A firmware defect in Coinkite's Coldcard hardware wallet line — undetected for five years and four months — has produced the largest single-vector Bitcoin self-custody loss on record. Three successive attack waves between July 30 and August 2, 2026, drained 1,367 BTC (~$88.6 million) from 4,585 a...
"I've always been skeptical of hardware wallets. You pay a lot of money for a device running code that few people will ever look at, on hardware that could be backdoored with a supply chain attack. Using them with multisig can be reasonable. But singlesig? Sketchy." — Peter Todd, Bitcoin Core Developer
A firmware defect in Coinkite's Coldcard hardware wallet line — undetected for five years and four months — has produced the largest single-vector Bitcoin self-custody loss on record. Three successive attack waves between July 30 and August 2, 2026, drained 1,367 BTC (~$88.6 million) from 4,585 addresses, according to Galaxy Research. The root cause: a March 2021 code change that routed seed generation to a deterministic software pseudorandom number generator (PRNG) instead of the STM32 hardware random number generator (RNG), reducing effective entropy on Mk3 devices from the expected 128 bits to approximately 40 bits.
Block's Bitcoin Engineering and Security teams published the first technical root-cause analysis on July 31. Coinkite shipped emergency firmware the same day and CEO Rodolfo Novak (NVK) issued a public apology accepting full responsibility. The incident has reignited the self-custody versus custodial debate, with multiple analysts suggesting the event may accelerate migration toward regulated custodians and spot Bitcoin ETFs.
| Date | Event |
|------|-------|
| March 1, 2021 | Firmware commit changes seed-generation call from ckcc.rng_bytes to ngu.random.bytes, introducing the RNG bypass |
| July 30, 2026 01:10–01:56 UTC | Wave 1: Attacker sweeps ~594 BTC ($38M) from ~500 single-signature wallets in a 41-minute window |
| July 30, 2026 (afternoon) | Block Engineering publishes technical root-cause analysis; Coinkite issues security advisory |
| July 31, 2026 | Coinkite CEO NVK publishes open letter accepting responsibility; emergency firmware shipped for all affected models |
| July 31, 2026 | Galaxy Research revises loss estimate upward to 1,082.65 BTC (~$70M) across 1,196 addresses |
| August 1, 2026 | Wave 2: Galaxy identifies second sweep of 1,158.66 BTC (~$75.1M) from 2,673 addresses |
| August 2, 2026 | Wave 3: Additional 207.73 BTC drained; cumulative total reaches 1,367 BTC (~$88.6M) across 4,585 addresses |
The vulnerability traces to a single macro configuration error in Coldcard's libngu cryptographic library, according to Block's engineering analysis.
Coldcard's production board configuration defines MICROPY_HW_ENABLE_RNG as zero, because the device provides its own hardware-RNG wrapper. However, libngu checks whether the macro is defined rather than whether it evaluates to a nonzero value. Since the macro exists (set to zero), libngu concludes its hardware path is active and binds to MicroPython's rng_get() function. But MicroPython itself correctly reads the zero value and compiles the Yasmarang software fallback instead of the STM32 hardware peripheral.
The result: seed generation silently falls through to a deterministic PRNG. Yasmarang initializes once on the first call to rng_get(), seeded from nonsecret chip data including the device serial number and timer state. After initialization, no new entropy is collected — every subsequent output is a deterministic state transition.
Entropy reduction by device generation:
| Device | Firmware Range | Effective Entropy | Expected Entropy | |--------|---------------|-------------------|-----------------| | Mk2/Mk3 | 4.0.0 – 5.0.3 | ~40 bits | 128 bits | | Mk4/Mk5 | Pre-5.6.0 | ~72 bits | 128 bits | | Q | Pre-1.5.0Q | ~72 bits | 128 bits |
On Mk3 devices, 40-bit entropy means an attacker with knowledge of the device UID, timer state, and prior RNG-call history can reproduce candidate output streams offline and derive wallet addresses for comparison. On Mk4/Mk5/Q devices, the secure element reseeded from 32 bits of material, lifting effective entropy to ~72 bits — still far below the 128-bit standard but computationally more expensive to brute-force.
The attacker operated with precision. According to CoinDesk, Wave 1 moved 1,324 separate UTXOs across 500 transactions inside a three-block window. Chainalysis confirmed the attacker targeted the largest ballets first — a triage strategy that maximized dollar value per computational cycle.
Galaxy Research tracked three distinct waves, each exhibiting different characteristics:
Galaxy Research stated it believes each wave is the work of a single operator but cannot confirm whether the same attacker is responsible for all three. The cumulative theft across all waves: 1,367 BTC worth approximately $88.6 million. Most affected wallets held less than 1 BTC, but the majority of stolen value came from larger wallets — consistent with individual self-custody users rather than institutional holders.
