Filed under: the security failure you cannot see, cannot patch away, and cannot undo.
Before the horror story, thirty seconds on Bitcoin, because the whole thing only makes sense once you understand what you actually own. Bitcoin is digital money with no bank behind it: no institution holding your account, no helpline, and no central ledger anyone can edit. Ownership comes down to knowing a secret number, your private key, which is usually boiled down to a string of twelve or twenty-four words called a seed phrase. Whoever knows that secret owns the coins, full stop. That is Bitcoin’s great strength and its sharp edge at the same time. There is nobody to appeal to if the secret is lost or stolen, and there is no undo button. Which is exactly why how, and where, that secret gets created matters enormously.
It also helps to know what one of these things is actually worth, because that is what turns “a wallet” into “someone’s house deposit.” Bitcoin’s price has been anything but steady. It spent 2021 swinging between roughly $30,000 and $69,000, crashed through 2022 to around $16,000, spent 2023 grinding back to the low forties, then ran hard: 2024 took it from about $38,000 to $108,000, and in October 2025 it set an all-time high just over $126,000. 2026 has been the hangover. As I write this, it sits around $63,000, roughly half its peak. Average it across the last couple of years, and you land somewhere in the $60,000 to $80,000 range, with the caveat that “average” is doing an enormous amount of work for an asset that has halved and doubled more than once in that window. The practical point is this: for most of recent memory, a single bitcoin has been worth somewhere between a decent used car and a deposit on a house. A wallet holding a handful of them is not pocket change, and the roughly 1,596 bitcoin drained in this incident come to about 100 million dollars at today’s price.
Now, the horror story, for anyone who has ever felt smug about their security setup. Picture the most careful bitcoin holder you can. They didn’t leave coins on an exchange. They didn’t get phished. They bought a Coldcard, the air-gapped, open-source hardware wallet that the paranoid end of the bitcoin world swears by. They generated a seed, wrote it on steel, locked it in a safe, and did everything right for years.
And in late July 2026 their wallet was emptied anyway, in a wave that drained over a thousand wallets in forty-one minutes. They did nothing wrong. The dice were loaded from the moment they set the thing up, and nobody, including the people who made it, knew.
This is the Coldcard entropy incident, and it is one of the most instructive security failures in years, because it went wrong at the one layer almost nobody thinks about. Let me walk through how it happened, where it stands, what you do about it, and why this particular kind of failure is so uniquely nasty to spot, to fix, and to recover from.
First, why anyone uses a cold wallet at all
To feel how much this stings, you need to understand what a Coldcard is for. Bitcoin has a founding principle: not your keys, not your coins. If your bitcoin sits on an exchange, you don’t really hold it; the exchange does, and you are trusting them not to get hacked, go bust, or quietly run off with it. The last decade handed holders a long list of reasons not to extend that trust: Mt. Gox, QuadrigaCX, Celsius, FTX. Every one of those taught the same lesson: that leaving your coins in somebody else’s custody is a risk all of its own.
So the serious answer is self-custody: you hold the secret keys yourself. And the gold-standard way to do that is cold storage, a wallet whose keys are generated and kept on a device that never touches the internet. A hardware wallet like the Coldcard is air-gapped by design, so that even if your laptop is riddled with malware, the secret never leaves the little box in your safe. It is exactly what you reach for when you decide to stop trusting other people and start trusting the maths.
Which is what makes this incident so bitter. The people hit by it were not careless. They were the most careful holders there are, the ones who did the responsible thing, took their coins off the exchanges, and put them behind the most trusted hardware in the space. The bug betrayed them at the precise layer they had gone out of their way to protect. Doing everything right was not enough, because the flaw was sitting underneath “everything right.”
