Bitcoin wallets that were never supposed to be reachable turned out to be reachable after all.
The funds were stored on Coldcard devices, the air-gapped hardware wallets made by Canadian manufacturer Coinkite. There was no phishing link, no malware, and no stolen computer involved. Attackers derived the private keys.
Galaxy Research said more than 1,596 BTC has been stolen across three confirmed waves from roughly 7,300 addresses, with 14 additional smaller incidents. If a suspected but unconfirmed fourth wave is included, the total rises to about 2,055 BTC, or roughly $130 million at current prices. One sweep moved $70 million in 41 minutes. Coinkite said at least 15 different attackers have piled in.
On August 1, the company published a technical backgrounder laying out what went wrong. In plain terms, the wallet spent eight years generating seeds with a badly weakened source of randomness and nobody caught it.
The hardware RNG was there, but seed generation stopped using it
In 2021, Coinkite moved Coldcard’s cryptography onto libsecp256k1, the same library used by Bitcoin Core. The decision itself was sound. The failure came in the integration.
During that migration, seed generation was quietly redirected away from Coldcard’s own hardware random number generator and onto MicroPython’s software fallback, a pseudo-random algorithm called Yasmarang that exists for devices with no randomness chip.
Coldcard does have a randomness chip. The software simply stopped asking it for entropy.
The trigger was a tiny build guard mistake. The code used #ifndef, which checks whether a setting exists, not whether it is enabled. Coinkite had defined that setting as zero, meaning off. In C preprocessor logic, zero still counts as defined, so the check passed and the build completed. Because both versions of the function had identical signatures, nothing looked visibly broken.
Coinkite wrote, “The bulk of randomness on the COLDCARD was coming from a PRNG that I didn't know was actually in the source code base,” referring to a pseudo-random number generator that produces outputs following a fixed recipe from a starting value.
Give that recipe the same starting value and it returns the same output every time.
How much entropy was left on affected devices
For Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, that starting value came from the chip serial number and its clock. Coinkite estimated the resulting search space at about 40 bits. Newer models mixed in a small amount of secure-element entropy, pushing the figure to roughly 72 bits.
Neither comes close to the 128-bit target.
The difference is not academic. Bits scale exponentially. A 128-bit search space contains more possible combinations than there are atoms in the observable universe, making brute force unrealistic. Forty bits is about a trillion possibilities, a range a decent laptop can work through. Lose one bit and the workload is cut in half.
Block’s engineering team reached a similarly blunt conclusion in its own analysis. It put the newer devices’ effective secure-element search space at 2^32 candidates, with an average of around 2^31 trials needed. For older boards, the team said wallet generation becomes deterministic if the device ID, timer state, and call history are known.
That is the core of the problem. The output was not merely weak. It was predictable.
Coinkite says AI may have helped attackers find the issue
Coinkite said it has to assume the flaw may have been discovered by machine review. “We have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue,” the company wrote. It added that it had recently run one of the best available AI models over the same code and found nothing.
“Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys,” Coinkite said.
Updated firmware is now available for every affected model. That update does not repair seeds that have already been generated, so those wallets must be regenerated and the funds moved. Decrypt previously reported on how air-gapped storage changes after an exploit like this and tracked losses rising past $114 million.
What entropy means in wallet security
Entropy is a measure of how much an attacker does not know.
More concretely, it is uncertainty counted in bits. One bit is a coin flip with two outcomes, giving a guesser a 50% chance. Ten bits means 1,024 outcomes. Each additional bit doubles the work required to guess correctly.
A Bitcoin wallet is, at its core, a very large secret number. The receiving address is derived from that number through one-way mathematics: you can go from key to address, but not back from address to key.
So the security question is simple. How many possible numbers would an attacker have to try?
If the number was chosen with 128 bits of entropy, the answer is effectively beyond physical limits. If it was chosen with 40 bits, the answer becomes manageable with enough time.
That distinction also helps explain why quantum-computing discussions matter in Bitcoin. A quantum machine would attack the math linking keys to addresses. The Coldcard bug never needed to touch that math. It made keys guessable before the cryptography even entered the picture.
This is also where terminology causes confusion. A pseudo-random generator can produce output that passes statistical tests for randomness. On the surface, it may look fine. But the sequence is still fully determined by its seed value. It looks random without being cryptographically unpredictable.
Statistical randomness and cryptographic unpredictability are not the same thing. Coldcard’s output could have passed the first standard while failing the second completely.
True randomness has to come from physical noise, such as electrical jitter, thermal fluctuation, or radioactive decay. That is what the Coldcard hardware chip was meant to supply, and that is the component the build flag effectively disconnected.
The dice debate focused on bias, not the main failure
As users rushed to replace seeds, many turned to a low-tech fix: rolling physical dice and feeding the results in as entropy. Coldcard supports that method. Coinkite’s own guidance says seeds created with at least 50 independent, private dice rolls are not at risk from this bug.
The company even sells a bag of “100 cute and tiny little dice” to make the process easier.
On July 31, Bitcoin Core developer Luke Dashjr posted a warning: “Quite a few people suggesting/using dice to mitigate the Coldcard vulnerability. Note that common dice are not designed to be cryptographically secure. If you are going to do this, you probably should buy precision casino dice. And even then, have another source of entropy.”
The response on Bitcoin social media was immediate. One user wrote, “lol now you can't even roll dice. Self custody is done for…” Another asked whether he should hire someone with Parkinson’s to throw them.
Developer Justin Sharp responded with arithmetic rather than outrage. “Overkill. A perfect d6 gives 2.585 bits per roll. A noticeably biased die, e.g. with one face landing 20% of the time instead of 16.7%, still gives about 2.55 bits. Across 99 rolls that's the difference between ~256 bits and ~252 bits of entropy.”
That means a visibly biased die costs about 4 bits out of 256.
Dashjr’s point about measurable bias in cheap dice was not wrong. Injection-molded pips remove slightly different amounts of plastic from each face, which is why casinos use flush-filled precision dice. But the scale of the risk is different. Dropping from 256 bits to 252 bits is not in the same category as dropping users to 40 bits.
There was still a sharper lesson inside his warning: do not rely on any single entropy source. Coldcard did not fail because its randomness was slightly biased. It failed because one entropy component silently stopped contributing and nobody noticed.
What affected users need to do now
If a user generated a seed on an affected Coldcard without dice rolls or a strong BIP-39 passphrase, that seed is compromised.
The recommended process is to update the firmware, generate a new seed, verify the fingerprint, send a test transaction, and only then move all funds. Coinkite’s advisory breaks the steps down by model. Exported seeds carry the same flaw with them, so importing a bad seed into another wallet app does not solve the problem.
The broader takeaway is not that hardware wallets are broken or that dice are somehow useless.
It is that “random” is a claim that has to be verified. Coldcard’s source code was public the whole time. The intended hardware RNG was present in the binary. Reviewers confirmed that it existed, but they did not confirm that seed generation actually called it.
For eight years, audits were looking at the right code. Nobody checked whether it was the code that actually ran.