Coldcard Hardware Wallet Flaw Exposes Millions in Bitcoin to Theft

Offline storage was believed to be invulnerable.

Coldcard hardware wallets were designed to sign transactions within a closed environment, ensuring private keys never touched any network-accessible component.

That security model remained unchallenged for over five years, even as a firmware vulnerability made wallet seeds guessable from a small set of device and timing variables.

A compilation mishap replaced true hardware-based randomness with a deterministic software alternative, reducing the difficulty of predicting a wallet's seed from astronomical odds to something computationally feasible.

No phishing, malware, or physical compromise was needed. Attackers could independently compute possible wallet seeds, derive addresses, and compare them to blockchain data; once a match was identified, control of the associated private key followed.

Galaxy Research has estimated total losses may have reached approximately 2,055 BTC—about $130 million—with investigators still working to identify all affected wallets. Thousands of users lost funds despite adhering to best practices for self-custody.

If a security lock can be opened simply by calculation, was it ever really secure?

Credit: Block Engineering Blog, decrypt, Galaxy Research, TechCrunch, Block's Engineering Blog, Coinkite, nvk, Literatecode, Alex Thorn, TRM Labs, Thomas Braziel, Cris Carrascosa, Criptolawyer

Coldcard users were the first to notice, as is often the case with victims: Their funds vanished without any transactions they recalled authorizing.

On July 30th, from 01:10:20 to 01:51:26 UTC, 1,196 wallets lost a total of 1,082.65 BTC, during blocks 960,183 to 960,191.

Block’s engineering team began investigating that same day, prompted by user reports rather than automated alerting.

The investigators observed a recurring pattern in the compromised wallets; Galaxy Research mapped the flows the next day, tracing the 1,082.65 BTC (about $70 million at the time) from those addresses.

Coinkite issued an initial warning the same day, advising Mk3 users who created seeds with firmware versions 4.0.1 to 4.1.9 to take precaution.

NVK, CEO of Coinkite, issued a public apology the following morning, accepted responsibility for the firmware flaw, and recommended users migrate funds to wallets generated with new seeds.

A firmware update by itself would not remediate the issue; Coinkite clarified that any pre-patch seeds needed to be replaced, not just updated.

The scope of losses kept growing. By August 3rd, Galaxy Research reported that the total stolen in the Coldcard breach surpassed $100 million.

[Their high-confidence count was 1,596 BTC missing from about 7,300 wallets over three main incidents and 14 smaller ones.]

A possible fourth wave of thefts had been identified by Galaxy but was not included in the main estimate, as not all victims were confirmed.

If the suspected but unconfirmed activity was included, the estimate rose to around 2,055 BTC, or $130 million.

Galaxy Research was monitoring over 25 distinct attack patterns, far more than the three main events previously tracked.

Galaxy expected that as further cases were vetted, total losses would likely exceed $130 million.

If all pending cases were validated, losses could reach over 2,300 BTC, approaching $145 million.

This was not like a centralized exchange hack, where a single ledger and customer list exist. Instead, investigators had to reconstruct loss estimates from blockchain activity and direct victim reports.

By August 7th, Alex Thorn, Galaxy’s Head of Firmwide Research, had received over 250 victim reports.

Each new report helped clarify the picture of a theft that was only partially visible from blockchain evidence alone.

When investigators can spot transaction patterns but can’t always identify the owners, how reliable is the final tally?

Technical Breakdown

Coldcard was originally designed to depend solely on its hardware-based true random number generator (TRNG) for generating wallet seeds, without any software fallback.

This changed with the March 2021 migration to libNgU, which became part of the seed generation process.

LibNgU (“Number Go Up”) is named accordingly in its documentation.

After the migration, what increased was not the price, but the number of wallets vulnerable to reproduction by attackers.

On paper, the integration should have worked: libngu checked if MICROPY_HW_ENABLE_RNG was defined at compile time.

Coldcard’s board config set MICROPY_HW_ENABLE_RNG to zero, since Coldcard used a dedicated hardware RNG wrapper.

But the #ifndef directive only checks for a macro’s presence, not whether it is true or false.

Libngu expected a function called rng_get(), but Coldcard’s hardware RNG exposed random32() and random_buffer() instead, so MicroPython's own software rng_get() filled the gap.

Because the macro value was zero, MicroPython defaulted to its Yasmarang software RNG, not the STM32 hardware RNG.

Yasmarang is a predictable, non-cryptographic pseudo-random number generator.

