How a single build flag turned bitcoin’s “safest” wallet into a $116 million liability
A one-line configuration choice, shipped quietly in March 2021, told every Coldcard hardware wallet to ignore its dedicated hardware randomness chip. For more than five years, nobody noticed.
On July 30, 2026, someone did.
Within 41 minutes, an attacker systematically guessed thousands of weak seeds, derived their corresponding keys, and swept 1,816 BTC-roughly $116 million at the time-from more than 5,200 addresses in four tightly coordinated waves.
No phishing emails. No compromised laptops. No stolen devices. No seed phrases left lying around. This was not a human-factors failure; it was a machine-factors failure. The very firmware the industry trusted to generate unbreakable keys had been silently weakening them since day one.
For a community that has repeated “not your keys, not your coins” as a mantra, this incident forces a deeper question: if you don’t audit the code that makes your keys, are they really yours?
—
What actually went wrong in Coldcard’s firmware
The core bug is deceptively small and brutally consequential. Coldcard’s firmware defines a macro:
– `MICROPY_HW_ENABLE_RNG` – a flag meant to control access to the device’s hardware random number generator (RNG).
Coinkite, the maker of Coldcard, ships its own wrapper around the hardware RNG and therefore set this macro to `0` (disabled) at build time. That choice in itself was not fatal.
The problem lived one layer deeper, in the supporting cryptographic library `libngu`. This library contained logic along the lines of:
– “If this macro exists, assume hardware randomness is available.”
It checked for presence of the macro, not whether the macro was set to an enabled value.
Because the macro existed but was explicitly set to `0`, `libngu` incorrectly concluded that it could not use the hardware RNG and fell back to a software-based pseudorandom system: the MicroPython Yasmarang generator.
That fallback:
– Was seeded only once, from the chip’s unique serial number and a few timer registers.
– Did not gather any additional entropy after initialization.
– Produced outputs that, under realistic assumptions, had far less unpredictability than cryptographic standards require.
In other words, the wallet’s “randomness” was not truly random. It was effectively constrained by a limited, guessable space driven by static device data and a small slice of timing state.
—
From 128 bits of entropy to 40: how strong keys turned weak
A standard 12-word BIP-39 seed phrase is supposed to encode 128 bits of entropy. In practical terms:
– 128 bits ≈ 3.4 × 10³⁸ possibilities.
– Brute-forcing that space is so far beyond conceivable computation that it’s effectively impossible. It would take more energy than the sun will produce in its remaining lifetime.
Coldcard’s broken RNG changed that picture completely. Security analysis of the fallout found:
– On Coldcard Mk3 devices, the Yasmarang-based process yielded about 40 bits of effective entropy.
– On Coldcard Mk4, Mk5, and Q models, it produced roughly 72 bits of effective entropy, with upper bounds estimated around 2⁷³ possibilities-but critically, not equivalent to a full 73 bits of cryptographic security due to structural biases and constraints in how seeds were derived.
These numbers sound abstract, so here’s what they mean in practice:
– 40 bits of entropy ≈ 1 trillion (10¹²) possibilities.
– 72-73 bits ≈ 4.7 × 10²¹ possibilities. Large, but not outside the range a determined, well-funded attacker can explore using targeted optimizations and modern GPU or ASIC clusters.
Forty bits, in particular, is a devastatingly small search space. For human intuition, a trillion is enormous; for parallelized computing, it is a long weekend.
—
How the attacker turned weak entropy into a $116M sweep
The attacker never needed physical access to any wallet. They never intercepted USB connections, never hacked Wi‑Fi, and never spied on user screens. The attack could be conducted entirely offline, then executed against the live blockchain.
The likely attack process looked roughly like this:
1. Model the bugged RNG
– Understand how Yasmarang was seeded-from the device’s serial number and timer state.
– Deduce constraints: range of serial values, timing jitter, internal counters.
2. Generate candidate seeds
– Enumerate all plausible combinations of serial numbers and timer states.
– Run the same seed-generation code Coldcard firmware used, but locally, at scale.
– Produce massive lists of candidate BIP-39 seeds that could realistically have been generated by affected devices.
3. Derive keys and addresses
– For each candidate seed, derive the corresponding master keys and standard wallet addresses, just as a legitimate wallet does.
4. Scan the blockchain
– Check which of these derived addresses actually existed on-chain and held funds.
