The Coldcard security incident has widened into a broader debate over wallet design, disclosure, and self-custody risk after researchers tied multiple waves of suspicious Bitcoin drains to a flaw in the device’s seed-generation path rather than any break in Bitcoin’s underlying cryptography.
Public reporting and technical analysis point to a 2021 integration error inside Coldcard firmware. In affected versions, some wallets generated seeds through a software pseudorandom number generator instead of the intended hardware random number generator, cutting the effective search space of mnemonics below the original security target.
By Aug. 3, 2026, Galaxy Research had identified four suspected waves of related on-chain activity. Its first three waves covered 4,585 addresses and 1,367.05 BTC. A fourth wave detected on Aug. 3 was later updated to about 448.7 BTC across 709 potential victim addresses. If there were no overlaps across the four sets, the arithmetic total would reach about 1,815.75 BTC across 5,294 addresses. Galaxy and other researchers have been explicit that those numbers are on-chain observations based on behavioral clustering, not a confirmed final loss tally or a wallet-by-wallet list of Coldcard victims.
First major sweep moved 1,082.65 BTC in roughly 41 minutes
On July 30, 2026, between 01:10 and 01:51 UTC, a batch of Bitcoin addresses was emptied in about 41 minutes. The transfers involved 1,082.65 BTC, worth about $70.2 million at the time. Galaxy Research first counted 1,196 addresses in the set, then used 1,195 in later summaries covering the first three waves. The newer 1,195-address figure is the one adopted in later analysis, though the one-address discrepancy remains part of the record.
Galaxy, citing pattern work from Block engineers and security researchers, said the core transaction set mostly used a flat 30 sat/vB fee and produced no change outputs, a structure consistent with automated batch execution. It later found a small number of related exceptions around 4 sat/vB, so the flat fee pattern should not be described as universal. The funds were then consolidated mainly into four addresses.
That transfer cluster took place about 30 hours before Coinkite, the maker of Coldcard, publicly disclosed a Mk3 firmware risk. Similar programmatic fund movements appeared afterward. After identifying the first three waves, Galaxy expanded the observed scope to 4,585 addresses and 1,367.05 BTC, valued at roughly $88.6 million. On Aug. 3, Galaxy Research head of research Alex Thorn said he had detected a fourth suspected organized attack wave.
Early signs first appeared in a smaller set of about 500 addresses
Researchers initially spotted roughly 500 single-signature Bitcoin addresses being swept in about 25 minutes on July 30. That earlier snapshot covered about 594 BTC, valued at roughly $38 million, with about 562 BTC later flowing into one address. Most affected addresses held more than 0.15 BTC, and some UTXOs had been dormant for years.
At the time, one apparent victim said they had used a Coldcard device, pushing the market toward speculation that the hardware wallet might be involved. Coinkite co-founder and CEO Rodolfo Novak, known as NVK, initially rejected the idea that a clear device-level flaw had already been established. He suggested some users may have imported previously exposed or weak mnemonics and said the transfers involved private keys from different wallets.
Bitcoin security researcher Jameson Lopp said at that stage that some users appeared to lose only specific UTXOs rather than entire wallet balances, which could imply the attacker held only some private keys and not a full mnemonic. That view was made before the root cause became public and should be read only as a hypothesis formed from limited samples at the time.
Galaxy later expanded the first-wave count to 1,195 addresses and 1,082.65 BTC. The earlier figures of about 500 addresses and 594 BTC were an initial snapshot of that same first wave and should not be added on top of the later total.
Coinkite widened the affected-device scope after its first notice
Roughly 30 hours after the first large sweep, Coinkite published a Coldcard security notice. Its initial statement focused on Mk3 devices that had created mnemonics with certain firmware versions and said Mk4, Q, and Mk5 did not appear to be affected based on the company’s preliminary analysis at that time.
