Galaxy Research identified 1,596 bitcoin, worth about $102 million, stolen from more than 7,300 Coldcard wallets across three confirmed waves and 14 smaller incidents. A firmware flaw dating to March 2021 left seed phrases far weaker than advertised, and attacks remain ongoing.
Coinkite confirmed the bug, shipped fixed firmware, and told users that updating does not repair old seeds. The theft exposes how a single integration error in a gold-standard air-gapped device can undo years of careful self-custody.
Three Waves and Counting Reach Past $100 Million
The first major sweep hit on July 30. One operator drained 1,082.65 BTC from 1,196 addresses in roughly 41 minutes. Galaxy Research mapped the pattern of fee rates and no-change outputs and linked it to Coldcard-generated seeds.
Two more waves followed quickly. By early August the confirmed total stood at 1,596 BTC from about 7,300 addresses. A suspected fourth wave could push the figure near 2,055 BTC, or roughly $130 million, though Galaxy has held that tranche out of its top-line count pending more victim confirmation.
| Wave | Approx. BTC | Addresses | Notes |
|---|---|---|---|
| Wave 1 (July 30) | 1,082.65 | 1,196 | 41-minute automated sweep |
| Waves 2-3 | ~284 | thousands more | Pushed observed total to 1,367 BTC |
| Confirmed total | 1,596 | ~7,300 | Plus 14 smaller incidents |
| Suspected Wave 4 | ~459 | hundreds | Unconfirmed; would reach ~2,055 BTC |
Losses skew toward smaller individual holdings by count, yet larger single-sig balances dominate the value. Galaxy reported roughly 600 attacker-controlled addresses to federal investigators, industry compliance firms and cyber investigators. Chainalysis later noted Canadian holders bore about 25 percent of attributable losses.
- 1,596 BTC confirmed stolen as of Galaxy’s Monday tally
- ~$102 million at then-prevailing prices
- ~7,300 victim addresses across confirmed activity
- Attacks still active; victims urged to migrate immediately
The speed of the opening wave points to precomputed candidate seeds rather than live brute force against each wallet. Fee-rate clustering and the absence of change outputs gave researchers a clean signature to follow across later drains. Smaller incidents continue to fill gaps between the major sweeps, which is why the address count keeps climbing even when headline BTC totals move more slowly.
How a Single 2021 Change Gutted the Randomness
Coldcard is supposed to generate a 128-bit (or better) seed using true hardware randomness. A March 2021 firmware change moved seed creation to a new library path. That path silently fell back to MicroPython’s deterministic Yasmarang software generator instead of the device’s STM32 hardware RNG.
Block’s Bitcoin Engineering and Security team published a detailed Block engineering analysis of the RNG fallback. The production board set MICROPY_HW_ENABLE_RNG to zero because Coldcard supplies its own wrapper. The library checked only whether the macro existed, not whether it was enabled. The build succeeded and bound to the weak software path seeded from device UID and timer registers.
On Mk2 and Mk3 devices running versions 4.0.1 through 4.1.9 the effective search space collapsed to roughly 40 bits. Later Mk4, Q and Mk5 models mixed limited secure-element entropy but still left about 72 bits instead of the expected 128. Wallet hashing and BIP-39 checksums cannot add entropy that was never present.
| Device and firmware | Effective entropy | Expected entropy |
|---|---|---|
| Mk2/Mk3 (4.0.1-4.1.9) | ~40 bits | 128 bits |
| Mk4, Q, Mk5 (affected builds) | ~72 bits | 128 bits |
| Any model on fixed firmware | Full hardware RNG | 128 bits or better |
Coinkite’s own Coinkite technical deep dive on the entropy failure states the company was unaware of the bug until the thefts. Its AI code review shortly beforehand also missed the issue. Attackers appear to have used similar tools to discover it.
The silent fallback mattered because nothing in the user interface warned that hardware RNG had been skipped. A seed generated in seconds looked identical to a properly random one. Only the math underneath had changed, and that math stayed hidden until someone reconstructed the weak path from public code.
What Coinkite Told Users to Do Right Now
Coinkite released fixed firmware for every affected track and published the official Coldcard security advisory and migration steps. Updating the device does not repair a seed already generated on vulnerable firmware. Users must create an entirely new seed on fixed software and move funds.
- Mk2/Mk3: install 4.2.0 or later before generating any replacement seed
- Mk4/Mk5 standard: 5.6.0 or later; Edge track 6.6.0X or later
- