A hardware wallet exists to do one thing well: generate a secret nobody else can guess, and keep it off general-purpose computers. COLDCARD's firmware got the first half wrong.
The device has an STM32 hardware random number generator. The firmware, in the affected builds, did not use it. It fell back to MicroPython's Yasmarang — a deterministic pseudo-random generator — seeded from the microcontroller identifier and system timing.
Neither of those is a secret. Both are potentially observable or reconstructable, which means the search space for a seed collapses from astronomically large to something you can grind through offline and check against the blockchain.
The timeline is the ugly part
30 July 2026 — Block's Bitcoin Engineering and Security teams, investigating reports of thefts, identified the flaw and disclosed it to Coinkite. Coinkite published its advisory the same day.
Roughly 30 hours before that disclosure, someone started emptying wallets.
Galaxy Research mapped the sweep:
| Wave | Date | Taken | Addresses |
|---|---|---|---|
| 1 | 30 July | 1,083 BTC (~$70.2m) | 1,196 |
| 2–3 | 1 Aug | +284 BTC | — |
| Total | 4,585 |
The first wave ran for 41 minutes.
How they know it was automated
Every transaction used an identical fee rate of 30 satoshis/vB — between 30 and 75 times the going rate — and none produced change outputs. Galaxy Research's read is that this is an automated tool spending keys it already held, paying whatever it took to confirm fast and not caring about cost.
Chainalysis adds that the attacker went for high-value wallets first: about $30 million in the first ten minutes, and $1.8 million from a single victim. That ordering implies the target list was built before the sweep began, not discovered during it.
Which devices
Seeds generated on:
- Mk2, Mk3 — firmware 4.0.1 through 4.1.9
- Mk4, Mk5 — before 5.6.0 (or Edge 6.6.0X)
- Q — before 1.5.0Q (or Edge 6.6.0QX)
TAPSIGNER, OPENDIME and SATSCARD were not affected.
The bit people will get wrong
Coinkite has shipped fixed firmware — 4.2.0+, 5.6.0+, 1.5.0Q+.
Updating the firmware does not fix a seed that already exists. The weak secret was generated once, at setup, by the old code. Patching the device changes how the next seed is made and nothing about the current one.
Anyone whose seed came from an affected build needs to upgrade and then generate a new seed, moving funds across.
Seeds strengthened at setup with 50+ fair dice rolls or a strong BIP-39 passphrase are materially less exposed, because the entropy did not come solely from the broken source — but migration is still the recommendation.
Coinkite says it destroyed affected devices still awaiting shipment and emailed customers who had already received them.
What this generalises to
The causal link between the flaw and the theft is researchers' assessment rather than a proven chain, and it is worth stating that plainly. The circumstantial case — the timing, the automation, the target selection — is strong.
The transferable lesson is narrower and older than cryptocurrency: a fallback path is a code path. Someone wrote a graceful degradation from hardware RNG to software PRNG, which is reasonable engineering in most contexts and catastrophic in this one, and the fallback ran in production for years without anyone noticing that the safety net was the failure.
If a system's security rests on entropy, the thing to test is not that it produces random-looking output. It is which generator actually ran.
