor a pattern across roughly 7,300 addresses rather than validating each one.

A fourth wave would raise the total to approximately 2,055 BTC, around $130M. Galaxy assesses with medium-high confidence that it is substantially the work of the same attacker but states it has not been confirmed by any victim, and has deliberately kept it out of its headline figure. The exploit remains active. Earlier snapshots of roughly 1,367 BTC and roughly 1,816 BTC were accurate when published and are superseded.

Galaxy reports that roughly 90% of the stolen coins remain unmoved, including all of the coins taken in waves one to three. Galaxy offers two readings: the operator is waiting for scrutiny to fade, or has no viable way to launder a sum this visible. Separately, on-chain analyst Willy Woo puts the odds of partial recovery at 20 to 40%, likely taking years.

Unlike the earlier waves, sweeps in the suspected fourth wave signal replace-by-fee. A holder who sees their own address being swept in the mempool has a short window to broadcast a competing transaction at a higher fee and move the funds first. This is a narrow escape hatch, not a defence, and it only helps someone already watching.

Coinkite states it ran AI-assisted review against its critical codebases in the weeks before the exploit and that it "did not catch this vulnerability". After the incident it re-tested against frontier models, naming Kimi K3, Claude Fable and Codex 5.6, and reports that none of them caught it either. Its own disclosure record logs an enterprise AI firmware review on June 26, 2026, roughly a month before the theft began, that produced 85 candidate findings without surfacing this one. Coinkite recommends that teams relying on AI review of security-critical code test it specifically against build and submodule boundaries. This is the vendor's own account of its process and Proof of Custody has not verified it, but it is a rare public data point on where automated review currently fails: at the seams between components rather than inside the cryptography.

Alongside the August 4 update Coinkite published a page recording known public security research, coordinated disclosures, professional audits, internal findings and advisories affecting Coldcard devices: 23 events from 2019 to August 2026, of which 12 show public evidence of coordinated disclosure. It is vendor-maintained and therefore self-selected, but it is a real primary artifact and more than most hardware vendors publish. We are treating it as a research source rather than as an independent audit.

Coinkite states that the patched firmware prevents the issue for newly generated seeds and does not repair or restore security to a seed already generated on vulnerable firmware. Affected holders must generate a new seed on fixed firmware and move funds to it.

Coinkite states that funds are at risk if the seed was created without at least 50 independent, private dice rolls and the wallet is not protected by a strong, unique BIP-39 passphrase. Fifty fair rolls contribute at least 128 bits on their own, which is why that path is treated differently.

Coinkite destroyed its remaining inventory manufactured with the vulnerable firmware and halted shipment when the vulnerability was confirmed. It states that its legal team will coordinate as warranted with law enforcement across multiple jurisdictions, which is a conditional commitment rather than confirmation of an active investigation. Galaxy Research has referred roughly 600 suspected attacker addresses to US federal investigators, exchanges and compliance firms; no indictment, seizure or agency statement has followed. It has also pointed users to alternative devices while they decide next steps, naming Bitkey, Ledger, Trezor, Jade and BitBox. Bitkey is made by Block, the company that published the competing engineering analysis.