The one-paragraph version
A firmware bug meant that, for around five years, affected Coldcard devices generated wallet seeds using weak software randomness instead of the dedicated hardware randomness they were supposed to use. The secret behind each wallet, which should have been one unguessable number out of an astronomically large set, was quietly drawn from a set small enough for an ordinary computer to search. An attacker worked out how to reproduce that shrunken set of possible keys on their own machine, generated the candidate wallets, and checked the public blockchain to see which ones held bitcoin. Then they swept them. Coinkite, Coldcard’s maker, disclosed the flaw and shipped fixed firmware on July 30, 2026. By then the draining had already started.
How it actually happened
The whole point of a hardware wallet is randomness. Your bitcoin is protected by a secret number, your seed, and the only thing standing between you and a thief is that the number is genuinely, unguessably random. A dedicated hardware random number generator exists precisely so that the secret is drawn from a space so vast (128 bits, or roughly 340 undecillion possibilities) that no computer on Earth could ever search it.
Here is where it went wrong. Back in 2021, during a migration to Bitcoin Core’s cryptography library, the code that generates the seed was changed. It was meant to keep calling the Coldcard’s hardware randomness. Instead, through a subtle mistake in a compiler guard (an #ifndef check that failed silently when a macro was set to zero rather than left undefined), the seed generation quietly fell through to MicroPython’s built-in software pseudo-random generator. Not the hardware chip. A predictable software fallback.
The result was an entropy collapse. On the older Mk2 and Mk3 devices, the effective search space dropped from 128 bits to an estimated 40 bits. Forty bits is about a trillion possibilities, which sounds like a lot until you realise a standard computer can chew through that in minutes. Newer Mk4, Mk5 and Q devices fared better, at an estimated 72 bits, because a separate secure element mixed in some entropy of its own, but 72 bits is still a catastrophic downgrade from 128 and well within reach of a determined, well-resourced attacker.
And this is the part that should make your skin crawl: the wallet worked the entire time perfectly. It generated a seed. It signed transactions. It showed no error, no warning, no symptom. To the user, and to Coinkite, everything looked exactly as it should. The randomness was broken in a way that is completely invisible from the outside. You cannot feel a weak random number. The dice looked normal and rolled normally. They were just loaded.
Coinkite has suggested the attacker may have found the flaw by pointing AI-assisted code review at Coldcard’s publicly available source. That detail, if it holds up, is its own small chapter in the story of this year: an open codebase, sitting in plain sight for five years, and the thing that finally spotted the needle was a machine reading the haystack.
The outcome, so far
This is still unfolding as I write, so treat the figures as a moving target, but the scale is already brutal. According to the running “money map” tracker built by Nader Cserny, by August 4, 2026, roughly 1,596 BTC, on the order of 100 million dollars, had been confirmed swept from around 7,300 wallets, with a suspected further wave pushing estimates past 2,000 BTC. Different outlets have quoted different totals as the waves rolled in, from tens of millions to well over a hundred, precisely because it happened in stages over about five days rather than in one hit. The first wave alone took over a thousand wallets in forty-one minutes.
But there is a genuinely fascinating twist, and it is the one bit of daylight in the whole affair. Almost none of the stolen bitcoin has moved. The money map’s analysis is that around 90 per cent of it is still sitting exactly where it landed: zero has reached exchanges, zero has gone through mixers or coinjoin, and something like 600 attacker addresses are now being watched by law enforcement, exchanges and compliance firms. The thief has the coins and cannot easily spend them, because bitcoin’s great strength, a fully public ledger, means everyone can see every one of those addresses light up the moment it tries to cash out.
So the money is both stolen and stuck, which is a strange place to end up.
How big a deal is this, really?
Two ways to size it, and they pull in different directions.
On one hand, keep some perspective. Bitcoin itself is not broken. Its cryptography is fine, the ledger is working exactly as designed, and the wider network did nothing wrong. This was an implementation bug in one product’s firmware, not a crack in the underlying maths. A hundred million dollars is a lot of money, but set against bitcoin’s total value it is a rounding error, and several individual exchange collapses have been far larger.
