A flaw in the software that runs Coldcard hardware wallets quietly weakened the “randomness” used to create some users’ Bitcoin wallets – in the worst cases badly enough that a well-resourced attacker could guess the keys. The maker, Coinkite, disclosed the problem on July 30, 2026, released emergency fixes for every affected device, and is urging a large group of owners to move their coins to a freshly generated wallet.
Reports of coins being stolen from affected wallets have been circulating and climbing since the disclosure. The exact totals are still moving and not all of them are verified, but Coinkite itself describes the danger to unprotected wallets as “a direct security risk, not a theoretical possibility.”
🚨URGENT COLDCARD SECURITY UPDATE
Read carefully before acting.
👉Mk3 seed generated on 4.0.1+ without ≥50 private, independent dice rolls: begin a careful migration now.
👉Mk4/Mk5 <5.6.0 or Q <1.5.0Q: update first, generate a new seed, then migrate.https://t.co/HshUxevCl3 https://t.co/zrkUuACRyE
— COLDCARD (@COLDCARDwallet) July 31, 2026
How Much Has Been Stolen
So far, more than 1,100 BTC – roughly $71 million – has reportedly been drained from vulnerable wallets, and the number is still climbing. That figure comes from on-chain trackers and social media, not from Coinkite, so treat it as a moving estimate rather than a final total.
The total keeps rising because attackers appear to have worked out the likely keys in advance. Even though these wallets were offline and air-gapped, once a vulnerable wallet receives coins they can be swept almost immediately. Some coins are reported to have been drained years after the keys were first computed.
What a Hardware Wallet Is Supposed to Do
A hardware wallet like the Coldcard is a small offline device that generates and stores the secret keys to your Bitcoin. The heart of it is a “seed phrase” – usually 12 or 24 English words – that is created from a large random number the moment you set up the device.
The security of that seed rests entirely on the number being genuinely unpredictable. A properly generated seed is one of an astronomically huge set of possibilities – on the order of a 340 followed by 36 zeros. Guessing it is effectively impossible.
The bug did not shrink the word list or make the words look odd. Affected seeds look completely normal. What changed was how the device picked the number – and that is where the danger hid.
What Went Wrong
Every computer chip that generates keys needs a source of randomness. The Coldcard was designed to use a dedicated hardware random-number generator (a “TRNG,” true random-number generator) baked into the device. Instead, on affected firmware, seed creation quietly fell back to a software random-number generator (a “PRNG,” pseudo-random generator) that came bundled inside a MicroPython software component.
A PRNG is not truly random. It produces numbers from a starting “seed value,” and on the Coldcard that starting value was drawn largely from predictable things – device identifiers and internal timing state. If an attacker can narrow down those inputs, they can narrow down the range of possible wallet seeds from astronomically huge to merely large – and “merely large” can be searched by a computer.
By Coinkite’s own early estimates of the reduced strength:
- Coldcard Mk3 (the hardest hit): about 40 bits of effective strength instead of 128. That is small enough to be brute-forced.
- Coldcard Mk4, Mk5, and Q: about 72 bits. Better, because these newer models mixed in extra randomness from their secure-element chips – but still well short of the intended target, and still described by Coinkite as serious.
To put 40 bits in perspective: instead of choosing from that 340-followed-by-36-zeros pool, the wallet was effectively choosing from a pool small enough that dedicated hardware could work through it.
The Root Cause
The mistake traces back to a March 2021 change, when Coinkite moved the Coldcard’s core cryptography onto the same well-trusted library used by Bitcoin Core. During that migration, the seed-generation code switched to a function that – across two software submodules – resolved to the wrong random-number implementation. Both the correct and the incorrect versions had the same name and shape, so nothing visibly broke and the device kept working normally.
A safety check that should have stopped this was itself subtly broken: it tested whether a setting was defined rather than whether it was switched on. The setting had been defined as “0” (off), so the guard never triggered and the flawed build went out the door. Coinkite says its own earlier code reviews confirmed the correct random-number code was present in the firmware, but never verified that the seed-generation path actually reached it.
