A critical firmware vulnerability in Coldcard hardware bitcoin wallets by Coinkite allowed attackers to steal about 1,367 BTC (valued at up to $89 million) from over 4,500 addresses in a series of coordinated attacks in the past week.
An initial coordinated sweep drained 594 BTC (~$38 million) from roughly 500 wallets in just 25 minutes, targeting the highest-value dormant accounts. The attack expanded to 1,082 BTC across 1,196 addresses within a 41-minute window, with attackers using elevated transaction fees to ensure rapid confirmation.
Cumulative losses reached 1,367 BTC across 4,585 addresses, with attackers continuing to exploit the vulnerability as other actors joined in.
The flaw, present since March 2021, caused affected devices to generate wallet seeds with significantly reduced entropy—40 bits for Mk3 devices and 72 bits for later models—instead of the intended 128 bits, by silently falling back to a predictable software-based random number generator instead of the hardware RNG.
A 2021 code commit introduced a library (`libngu`) that used a preprocessor check which only verified if a macro was defined, not if it was enabled. This caused the device to bypass its secure hardware random number generator.
The fallback software generator relied on non-secret data like chip IDs and internal clock values, creating a search space small enough for attackers to brute-force private keys offline.
Mk3 units running firmware 4.0.0 or later were most severely impacted. Mk4, Mk5, and Q devices were also vulnerable, though with slightly higher entropy (~72 bits).
The bug remained undetected through five years of updates and AI-assisted audits, as the generated seeds appeared valid but lacked true randomness.
The stolen Bitcoin remains largely unspent, held in a small number of attacker-controlled addresses, with analysts suggesting this is a deliberate strategy to avoid capture by authorities and triggering immediate market panic.
Galaxy Research identified about 600 suspected attacker addresses and reported them to federal investigators, compliance firms, and cybersecurity teams. Block, Jack Dorsey’s company, published an independent technical analysis confirming the RNG flaw.
Coinkite released patched firmware and urged users to transfer funds to new, secure wallets. Crucially, users were warned that updating the device does not fix old seeds; users must generate entirely new seeds using the updated firmware.
In an update on X Tuesday, Coinkite wrote in part: "We understand there is real anger at this moment. Users have suffered real losses, and for those impacted, no public statement is enough.
"We continue to support affected customers directly and urge others to reach out to any other users they are aware of who may be affected. Urgently: if your seed was generated with our affected firmware, without at least 50 independent, private dice rolls, and your funds aren't protected by a strong, unique BIP-39 passphrase, move those funds to a new wallet now.
"As independent researchers have publicly corroborated, this firmware bug appears to have lived at a boundary between two unrelated submodules, not in the parent code, and not in the cryptographic or Bitcoin-specific logic that are the subject of most internal and third-party reviews.
"Because the flag check looked correct, the bug silently went unnoticed, and its potential impact grew with every release.
"We believe it’s important for the broader ecosystem to understand how this bug arose, and why it evaded detection, so they can avoid similar consequences.
"We know there are questions about our own use of AI in code review. We'll cover this fully in our post-mortem, but given the active investigation right now, here's what we can say immediately.
"We've run AI-assisted review against our critical codebases, including in the weeks before the exploit. It did not catch this vulnerability. Since the incident, we've also tested our code against frontier models, including Kimi K3, Claude Fable, and Codex 5.6. None of them caught it.
"It's a reason for us, and anyone else relying on AI tools, to be specific about what it currently catches and what it might not."
The ColdCard incident highlighted that hardware wallet security is only as strong as its entropy generation, prompting competitors like Ledger and Trezor to reaffirm the security of their own TRNG implementations.
