Coinkite Coldcard Firmware Bug Triggers $130 Million Bitcoin Theft

Attackers have stolen an estimated 2,055 Bitcoin—valued at roughly $130 million—from Coinkite Coldcard hardware wallets after a long-standing coding error crippled the devices’ cryptographic random number generation, according to findings from Galaxy Research and official disclosures from manufacturer Coinkite.

Galaxy Research confirmed that thieves swept over 1,596 BTC across three distinct attacks, with a suspected fourth wave raising total losses past 2,055 BTC. In one 41-minute window, attackers drained $70 million from compromised wallets. Coinkite stated that at least 15 separate entities have participated in exploiting the affected addresses.

The security failure originated during a 2021 upgrade when Coinkite migrated Coldcard firmware cryptography to libsecp256k1, the library utilized by Bitcoin Core. A preprocessor build check using #ifndef checked whether a specific configuration flag existed rather than whether it was activated. Because Coinkite set the variable to zero to disable it, the compiler interpreted the flag as defined and bypassed the device’s hardware random number generator chip.

Deprived of hardware entropy, the wallets defaulted to MicroPython’s software pseudo-random generator, Yasmarang, which is intended only for hardware lacking physical randomness circuits. “The bulk of randomness on the COLDCARD was coming from a PRNG that I didn’t know was actually in the source code base,” Coinkite stated in an August 1 technical report.

For Coldcard Mk2 and Mk3 models running firmware versions 4.0.1 through 4.1.9, the software generator drew initial seed values solely from chip serial numbers and internal timers. This reduced the device’s search space from the standard 128 bits down to approximately 40 bits. Newer wallet models incorporated secure-element entropy, raising the search space to roughly 72 bits.

Standard 128-bit security provides more key combinations than atoms in the observable universe, rendering brute-force attacks impossible. By contrast, a 40-bit search space contains roughly one trillion possibilities, enabling standard computers to systematically guess wallet keys. An independent technical analysis by Block’s engineering team confirmed that for older boards with known device IDs and timer states, key generation was entirely deterministic.

Coinkite indicated that attackers may have utilized automated code analysis tools to discover the flaw. “We have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue,” the company noted, adding that internal tests using advanced AI tools failed to flag the vulnerability. “Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.”

Coinkite has issued emergency firmware updates across all affected models. However, because firmware updates cannot retroactively secure private keys generated under flawed entropy, users must update their software, generate entirely new seed phrases, and transfer funds to new addresses. Seeds created on compromised firmware retain the flaw even if imported into secondary wallet software.

To bypass software entropy entirely, many users rely on manual dice rolls to construct seed phrases. Coinkite confirmed that wallets created using at least 50 independent physical dice rolls remain unaffected by the firmware bug.

The incident raised debate over physical entropy standards. On July 31, Bitcoin Core developer Luke Dashjr warned users against relying on off-the-shelf dice, writing: “Quite a few people suggesting/using dice to mitigate the Coldcard vulnerability. Note that common dice are not designed to be cryptographically secure. If you are going to do this, you probably should buy precision casino dice. And even then, have another source of entropy.”

However, developer Justin Sharp noted that physical manufacturing imperfections present negligible risk compared to the firmware bug. Sharp calculated that a heavily biased die landing on one face 20 percent of the time yields 2.55 bits of entropy per roll instead of the theoretical 2.585 bits from a perfect die—reducing total entropy across 99 rolls from 256 bits to 252 bits, leaving wallets fundamentally secure.