As the Block security team and other researchers continued to work through the bug, Coinkite broadened the scope. In its notice updated through Aug. 1, the company said the following seed-generation ranges were affected:
- Mk2 and Mk3: seeds generated with firmware 4.0.1 through 4.1.9
- Mk4 and Mk5: seeds generated with standard firmware before 5.6.0
- Q: seeds generated with standard firmware before 1.5.0Q
- Mk4 and Mk5 Edge: seeds generated with versions before 6.6.0X
- Q Edge: seeds generated with versions before 6.6.0QX
Block’s technical report used a slightly broader vulnerable range for Mk2 and Mk3, listing 4.0.0 through 4.1.9 and saying the code path first appeared in version 4.0.0 released on March 17, 2021. That leaves a one-version gap between Block’s range and Coinkite’s published notice. For users who created seeds on 4.0.0, the more conservative reading before any further clarification from Coinkite is to treat those seeds as potentially affected and move funds.
TAPSIGNER, OPENDIME, and SATSCARD use different codebases and were not listed as affected in the company’s notice.
The practical takeaway is that Coinkite’s initial statement about Mk4, Q, and Mk5 not being affected was revised by the later investigation. Risk depends on the device and firmware version used at the time a seed was created, not the firmware currently installed, the purchase date of the device, or the wallet software where the mnemonic may now be stored.
The bug traces back to a 2021 code migration
Block Bitcoin Engineering and Security said in a July 30 technical analysis that the issue dates to March 2021. Coinkite was then migrating some elliptic-curve operations to libsecp256k1, the library used by Bitcoin Core, and introducing libNgU for an embedded MicroPython environment.
During that migration, seed generation changed from calling ckcc.rng_bytes() to ngu.random.bytes(). The older path used Coldcard’s hardware RNG implementation for STM32 chips. The newer path, because of a conditional compilation mistake, ended up linking to MicroPython’s built-in Yasmarang software pseudorandom number generator.
Coldcard’s production configuration defined MICROPY_HW_ENABLE_RNG as 0. The intent was to disable MicroPython’s own hardware RNG implementation and use Coldcard’s version instead. But the libNgU code only checked whether the macro was defined, not whether its value was nonzero.
Because the macro was defined even though its value was 0, the build did not fail. A software fallback with the same function signature was linked into the firmware. The error did not crash the program or stop seed creation, so devices still produced mnemonics that looked random and users had no direct signal that anything was wrong.
The software generator was initialized mainly from portions of the MCU unique identifier and timer registers such as SysTick and RTC. Those data points are not cryptographic secrets. If an attacker could obtain or narrow the range of the device identifier, boot time, timer state, and prior RNG call history, they could in theory reproduce part of the output stream offline and derive candidate mnemonics and addresses from it.
For Mk2 and Mk3, Block said the vulnerable seed-generation path did not receive later cryptographic-grade reseeding. Mk4, Mk5, and Q did add entropy from a secure element, but only four bytes from the digest, 32 bits of data, entered the software generator’s state, which did not restore the intended level of randomness.
Coinkite’s preliminary estimate put the effective search space of affected Mk2 and Mk3 seeds at about 40 bits. For Mk4, Mk5, and Q, the addition of secure-element data raised the estimate to about 72 bits, still below the company’s stated design goal of 128 bits.
Block gave conditional upper bounds below roughly 2^40.7 and 2^73.3. It also stressed that those estimates depend heavily on what an attacker knows about device and timing information, so they should not be treated as standard cryptographic security levels or used to calculate a precise break cost for every device.
Block said it had not completed a full end-to-end empirical test on real devices and victim wallets. Public materials also do not show a full demonstration rebuilding a victim mnemonic from scratch and matching it to a drained address. The randomness defect is confirmed at the code level, but the link between the flaw and each on-chain address still rests mainly on transaction behavior, address features, and some user information rather than wallet-by-wallet cryptographic reproduction.
Galaxy tracked three earlier waves, but attribution is still incomplete
On Aug. 1, Galaxy Research said it had identified three suspected waves targeting addresses generated by Coldcard, based on Bitcoin on-chain data. Those three waves covered 4,585 addresses and 1,367.05 BTC, worth about $88.6 million.
