The root cause behind Coldcard’s seed randomness flaw was disclosed in early August, with Block’s engineering team tracing the issue to a coding change introduced in March 2021. After receiving reports of stolen user funds, the team said it identified the problem on July 30 alongside other researchers: a piece of code written during a firmware transition effectively bypassed the device’s hardware random number generator and switched seed generation to a predictable software substitute. The bug remained unnoticed until recently.
A build check sent firmware down the wrong randomness path
According to Block’s technical analysis, the mistake was introduced when Coldcard moved elliptic-curve operations to Bitcoin Core’s libsecp256k1 library in March 2021. The firmware checked whether a configuration flag for hardware randomness had been defined, rather than whether it had actually been enabled.
That distinction mattered. The flag’s value had been set to 0, meaning disabled, but the check still passed. As a result, the firmware called MicroPython’s built-in software random fallback instead. Block said this code path first appeared in firmware version v4.0.0, released on March 17, 2021, and went undetected for five years.
The fallback source was predictable
Block said the software fallback was not a true entropy source. Its seed material came only from a chip serial number, a timer and clock registers, values that are either predictable or drawn from a very small range.
On Mk2 and Mk3 devices running v4 firmware, Block said the resulting seeds were almost fully reproducible. On newer models including Mk4, Mk5 and Q, an additional reseeding step raised the search space, but only to about 2^32 possibilities in theory, still far below the strength expected from a mnemonic seed. That left open the possibility that an attacker could reconstruct a private key by recalculating or brute-forcing the limited set of outcomes.
Coinkite halted shipments and published fixed firmware
Coldcard maker Coinkite has issued a security notice and rolled out a series of response measures. The company said it has stopped shipments, destroyed affected inventory and emailed customers who had already received devices.
The notice also listed patched firmware versions by model:
- Mk2 / Mk3: upgrade to version 4.2.0 or later
- Mk4 / Mk5: upgrade to version 5.6.0 or later
- Q: upgrade to version 1.5.0Q or later
Coinkite told users not to generate new seeds on those models before updating. It also said seeds created using at least 50 independent and private dice rolls are not affected by the flaw.
Loss estimates vary, and no user loss has been confirmed by the company
Third-party on-chain estimates of the damage differ widely, ranging from about $38 million to $89 million and spanning hundreds to more than 1,000 addresses.
So far, however, Coinkite has not confirmed any user loss. Block also said it has “not yet done full real-world testing to confirm exploitability.”
Separate claims have circulated in the crypto community. On X, some users shared personal theft reports, including Jonathan Goodman, who said he lost 18.25 BTC. Researchers have also shown that AI tools could identify the bug in open-source code within minutes. Those remain individual claims or demonstrations. Coinkite’s notice did not describe AI as an attack vector, and the actual amount stolen remains unclear.
What affected users were told to do
For Coldcard holders, the guidance from the company was direct: check the device model and firmware version, install the fixed release only through official channels, generate a new seed on the updated firmware, and move funds to a new wallet address.