A hardware wallet that was never supposed to connect to the internet has lost more than $130 million in Bitcoin to attackers who worked out what the private keys were. Galaxy Research has now tracked 1,596 BTC stolen across three confirmed waves, with a suspected fourth wave that would lift the total to roughly 2,055 BTC. One sweep moved $70 million in 41 minutes. Coinkite, the Canadian manufacturer of the Coldcard wallet, says at least fifteen separate attackers have piled in. The vulnerability had lived in the firmware for eight years, undetected by every audit that reviewed the source code, because a single build flag silently disconnected the hardware random number generator that was supposed to generate every seed.
What Went Wrong
Coinkite published a technical backgrounder on August 1 explaining the root cause. In 2021, the company migrated Coldcard’s cryptography onto libsecp256k1, the same library Bitcoin Core uses. The migration itself was sound. The integration quietly rerouted seed generation away from Coldcard’s hardware random number generator and onto a software fallback called Yasmarang, a small pseudo-random algorithm designed for devices that have no randomness chip at all. The chip was still on the board. The firmware simply stopped asking it for numbers.
The reason is almost too small to believe. A build guard used the C preprocessor directive #ifndef, which checks whether a setting exists rather than whether it is switched on. Coinkite had defined that setting as zero, meaning off. Because zero still counts as defined, the safety check passed. Both versions of the function had identical signatures, so the wrong path looked identical to the right one. The bulk of randomness on the COLDCARD was coming from a PRNG that I did not know was actually in the source code base, Coinkite wrote.
The consequences are not subtle. On Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, the starting value for the software fallback came from the chip’s serial number and its clock. Coinkite estimates the resulting search space at about 40 bits. Newer models mixed in a little secure-element entropy, lifting them to roughly 72 bits. Neither is the 128 bits the design targeted. Forty bits is about a trillion possible values, a number a decent laptop can chew through. Block’s engineering team, which published its own analysis, put the newer devices’ effective secure-element search space at two-to-the-thirty-two candidates, averaging around two-to-the-thirty-one trials. Their assessment for the older boards is blunter: for a known device ID, timer state, and call history, wallet generation is deterministic.
Why Bitcoin Prices Did Not Fall
Bitcoin prices climbed on Monday August 3, posting a 2.9% gain to above $64,000 even as headlines were dominated by news of the hack, according to Coinbase data via TradingView. Analysts pointed to improving macro sentiment, growing optimism around the CLARITY Act, and the limited scope of the attack itself. Terence McMenamin, CEO of lending firm Techdollar, told Forbes the hack failed to trigger a meaningful selloff, suggesting the market had already absorbed much of the recent pessimism. Tim Enneking, managing partner at Psalion, attributed the move to positive US-Iran developments and solid Wall Street earnings. Jeff Anderson, managing director at STS Digital, connected the Bitcoin move to a broader rebound in risk assets after a recent tech-sector washout.
How The Keys Became Guessable
The vocabulary matters. Entropy is the measure of how much an attacker does not know. A Bitcoin wallet is a very large number kept secret. The address people send coins to is derived from it mathematically, and the derivation runs one way only. So the security of every wallet rests on one question: how many numbers would an attacker have to try? If the number was picked with 128 bits of entropy, the answer is more than physics permits. If it was picked with 40, the answer is give me some time. Each bit lost halves the attacker’s workload.
The same property is what makes the quantum computing threat worth arguing about: a quantum machine would attack the math that links key to address. The Coldcard bug never needed to. It made the keys guessable before that math got involved. Statistical randomness and cryptographic unpredictability are different properties, and Coldcard’s output would have sailed through the first test while failing the second completely. True randomness has to come from physical noise: electrical jitter, thermal fluctuation, radioactive decay. That is what the hardware chip on the Coldcard was for, and that is the chip the build flag disconnected.
The Dice Question
As users scrambled to regenerate seeds, many reached for the obvious low-tech fix. Coldcards let users roll physical dice and feed the results in as entropy. Coinkite’s own guidance treats seeds made with at least fifty independent, private dice rolls as not at risk from the bug. The company actually sells a bag of one hundred small dice to make the process easier. On July 31, Bitcoin Core developer Luke Dashjr posted a warning that common dice are not designed to be cryptographically secure, advising users to buy precision casino dice and combine them with another source of entropy. Bitcoin’s social channels did not take it calmly.
Developer Justin Sharp ran the numbers on what a slightly biased die actually costs: a perfect d6 gives 2.585 bits per roll, while a visibly unfair die still gives about 2.55 bits. Across 99 rolls the difference is four bits out of 256. Coldcard’s bug left users at 40.
We have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue, Coinkite wrote. Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.
What Affected Users Should Do
Coinkite has shipped fixed firmware for every affected model. The patch does not repair existing seeds. Wallets that generated seeds on affected firmware without dice rolls or a strong BIP-39 passphrase must regenerate the seed, verify the fingerprint, send a test transaction, and then move all funds. Exported seeds carry the flaw with them. Moving a bad seed into a different wallet application does not solve anything. Coinkite’s advisory walks through the procedure model by model.
For everyone else, the takeaway is not that hardware wallets are broken or that dice are a trap. It is that random is a claim, and claims need checking. Coldcard’s source code was public the entire time. The intended hardware RNG was sitting right there in the binary. Eight years of audits looked at the right code. Nobody checked whether it ran.