In Galaxy’s later breakdown, the first wave involved 1,195 addresses, the second 1,478, and the third 1,912. That adds up to 4,585. Its initial report on the first wave used 1,196 addresses, so the two Galaxy reports differ by one address because of later data cleanup.
Galaxy said the first two waves shared similarities in fund consolidation structure, recipient address types, and address-generation paths, making it reasonable to suspect a common operator, though not enough to confirm one. The third wave looked different in fund routing, destination addresses, and batch-transfer structure. That could mean the original attacker changed tools, or it could point to a separate attacker exploiting the same weakness independently.
The firm said it had relatively high confidence that transactions within each wave were controlled by the same operator, but it did not conclude that all three waves were carried out by one person.
Galaxy also cautioned that all of its numbers came from on-chain analysis and did not verify that every address was in fact generated by Coldcard firmware with reduced randomness. Flat fees, no-change structure, address age, and consolidation patterns can help cluster related activity, but they cannot by themselves prove every transfer was theft or show that different clusters came from the same attacker.
At the time Galaxy published its three-wave summary, the main funds from those waves were still sitting in the identified suspected attacker addresses. Separately, the firm observed smaller amounts from possible copycat or opportunistic attacks beginning to spread through peel chains, cross-chain services, and offshore gambling platforms. Galaxy said those flows should not be conflated with the main funds from the first three waves.
Galaxy added that it had provided about 600 suspected attacker holding addresses to U.S. federal investigators, compliance groups, and cyber investigators.
Fourth suspected wave rose to about 448.7 BTC
On Aug. 3, Galaxy Research head of research Alex Thorn said a fourth organized wave appeared to be underway.
Thorn first identified 218 transactions between blocks 960,778 and 960,792, involving 462 potential victim addresses, 216 new destination addresses, and about 388.93 BTC.
He said the inputs were all no earlier than the time boundary when the Coldcard firmware flaw began to exist. In that observed range, there were about 13.8 emptying transactions per block on average, versus roughly 0.3 per block in a pre-incident comparison window, a rate about 45 times normal. Most transactions created one new destination address for each potential victim, and some funds later moved to second-hop addresses.
After more blocks were confirmed and the sample was cleaned up, Thorn revised the fourth-wave figures to about 448.7 BTC across 709 potential victim addresses. That revision included excluding 89 multisig addresses and about 20.58 BTC of false positives, so the newer number should not be read as a simple extension of the initial sample.
Those figures remain on-chain estimates derived from UTXO age, address type, and transaction behavior. They have not been individually confirmed by Coinkite, law enforcement, or all wallet holders.
Thorn also said similar transactions were still waiting in the mempool at the time and that some already-confirmed transactions had opted into Replace-by-Fee, or RBF. For users who still controlled the relevant private keys and whose suspicious transaction was unconfirmed and replaceable, one possible response was to broadcast a higher-fee conflicting transaction to a safe wallet.
That option is narrow. RBF applies only to transactions that are still unconfirmed and flagged as replaceable, and it does not guarantee that a user’s replacement will be mined first. Thorn also warned users to watch for fake recovery tools, phishing sites, and supposed support staff asking for mnemonics during a rushed response.
If Galaxy’s earlier 1,367.05 BTC across 4,585 addresses is simply added to the updated fourth-wave figure, the observed total reaches about 1,815.75 BTC across 5,294 addresses. That arithmetic assumes no overlap across waves and should not be treated as a confirmed final loss number from Coinkite or law enforcement.
Swan paused some withdrawals and Nunchuk reviewed platform keys
On Aug. 1, Bitcoin financial services platform Swan said it had temporarily stopped processing some Bitcoin withdrawals that appeared to be headed to Coldcard wallets in light of the disclosure.
Swan said its own services were not affected by the flaw. The restriction was based mainly on wallet labels users had previously attached to withdrawal addresses. The platform said those labels alone cannot confirm what device, firmware version, or seed the user is currently relying on.
According to a response from Nunchuk relayed by Bitcoin News, some platform keys had been generated by Coldcard Mk4 devices, but the keys were used with custom derivation logic, making them less straightforward to include in lookup tables built around standard derivation paths.