– This step is embarrassingly parallel: each candidate can be tested independently.
5. Sweep in waves
– Once a list of “real” vulnerable addresses was assembled, the attacker could sign transactions from those private keys and send coins to their own consolidation addresses.
– The sweeps took place in four bursts across less than an hour, giving victims virtually no reaction time.
The combination of limited entropy, deterministic derivation, and a public blockchain turned the entire exploit into a search problem-one that modern computing could solve fast enough to pull off a synchronized heist.
—
The four attack waves: a brief anatomy
On-chain analysis shows the theft did not happen as a single, monolithic transaction batch but as distinct waves, suggesting a carefully staged operation:
1. Probe and confirm
– Initial smaller movements likely served as a sanity check: confirming the attacker’s model of the flawed RNG and derivation path was correct.
2. Main sweep
– Once validated, the attacker executed large consolidations from thousands of vulnerable addresses, draining the majority of the 1,816 BTC quickly before defenders could react.
3. Stragglers and error-correction
– Additional transactions picked off remaining balances, corrected earlier omissions, or covered additional derivation paths (e.g., alternative account indexes, change paths).
4. Obfuscation and redistribution
– Subsequent movements began the process of splitting, mixing, and re-routing stolen funds to complicate tracing efforts, even though chain analysis can still identify the overall flow.
The compressed timeline-41 minutes end to end-strongly indicates the victim set was precomputed long before the heist. When the attacker “pressed go,” everything was already mapped.
—
“I did everything right” – and still lost millions
The chilling part of this story is not just the scale of the theft but who it hit.
Canadian entrepreneur Jonathan Goodman, who lost 18.25 BTC (about C$1.6 million at the time), stored his Coldcard in a safety deposit box. His operational security checked every conventional box:
– Air-gapped cold storage.
– No obvious digital fingerprints.
– Physical separation between keys and everyday life.
Yet his funds vanished anyway, because the weak point was not his behavior-it was the firmware he trusted. His reaction distilled the mood across affected holders:
> “Perhaps the hardest part about this is that I did everything right.”
These were not novice retail users clicking random links. Many were long-time bitcoiners, the type who actively avoided custodial solutions and followed best practices religiously. Their single “mistake” was something they could never reasonably audit themselves: assuming that the device’s randomness was truly random.
—
What 40 bits of entropy *actually* means
A section a competitor would struggle to write honestly is the one that confronts the math. Hardware wallet marketing leans heavily on phrases like “military grade” and “strong cryptography,” but the Coldcard incident exposes how fragile that assurance becomes when entropy collapses.
To frame the numbers:
– A 40-bit space has 2⁴⁰ ≈ 1,099,511,627,776 possible values.
– If you can test 1 billion candidates per second using a GPU cluster (which is realistic for optimized code), that entire space can be swept in under 20 minutes of pure computation time. Parallelization and precomputation can make it even faster in practice.
– A 72 or 73-bit space (2⁷²-2⁷³ possibilities) is much larger, but not inviolable.
– Attackers don’t always need to cover the entire space. They can target subsets shaped by real-world constraints (manufacture dates, serial number ranges, typical user configurations), slashing the effective search space dramatically.
Compare that to the intended 128 bits of entropy for a proper 12-word seed:
– 2¹²⁸ ≈ 3.4 × 10³⁸ possibilities.
– Even if you could test a trillion (10¹²) seeds per second for the age of the universe, you would have effectively no chance of stumbling onto a specific target.
Coldcard’s bug didn’t just weaken keys-it transformed them from “unsearchable in the lifetime of the cosmos” into “feasible to brute-force on a motivated attacker’s hardware.”
—
The self-custody shock: bitcoin flows back to exchanges
The philosophical fallout may end up bigger than the direct financial loss.
Self-custody has long been portrayed as the final boss of bitcoin security:
– Don’t trust exchanges.
– Don’t trust banks.
– Hold your own keys on a hardware wallet and you are sovereign.
The Coldcard exploit shattered the simplicity of that narrative. Following the hack, on-chain data shows a marked uptick in coins moving back to centralized exchanges and custodial platforms-something not seen at this scale since the FTX collapse.
The migration is driven by uncomfortable questions:
– If even the “most trusted” hardware wallet can be fatally misconfigured for five years, how can a non-technical user verify that *any* device is safe?