According to Coinkite's security advisory, the following users are at risk:
High risk (immediate action required):
Elevated risk:
Not affected:
BitBox and Trezor separately confirmed their devices were unaffected. BitBox02 published a technical explanation of why its RNG architecture avoids the class of error.
Coinkite CEO Rodolfo Novak issued an open letter on July 31 stating: "If you generated a seed using a Coldcard wallet, move your funds now, using our updated best practices, before reading further."
NVK accepted full responsibility for the firmware failure and attributed the discovery's speed to AI-assisted code analysis: "We believe this is a sober reality of the new AI paradigm. AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts."
The company released emergency firmware:
| Device | Fixed Version | |--------|--------------| | Mk3 | 4.2.0+ (new seed required on new device) | | Mk4/Mk5 | 5.6.0+ (Standard) / 6.6.0X (Edge) | | Q | 1.5.0Q (Standard) / 6.6.0QX (Edge) |
Coinkite's recommended remediation for at-risk users: (1) create a strong BIP-39 passphrase as an immediate interim measure, (2) generate a fresh seed on fixed firmware or a different device, (3) migrate all funds to the new wallet.
The Mk3 has no architectural fix — the device hardware cannot be patched to resolve the root cause. Users must migrate to a newer device or alternative hardware wallet.
The incident has produced the most significant challenge to Bitcoin's self-custody narrative since the Mt. Gox collapse, albeit from the opposite direction — the failure point was not a centralized exchange but the hardware designed to make self-custody safe.
Peter Todd, Bitcoin Core developer, stated: "It's reasonable to add a hardware wallet in a multisig configuration. But with singlesig, it is probably better to stick with well-audited software on commodity hardware."
Casa CEO Jameson Lopp reported observing partial thefts — wallets where only some outputs had been drained, not the entire balance — suggesting the attacker's seed reconstruction was probabilistic rather than deterministic for some device configurations.
According to CoinDesk, the exploit may accelerate adoption of regulated custodians and spot Bitcoin ETFs. Large amounts of Bitcoin were deposited to centralized exchanges in the days following the initial sweep. The irony is not lost on the community: the hardware designed to eliminate counterparty risk introduced a different, arguably more dangerous form of it — a single point of failure in entropy generation that persisted for five years across multiple device generations and firmware versions.
Binance founder CZ also warned users to verify their hardware wallet security in light of the incident.
The Coldcard flaw raises structural questions about the hardware wallet industry's security verification practices:
Audit coverage gaps: The bug survived five years in open-source code. Multiple firmware releases, multiple device generations, and an unknown number of third-party reviews failed to catch a macro evaluation error in a security-critical code path.
RNG verification is non-trivial: Unlike functional bugs that produce visible errors, an RNG that silently falls back to a weaker source produces outputs that look random. Standard testing (NIST SP 800-22, Dieharder) applied to a small sample of outputs would not reliably detect the entropy reduction.
AI-assisted vulnerability discovery: NVK's statement that AI likely played a role in the exploit's discovery signals a new threat model. If AI tools can identify five-year-old latent bugs in open-source firmware, the attack surface for all open-source hardware wallet projects expands.
Multisig as mitigation: The incident strengthens the case for multisignature custody architectures, where a single compromised signing device does not result in fund loss. No multisig wallets were affected in any of the three attack waves.
#ifdef vs. #if) caused Coldcard devices to use deterministic software PRNG instead of hardware RNG for seed generationThe Coldcard exploit represents a case study in how a single line of code — a macro check that tested for definition rather than value — can cascade into tens of millions of dollars in losses over half a decade. The bug was not sophisticated. It was mundane. That is what makes it significant.
The open-source model, often cited as a security advantage for hardware wallets ("anyone can audit the code"), failed to catch this defect for 64 months across four device generations. The attacker who eventually found it — possibly with AI assistance — executed with surgical precision, draining the highest-value wallets first and expanding to smaller targets in subsequent waves.
For the Bitcoin self-custody community, the lesson is structural: single-signature hardware wallet custody introduces a single point of failure at the entropy generation layer. Multisig architectures, BIP-39 passphrases, and user-supplied entropy (dice rolls) each add independent layers that would have — and in many cases did — prevent this specific attack.
The financial damage ($88.6M and counting) is material but bounded. The reputational damage to hardware wallet self-custody as a category may prove more consequential, particularly as regulated custodians and spot ETF providers position themselves as alternatives.