On the other hand, this is a big deal in a way the dollar figure does not capture. Hardware wallets are sold and bought as the trustworthy option, the thing you graduate to when you get serious about security. This incident put a crack in that trust for an entire product category, not just one vendor. If the paranoid-grade, open-source, air-gapped device that the experts recommend can quietly ship broken randomness for five years, what does that say about the boxes people trust with far less scrutiny? And the swept wallets may not be the whole story: any seed generated on affected firmware is theoretically weak whether or not it has been drained yet, so the population at risk is larger than the population already robbed. That quiet dread, spread across every holder now wondering whether their own device is sound, is the part that outlasts the headline number.
Both things are true at once. The system held, a specific trusted product failed, and the reputational aftershock will run longer than the theft. Which is exactly why the next three questions matter so much, because they are what turn a contained bug into a lasting problem.
Am I affected, and what should I do?
The short version: you are potentially exposed if your seed was generated on a Coldcard running affected firmware, you did not add your own dice-roll entropy at setup, and you did not protect the wallet with a strong, unique BIP-39 passphrase. All three have to line up in your favour before you can relax.
Work through it in this order.
- Check your model and firmware against Coinkite’s official advisory. Mk2 and Mk3 devices are worst hit, at an estimated 40 bits of effective entropy. Mk4, Mk5 and Q land at an estimated 72 bits, which is better and still not acceptable. Do not take a version number from a blog post, including this one. Get it from the vendor.
- Update to the fixed firmware Coinkite shipped on July 30, 2026. This protects seeds you generate from now on. It does nothing at all for the seed you already have.
- Generate a completely new seed on the patched device, and this time add your own dice entropy and set a strong, unique passphrase.
- Move every satoshi across to the new wallet. Until the funds have actually moved, the old seed is still the only thing protecting them, and the old seed is the thing that is broken.
- Treat it as urgent. The attacker has the technique and a list of candidate keys. A wallet that has not been swept yet is not a wallet that is safe, it is a wallet that has not been reached yet.
If you threw your own dice or set a strong passphrase, you are very probably fine. Migrate anyway when you get a quiet weekend. Being fine by luck and being fine by design are two different things.
Why it is so hard to spot
You cannot see weak randomness. That is the whole problem. Most security failures leave a trace: a phishing email in a mailbox, an anomalous login, a file that should not be there. An entropy failure leaves nothing. The device behaves flawlessly. Your funds sit there safely for years, right up until the moment someone who has figured out the flaw drains them. There is no alert that fires, because from the system’s point of view nothing is wrong.
The only ways to catch a bug like this are to audit the code that produces the randomness, line by line, which is exactly how it was eventually found, or to notice that your money has vanished, which is the worst possible way to be told. For five years this sat in open-source code that plenty of smart people had looked at. Randomness bugs are famously easy to introduce and famously hard to see, because correct and broken randomness look identical unless you are specifically testing the source of it.
Why it is so hard to mitigate
Here is the cruel bit. Updating the firmware does not fix it. A patched device generates good randomness from now on, but it cannot retroactively heal a seed that was already created with the weak generator. That secret number is already out in the world of guessable numbers, and no software update can pull it back. If your seed was generated on affected firmware, the only real fix is to generate a completely new seed on patched firmware and move every last satoshi to the new wallet. You cannot patch your way out. You have to migrate.
That is a heavy lift for a normal person, and worse, many affected holders may not even know they need to act. If you set up a Coldcard on a bad firmware version, did not add your own dice-roll entropy, and did not protect it with a strong unique passphrase, you are exposed, and nothing about your day-to-day experience will tell you that.
Which brings up the one piece of good news for the careful. Two things saved people. If, at setup, you added a decent amount of your own independent dice-roll entropy, the device mixed in randomness the bug could not spoil. And if you protected your wallet with a strong, unique BIP-39 passphrase, that passphrase sits on top of the seed as a second secret the attacker never had. Either of those, done properly, meant the broken randomness was not your single point of failure. That is not luck. That is defence in depth doing precisely the job it exists to do.