– Is relying on a professional custodian, with internal security teams and explicit insurance, actually less risky than trusting opaque firmware that a small team controls?
– How should risk be balanced between self-custody’s technical attack surface and custodial solutions’ regulatory and counterparty risks?
The answer is not that exchanges suddenly became “safe.” Rather, the perceived risk profile of self-custody hardware just changed. The trade-off is no longer purely about personal discipline and operational mistakes; it now clearly includes sophisticated software supply-chain errors.
—
Did AI find the bug? The machine-review question
Coinkite’s CEO suggested that artificial intelligence may have helped uncover the vulnerability. Whether that claim is accurate or not, it raises a new and unsettling dimension:
– Every open-source firmware repository is now a dataset.
– Every subtle crypto misuse, misconfigured macro, or entropy leak is a pattern a capable model can detect.
– Attackers can point large language models and specialized analysis tools at codebases and let them propose candidate vulnerabilities at scale.
If human reviewers missed a one-line build flag problem for five years, but an AI-assisted adversary can spot it in hours, the review asymmetry is stark.
This cuts both ways:
– Defenders can use AI to audit code, fuzz cryptographic flows, and simulate attack paths.
– Attackers can use the same or better tools, without disclosure obligations, purely for exploitation.
The Coldcard hack may be an early example of what happens when “AI-augmented red teams” systematically harvest low-hanging cryptographic fruit from widely used open-source projects.
—
Are other hardware wallets affected?
So far, the Coldcard incident appears tied to a very specific integration error between:
– A hardware RNG configuration macro.
– The MicroPython environment.
– The `libngu` cryptographic library’s misuse of that macro.
However, the broader class of failure-entropy-related mistakes in key generation-is not unique to any one vendor. Other wallets could in theory be vulnerable if:
– They misconfigure or misread hardware RNG capabilities.
– They fall back to software RNGs seeded with low-entropy or predictable values.
– They introduce deterministic or patterned behavior into seed generation to simplify testing or debugging and fail to disable it for release builds.
The responsible question for users is not “Which brand is immune?” but:
– Who independently audits the seed generation code?
– Is there a transparent process to verify the quality and source of randomness?
– Can independent researchers reproduce and validate entropy measurements on real devices?
At the time of writing, no comparable RNG misconfiguration has been publicly tied to another major hardware wallet vendor, but the Coldcard case has prompted urgent reviews across the industry.
—
Does updating Coldcard firmware fix the problem?
Patching the firmware can:
– Correct the RNG usage.
– Ensure new seeds and new keys are generated with proper entropy going forward.
But it cannot retroactively strengthen keys that were already created under the flawed regime. If your seed was generated while the vulnerability was active, its entropy is forever limited. The patch does not “upgrade” those keys into something stronger.
For affected users, the only robust remediation is:
1. Create a brand-new wallet using firmware that has been independently verified to handle randomness correctly.
2. Move all funds from addresses derived from the compromised seed to addresses derived from the new, properly generated seed.
If funds were already swept, there is no technical recovery path. Once a private key has been used to sign a transaction, and an attacker holds that same key, the loss is final.
—
Is self-custody still safe after the Coldcard hack?
Self-custody remains the only way to truly avoid counterparty risk, regulatory seizure, and custodial failure. This incident does not change that fundamental reality-but it reveals that:
– “Self-custody” is not synonymous with “plug in a device and forget about it.”
– Trust is not eliminated; it is shifted-from an exchange’s solvency to a hardware manufacturer’s engineering practices and supply-chain security.
What changes going forward is the standard for what “secure” hardware means:
– Independent, repeatable audits of seed generation and randomness.
– Transparent bug disclosure and firmware development processes.
– Cryptographic design that minimizes the impact of single-flag or single-macro misconfigurations.
For sophisticated users, multi-vendor setups (e.g., multisig with different hardware wallets from unrelated manufacturers) can reduce single-device risk. Even if one vendor suffers a catastrophic failure, the attacker cannot move funds without compromising the others.
—
Should you move your bitcoin to an exchange now?
Moving funds to an exchange is not a universal prescription; it simply trades one set of risks for another. Before reacting, consider:
– Custodial risks:
– Exchange insolvency, hacks, regulatory freezes.
– Limited or no legal recourse in many jurisdictions.