Nunchuk also said that if an attacker had enough time, those derived keys should still be assumed capable of ending up inside the search space. No complete public technical advisory from Nunchuk was cited in the source material, so that point should be read as a media relay of the company’s response rather than an independently verified security conclusion.
On-chain activity rose after disclosure, but causation remains unproven
CryptoQuant head of research Julio Moreno said Bitcoin daily active addresses climbed from about 645,000 on July 30 to nearly 1 million on July 31, the highest level since Dec. 10, 2024. Active sending addresses rose sharply inside that move.
Moreno said the increase may have included Coldcard users moving BTC out of caution after the disclosure, but address activity by itself cannot identify wallet brands or prove a direct causal link.
Over the same period, transfers below 1 BTC per transaction totaled about 39,600 BTC, close to the roughly 39,900 BTC seen after the FTX collapse in November 2022. Exchange deposits below 10 BTC per transaction rose to about 7,300 BTC, the highest since Feb. 6.
TimechainIndex founder Sani estimated that net Bitcoin inflows on July 31 to centralized platforms or known entities were about 11,163 BTC, mainly toward River, Binance, Kraken, and OKX. Because River is not a traditional pure-play exchange, the entire figure should not be flattened into a simple “exchange net inflow” description.
CryptoQuant analyst JA Maartunn said about 77,402 BTC from older UTXO age bands moved again after the flaw became public. That figure tracks renewed on-chain activity in long-dormant coins. It cannot all be attributed to Coldcard, nor does it mean all of those coins entered exchanges. Wallet migration, address consolidation, changes in custody structure, and outright selling can all show up in the same broad metric.
Santiment said the Coldcard incident may have weakened confidence among some traders in cold wallets and self-custody. The firm’s signal came from short-term social media samples, which are highly sensitive to day-to-day headlines and extreme commentary, so it does not establish whether sentiment effects would persist.
PeckShield’s July 2026 security report provisionally put Coldcard-related losses at about $70 million and ranked the case as the third-largest crypto asset theft of the year up to that point, behind Drift and KelpDAO/LayerZero.
That figure was a snapshot from the time the monthly report was published. It did not include all the addresses Galaxy identified later or the fourth wave, and it is not equivalent to a final loss number confirmed by victims or law enforcement.
The incident reignited the custody-model debate
Bloomberg ETF analyst Eric Balchunas said publicly available information from PitchBook and LinkedIn suggested Coinkite had about five employees. For a hardware wallet maker responsible for products used to secure significant user assets, he said that scale could be seen as a warning sign.
Balchunas contrasted that with larger institutions such as Coinbase and Ledger, as well as regulated custody structures behind spot Bitcoin ETFs, arguing they may have deeper security and compliance resources even if they also bring higher fees. Coinkite’s actual headcount was not independently confirmed by the company in his comment, so the “about five” figure should be treated as a third-party estimate he cited, not a settled fact.
The broader discussion centered on the different risks carried by centralized custody and self-custody. Exchange and fund custody systems carry counterparty risks that include asset misuse, institutional failure, withdrawal freezes, insider compromise, regulatory action, and single points of failure. Self-custody reduces some counterparty exposure but shifts responsibility for seed creation, backup, inheritance, signing devices, firmware supply chains, and user operations onto the asset holder.
The Coldcard case shows that offline hardware operation does not mean every step in seed creation, firmware builds, and supply-chain trust has been fully validated. The flaw hit the randomness path at the moment a seed was created. If an affected mnemonic is imported into another wallet brand, the original entropy weakness is still there.
Firmware updates do not repair old seeds
Updating firmware alone does not repair an already created mnemonic. Users need to generate a new seed in patched firmware or another trusted environment and move funds to addresses controlled by that new seed.