Why it is so hard to get your money back
In the normal run of things, this is the shortest section in any crypto theft story: you don’t. Bitcoin transactions are irreversible by design. There is no bank to call, no chargeback, no fraud department, no central party who can claw the funds back. Once a valid transaction confirms, it is final. That finality is the entire value proposition of the system, and it cuts exactly as deep when you are the victim.
This case is unusual only because the attacker has been sloppy or cautious enough to leave the coins sitting still, and the transparency of the ledger has let the industry ring-fence the addresses. That is not the same as getting the money back. It is a stalemate: the thief cannot easily launder or spend it, but the rightful owners cannot retrieve it either. Recovery, if it ever comes, would depend on the attacker being identified and compelled to return it, which is a law-enforcement and legal problem measured in years, not a technical one you can solve this week. Anyone affected should assume the funds are gone and be pleasantly surprised if they are ever not.
Questions people keep asking
Which Coldcard models are affected by the entropy bug? Mk2 and Mk3 come off worst, with effective entropy estimated at around 40 bits. Mk4, Mk5 and Q are estimated at around 72 bits, because a separate secure element mixed in entropy of its own. Both numbers are a catastrophic drop from the intended 128 bits. Check your exact firmware version against Coinkite’s advisory rather than relying on the model alone.
Does updating the firmware fix it? No, not for a seed you already have. Patched firmware generates good randomness from that point forward, but it cannot retroactively repair a seed that was created with the weak generator. The only real fix is a new seed on patched firmware and a full migration of funds.
How much bitcoin was stolen? Roughly 1,596 BTC, on the order of 100 million dollars, confirmed swept from around 7,300 wallets by August 4, 2026, with a suspected further wave pushing estimates past 2,000 BTC. Reported totals vary between outlets because the theft happened in stages across about five days.
Did a BIP-39 passphrase protect people? Yes. A strong, unique passphrase sits on top of the seed as a second secret the attacker never had. So did adding your own dice-roll entropy at setup. Either one, done properly, meant the broken randomness was not a single point of failure.
Can the stolen bitcoin be recovered? Not through any technical route. Bitcoin transactions are final by design and there is no central party who can reverse them. The coins are being watched rather than recovered: around 90 percent has not moved, nothing has reached an exchange or a mixer, and roughly 600 attacker addresses are flagged. Recovery would require identifying the attacker and compelling them, which is a legal process measured in years.
Was AI used to find the bug? Coinkite has suggested the attacker may have found it by pointing AI-assisted code review at Coldcard’s open source. That is the vendor’s hypothesis rather than a confirmed fact, and it is worth treating as such.
The lesson worth carrying out of this
It is tempting to read this as a bitcoin story, or a Coldcard story, and file it under “not my problem.” It is neither. It is a story about the layer underneath everything.
Randomness is the silent foundation of essentially all modern security. Your TLS keys, your SSH keys, your password resets, your session tokens, the encryption on your laptop, all of it rests on the assumption that when a system asks for a random number it gets a genuinely unpredictable one. When that assumption quietly fails, everything built on top of it is compromised, and it fails without a sound. The Coldcard was, in most respects, an exemplary piece of security engineering: air-gapped, open-source, built by careful people. And it still got caught at layer zero, by a single misfiring compiler guard, for five years.
The two things that protect people are the same in every domain: do not let any single component be your entire security, and add your own independent layer where you can. The holders who threw their own dice and set their own passphrase did not have to trust that Coldcard’s randomness was perfect, and when it turned out not to be, they were fine. That is the whole game, whether you are securing a bitcoin seed or a corporate tenant. Belt, braces, and never a single point of failure.
The dice were loaded. The people who brought a second set of dice are the ones who still have their coins.
Sources and further reading below. Nothing here is financial advice; if you hold affected hardware, follow Coinkite’s official guidance and move funds generated on affected firmware.
Sources: Coinkite entropy technical backgrounder · Coldcard Money Map (Nader Cserny) · The Hacker News · Blockhead · Crypto Briefing