After this fallback, Yasmarang was seeded from device state rather than genuine hardware entropy: low 32 bits of the device UID, XORed with the SysTick counter, and values from two real-time-clock registers.

All these inputs are accessible or guessable, and do not change during runtime: If an attacker could determine or narrow down the boot-time state, they could reproduce the random output.

Libngu then combined that stream with another Yasmarang instance, seeded from four public, hardcoded constants.

Merging two predictable outputs does not create more randomness; it merely shifts the uncertainty.

The problematic code was released with firmware version 4.0.0 on March 17, 2021.

Every Mk2 and Mk3 wallet seed created with firmware v4.0.0 to v4.1.9 was generated using this vulnerable method, with no secure reseeding.

With no later injection of true entropy, the only real question was the number of possible initial states an attacker must check. This is measured in bits: each bit doubles the search size.

Coinkite estimated the resulting search space at about 40 bits, assuming attackers could not precisely determine timer values.

Block’s technical review describes the worst-case scenario: If an attacker knows the device UID, timer state, and RNG call sequence, wallet creation becomes deterministic, with only one possible seed.

Mk4, Q, and Mk5 devices had only slightly improved security: Later reseeding introduced more randomness, but only 32 bits of that affected Yasmarang’s state.

All production firmware versions across these models were vulnerable until the vulnerability was fixed after disclosure.

In 2022, extra entropy from Coldcard’s secure element was added to the fallback generator, but only four bytes were retained and only one of Yasmarang's internal words was updated.

Once fallback state and call sequence are known, the number of unique output streams is capped at 2^32; on average, brute-forcing requires about 2^31 attempts.

Coinkite said this made the situation better for Mk4, Q, and Mk5, estimating about 72 bits of effective search space for these, compared to 40 bits for Mk2 and Mk3.

Block’s analysis highlights a crucial caveat: The timer inputs could be correlated and might take only a small set of values, reducing practical security.

The secure-element reseed can only add 32 bits of new uncertainty to Yasmarang’s state; if attackers reconstruct the earlier fallback state and call history, their search is narrowed to the reseed values.

Coinkite attributed the flaw’s persistence to a separation between different code modules, rather than errors in the cryptographic or Bitcoin-specific code.

Block Engineering’s review found that libngu referenced rng_get(), but Coldcard’s hardware RNG functions used different names, so MicroPython’s fallback filled the gap.

The vulnerability originated at the interface between these separate software components.

If a code check only confirms that a setting exists, not what its value is, how many “secure by design” systems might unknowingly rely on similar oversights?

Attack Patterns and Transaction Analysis

Every sweep in this series of attacks was methodical and automated, not targeted at individuals.

The first major wave drained 1,196 wallets for 1,082.65 BTC in only 41 minutes. The victims included 1,183 BIP84 SegWit addresses, seven BIP49, and six BIP44 addresses.

According to Galaxy, the scope of simultaneous sweeps matched “multi-path key scanning” behavior.

Transaction fees and outputs also supported the theory of “an automated tool spending keys it already held”, as opposed to legitimate owner withdrawals.

Galaxy’s transaction analysis confirmed this interpretation.

Each first-wave transaction used a 30.0 sat/vByte fee, far above the weekly median, and left no change output.

Wave 2 took place the following day, using mostly 10 and 50 sat/vByte fees.

Galaxy found that both waves funneled funds to a small group of collector addresses, targeting similar destination types and derivation paths, and happening 27 hours apart. The research suggested both waves could be attributed to a single operator, though this was based on similarities, not definitive proof.

The third wave complicated the attribution: 207.7294 BTC were stolen, raising Galaxy’s recorded total to 1,367.05 BTC from 4,585 addresses.

Unlike the earlier incidents, Wave 3 distributed funds to 293 unique P2WSH addresses, not a few collector wallets.

Galaxy did not draw firm conclusions about attribution: The third wave could have been the same attacker using new tactics, or a different group exploiting the same vulnerability.

By August 2, a suspected fourth wave was unfolding.

Alex Thorn reported 218 transactions from 462 affected wallets, amounting to 388.92748828 BTC in about two and a half hours.

216 destination addresses were used, later revised to 210 newly created addresses, with a sweep rate 45 times higher than before the incident.

The fourth wave showed an almost one-to-one relationship: Each victim’s funds went to a unique destination, except for one address that received two deposits. No collector pattern was observed.

By August 4, Alex Thorn reported that at least 15 distinct attackers were exploiting the bug. He also noted that subsequent waves were identified through user reports.