Which Devices and Versions Are Affected
Affected firmware – do not generate a new seed on these until you update:
- Mk3: firmware 4.0.1 through 4.1.9 (roughly March 2021 onward)
- Mk4 / Mk5 (standard track): anything before 5.6.0
- Q (standard track): anything before 1.5.0Q
- Mk4 / Mk5 (Edge track): anything before 6.6.0X
- Q (Edge track): anything before 6.6.0QX
Fixed firmware, now available for every model:
| Model | Standard track | Edge track |
|---|---|---|
| Mk3 | 4.2.0+ | — |
| Mk4 / Mk5 | 5.6.0+ | 6.6.0X+ |
| Q | 1.5.0Q+ | 6.6.0QX+ |
Coinkite warns that “Standard” and “Edge” are separate tracks. Don’t assume an older Edge release is safe just because its version number looks higher than the standard one – install the specific fixed release for your model and track.
Not affected: TAPSIGNER, OPENDIME, and SATSCARD, which run entirely different code. Wallets from other makers such as Ledger and Trezor are unrelated to this particular bug.
Who Is Not at Risk
Two groups of affected-firmware users are considered safe from this specific flaw. This is an important correction to some of the viral summaries, which have been inconsistent about it.
1. You added enough dice rolls. The Coldcard lets you mix in your own randomness by rolling a physical die. That independent entropy sat on top of the device’s flawed number and was not damaged by the bug. Per Coinkite:
- 50 to 98 fair, independent, private rolls contributed at least 128 bits on their own – enough.
- 99 or more contributed roughly 256 bits.
- Fewer than 50, or you don’t remember: treat the seed as at risk and migrate.
The rolls only count if they were fair, independent, and never recorded, photographed, or exposed.
2. You used a strong BIP-39 passphrase. A passphrase (the optional extra secret word or phrase – not your device PIN) creates a separate wallet and adds an independent barrier. If it is strong, unique, and secret, the weakened seed alone is not enough to reach your funds. But a short, common, patterned, quoted, or reused passphrase can be guessed. And even with a strong one, Coinkite still recommends migrating “as soon as practical,” because the underlying seed remains weak.
Updating Does Not Fix Your Existing Seed
This trips people up, so it’s worth stating plainly. Installing the new firmware corrects future seed generation only. It does not repair a seed that was already created on the buggy firmware. If your at-risk seed was generated before the fix, you must generate a brand-new seed and move your coins to it.
What Affected Owners Should Do
Coinkite’s repeated advice is to move deliberately, not in a panic – a rushed migration can lose more money than the bug. The broad steps:
- Update first. Install the fixed firmware for your exact model and track, and confirm the version on the device screen.
- Generate a completely new seed on the updated device. On the fixed firmware, the device’s own randomness is now sufficient – extra dice rolls are optional, not required.
- Back it up and verify the written backup, the wallet fingerprint (XFP), and a receive address before sending any funds.
- Send a small test transaction to the new wallet and confirm it arrives.
- Only then move the rest of your balance.
- Keep the old backup until every coin has arrived and confirmed in the new wallet.
If a Mk3 is your only device, the migration can still be done on it alone by carefully alternating between the old and new seeds – Coinkite publishes step-by-step guidance for that case. Owners comfortable with advanced procedures can also build a dice-only seed (99+ rolls) that bypasses the device’s generator entirely.
Watch Out for Scammers
A disclosure like this is a magnet for thieves. Fake “support” accounts are already sliding into people’s direct messages posing as Coldcard or Coinkite staff. Some guidance to keep in mind:
- No legitimate party will ever ask for your seed words or passphrase. Anyone who does is trying to rob you.
- The real migration happens on the device. You never type your seed or passphrase into a website, app, or “recovery tool.”
- Verify firmware only from Coinkite’s official download pages, and double-check the version numbers above.
The Uncomfortable Footnote
Coinkite’s code has always been open source, and the bug still sat undiscovered for years. In its technical write-up the company says it now assumes someone used AI to comb through the published firmware and found the flaw. Notably, Coinkite says it had itself run one of the best available AI models over its code only weeks earlier looking for security problems – and it missed this one. As the company put it, defenders and attackers now hold the same tools; this time the tools helped the attackers first.
Coinkite says its investigation is ongoing and that a fuller technical review will follow.