Coinkite listed the following patched versions:
- Mk2 and Mk3: 4.2.0 or later
- Mk4 and Mk5 standard: 5.6.0 or later
- Q standard: 1.5.0Q or later
- Mk4 and Mk5 Edge: 6.6.0X or later
- Q Edge: 6.6.0QX or later
Coinkite also said that adding at least 50 fair, independent, and non-disclosed dice rolls during seed creation can provide extra entropy that does not depend on the device’s random source. The dice must be real, fair, and rolled by the user. If the results are recorded, filmed, uploaded, or supplied by a third party, the added protection is reduced.
A strong and unique BIP-39 passphrase can add an independent layer of protection, but it does not restore the randomness missing from the original seed and does not replace the need to migrate funds. For seeds confirmed or suspected to have been created under affected firmware, Coinkite still recommends generating a new seed and moving assets.
For larger holdings, using keys generated by devices from different vendors inside a multisig setup can reduce the risk that a single vendor flaw compromises enough keys at once. That comes with trade-offs in backup, inheritance, recovery, and day-to-day operating complexity, and the benefit depends on whether the multisig threshold still retains a sufficient number of safe keys.
Open code helped researchers find the root cause, but it did not prevent a five-year bug
Coldcard firmware source code has long been publicly viewable, which helped Block and others isolate the defect quickly after the incident surfaced. At the same time, the current license includes restrictions such as the Commons Clause, so describing the project simply as free and open-source software in the conventional sense would be imprecise. “Source-available” or “publicly auditable source code” is closer to the mark.
Public code only creates the possibility of review. It does not prove that review happened at sufficient depth. This error sat in the seed-generation path for about five years, which shows that even critical security code can remain insufficiently checked for long periods while still being available for inspection.
Community tests suggested AI could spot the flaw, not that attackers used AI
In its technical note, Coinkite said the public availability of Coldcard source code led the company to speculate that someone may have used AI to review older code and discover the problem.
The company also said it had used a leading AI model to review the code weeks before the incident and that the model did not find this flaw or any other serious issue. That result underscores how dependent AI-assisted review remains on code scope, prompts, context length, tooling, and verification steps.
After the bug became public, a Reddit user said they had given the Coldcard code to Claude Code with a simple prompt along the lines of “check for vulnerabilities,” and that the model pointed to the randomness path in about eight minutes.
The same user also said GLM-5.2, a model released or trained before the incident and run without internet access, identified the same issue in about 20 minutes.
Those tests all took place after public disclosure. They did not fully disclose the exact code commit analyzed, whether a patched or clue-rich version was used, the exact model versions, system prompts, full logs, or verified network isolation. Because of that, the results cannot rule out the possibility that the models saw code versions containing obvious hints or that the experimenter’s prior knowledge shaped the selection and interpretation of outputs.
At most, the community tests suggest that current code-focused models may be able to follow macro definitions, dependency chains, and function-call paths with limited manual guidance and independently localize this class of bug. They do not show that the original attacker used AI, and they do not show that AI can autonomously carry out the full chain from code review to weaponization, seed enumeration, and on-chain theft.
There are no public attack tools, model logs, prompts, runtime records, or attacker identity details that support AI attribution. Coinkite’s suggestion that AI may have been involved remains speculation.
What is confirmed, and what is not
The firmest conclusions at this stage are narrower than some public reactions suggest. A randomness integration error introduced in 2021 weakened the security of seeds created by certain Coldcard firmware versions. Multiple waves of programmatic on-chain fund movements appeared afterward. Galaxy and other researchers believe those waves may be linked to the flaw based on transaction characteristics, but they have not completed wallet-by-wallet cryptographic verification of all affected addresses.
The event concerns key generation in a specific product and firmware range. It does not show a break in Bitcoin elliptic-curve cryptography, SHA-256, the BIP-39 standard, or Bitcoin consensus itself. It also does not support the blanket claim that all hardware wallets or all self-custody setups are unsafe.
The address counts, BTC totals, and dollar values cited in current reports are interim figures based on public on-chain data and transaction features as of Aug. 3, 2026. They do not mean each address has been individually confirmed to come from affected Coldcard firmware, and they are not the same as a final loss number confirmed by Coinkite, law enforcement, or victims. The incident is still developing, and the definitive scope of affected devices and firmware should follow Coinkite’s latest security notice.