– Hardware risks:
– Firmware bugs like the Coldcard RNG issue.
– Potential supply-chain tampering or physical interception of devices.
– Operational risks:
– Your own mistakes in managing backups, passphrases, and recovery processes.
For many holders, a balanced approach may be wiser:
– Keep a portion of holdings on reputable, regulated custodians if they need liquidity or institutional-level service.
– Store long-term savings in self-custody, but diversify devices and apply more rigorous due diligence to firmware and vendor practices.
– Use multisig where feasible to avoid any single point of failure-whether that failure is a miscompiled RNG or an exchange bankruptcy.
The Coldcard hack does not prove that exchanges are “safer.” It proves that unexamined assumptions about hardware infallibility are dangerous.
—
What to watch in the months ahead
The repercussions of this incident will unfold over years, not days. Key developments to monitor include:
1. Industry-wide RNG audits
– Expect wallet vendors to trumpet new or existing audits of their randomness and key generation logic. The quality and independence of these audits will matter more than the marketing.
2. Standardization of entropy testing
– The ecosystem may push toward shared, open test suites for verifying key-generation entropy on real hardware, not just in simulated environments.
3. AI-driven security arms race
– Both offensive and defensive teams will lean harder on automated code analysis, symbolic execution, and AI-based pattern detection. The Coldcard case is strong evidence that the manual-review era is over.
4. Legal and reputational fallout
– Lawsuits against vendors, pressure from large affected holders, and possible regulatory interest could shape how hardware wallets are built and marketed in the future.
5. User education upgrades
– Guides that once focused solely on avoiding phishing and backing up seed phrases will need to incorporate new considerations: vendor selection, firmware provenance, and cross-checking entropy where possible.
—
Frequently Asked Questions
What is the Coldcard hardware wallet hack?
It is a large-scale exploit of a five-year-old firmware flaw in Coldcard hardware wallets that caused them to generate private keys with severely reduced randomness. An attacker leveraged this weakness to brute-force seed phrases and drain affected wallets without ever touching the physical devices.
How much bitcoin was stolen in the Coldcard exploit?
A total of 1,816 BTC-over $116 million at the time of the incident-was stolen from more than 5,200 addresses in four rapid attack waves.
What caused the Coldcard vulnerability?
A misconfigured build flag (`MICROPY_HW_ENABLE_RNG`) and a flawed assumption in the `libngu` library. The firmware set the hardware RNG flag to zero, but the library only checked whether the flag existed, not whether it was enabled. As a result, the system silently fell back to a weak software RNG seeded with limited, predictable data.
Does updating Coldcard firmware fix the problem?
Updating the firmware prevents new keys from being generated with the flawed randomness, but it does not strengthen any existing seed phrases created under the vulnerable firmware. If your seed was generated during the affected period, you must move funds to a new wallet with properly generated keys to be safe.
Which Coldcard models are affected?
The flawed randomness affected multiple generations: Mk3, Mk4, Mk5, and Q, though the severity varied. Mk3 devices saw roughly 40 bits of effective entropy; later models were somewhat stronger but still far below the intended cryptographic standard.
Are other hardware wallets affected?
No identical vulnerability has been publicly tied to other hardware wallets to date, but the general class of failure-poor entropy or RNG misconfiguration-could in principle exist elsewhere. The Coldcard incident has triggered widespread re-examination of key-generation mechanisms across the industry.
Is self-custody still safe after this incident?
Self-custody is still the only way to fully avoid custodial and counterparty risk, but it is not automatically safe. Users now need to factor in firmware quality, independent audits, and vendor transparency when choosing hardware, and consider diversification strategies such as multisig across different wallet brands.
Should I move my bitcoin to an exchange because of this?
Not automatically. Moving to an exchange replaces firmware-risk with counterparty-risk. For many users, a hybrid approach-combining carefully audited self-custody solutions with selective use of trusted custodians-may be more appropriate than an all-or-nothing shift.
—
A single build flag, misunderstood by a supporting library, turned one of bitcoin’s most respected hardware wallets into a time bomb. For five years, that bomb quietly ticked inside tens of thousands of devices whose owners believed they were doing everything right.
The lesson is not to abandon self-custody. It is to finally confront the question the ecosystem has avoided for too long: who watches the code that watches your keys-and how do you know they did their job?