Coldcard Firmware Flaw Linked to Theft of 1,082 Bitcoin in 41 Minutes
A critical defect in COLDCARD firmware degraded entropy during BIP39 seed generation, enabling offline enumeration of weak seeds and resulting in the theft of 1,082.65 BTC from 1,196 addresses in just 41 minutes on July 30, 2026. The root cause traces to a March 2021 integration error that replaced the STM32 hardware RNG with a deterministic software PRNG initialized only by chip ID and timing registers, yielding roughly 40 bits of effective entropy on Mk3 devices and 72 bits on Mk4, Mk5, and Q models. Coinkite issued emergency firmware updates, yet any seed created on vulnerable versions remains exposed regardless of later updates. Additional sweeps matching the same pattern have raised total observed losses to 1,367.05 BTC across 4,585 addresses. Users must generate fresh seeds on patched firmware and migrate funds immediately; dice-based entropy addition or BIP39 passphrases provide only partial mitigation.
Hispasec•Crypto & Financial Crime