As the inquiry expanded, Galaxy confirmed that it was sharing attacker and victim addresses with U.S. federal agencies, exchanges, and cybercrime groups.

As of Galaxy’s August 3 update, most stolen Bitcoin remained at its original destination. Galaxy reported that 90% of the funds had not moved, including all coins from the first three waves.

When limited laundering was observed: On August 4, 64.9 BTC was routed through Wasabi and 200 ETH entered Tornado Cash.

TRM Labs noted that most victim funds were pooled in a few attacker-controlled wallets, with little subsequent movement.

When funds left their initial recipient, TRM saw only further consolidation, not active laundering or mixing, suggesting attackers were still deciding how to manage such highly visible assets.

TRM compared this to North Korea-linked TraderTraitor groups, who typically begin laundering almost immediately.

TRM did not publicly assign blame to a specific group, and observed that transaction construction varied between waves, indicating the likely involvement of multiple attackers.

By early August, researchers could track many addresses and on-chain balances, but could not firmly tie them to specific individuals.

When most of the stolen assets are visible and barely moved, what is everyone waiting for?

Corporate and Legal Response

Coinkite responded quickly on the technical front.

By August 2, the company destroyed its remaining inventory of devices with vulnerable firmware, halted further shipments, and released updated firmware to prevent further exposure in new wallets.

Coinkite was clear about the patch’s limitation: It cannot fix seeds already generated with compromised firmware.

Users who created seeds on affected firmware must create new seeds and transfer their funds.

For those needing an immediate replacement, Coinkite suggested alternatives including Bitkey, Ledger, Trezor, Jade, or BitBox, directly referencing competitors.

Coinkite’s August 4 statement acknowledged an uncomfortable reality in the AI audit debate: AI-based code review tools had not detected the issue, neither before nor after the incident, when tested against Kimi K3, Claude Fable, and Codex 5.6.

As of its August 7 update, Coinkite had not announced any compensation fund. [The only mention was in a post thanking volunteers for assisting victims “selflessly, and without compensation,” describing community action, not company policy.

On August 7, Coinkite suspended its standard practice of erasing most customer records after 120 days.

A company that usually minimized retention of customer information, announced it would preserve such data for potential legal proceedings.

Legal action rapidly followed. Thomas Braziel’s 117 Partners began collecting information from Coldcard victims globally, considering product liability claims, group litigation, and asset recovery options.

No lawsuit had been filed at that stage.

Cris Carrascosa of ATH21 stated that Coldcard had “zero regulatory responsibility” for user funds. She added that a regulated crypto service provider would have to reimburse users, but that legal action against Coldcard would be “terribly difficult” as claimants would need to prove foreseeability.

Criptolawyer, of Blend, provided a contrasting view: While there’s no automatic right to full recovery, Coldcard’s promises and the seed-generation defect could provide “a credible legal basis to investigate responsibility,” including defects and professional negligence.

Regardless of the legal theory, Coinkite’s terms of sale are explicit:

Products are sold “as is”; direct damages are capped at the device purchase price (excluding shipping/tax); all consequential or special damages are excluded; and any legal claims must be filed within a year.

Coinkite may also require disputes to be arbitrated in Toronto, under a class-action waiver.

These terms do not guarantee legal protection, but do create significant barriers for claimants.

When legal fine print offers more protection for a company than its firmware did for users, what exactly is being purchased?

Coldcard marketed years of security-by-design.

There was no warning in the firmware, no abnormal wallet behavior, and vulnerable seeds appeared normal until exploited.

Losses approached $130 million, with at least 15 attackers identified.

The investigation is ongoing, as researchers continue to trace stolen funds and pinpoint affected wallets. Attackers took advantage of publicly accessible code and a mathematically predictable vulnerability.

As of August 3, 90% of the stolen Bitcoin remained unmoved, with no public attribution to a specific group or individual.

Coinkite addressed the bug, destroyed affected stock, and even recommended competitors, but ultimately, the company’s legal terms proved more robust than its firmware’s security guarantees.

AI-assisted review failed to catch the flaw before or after the breach, even as the relevant code was publicly available and its name, “Number Go Up,” ironically foreshadowed the outcome.

Three additional AI models were tested post-incident; none detected the vulnerability.

If AI review can miss a known bug even with hindsight, what confidence can users place in such methods?

After five years of open-source development, with both human and automated oversight, the exploit itself finally revealed the flaw.

If no one—human or machine—checked whether the lock actually worked, what did those years of open code achieve?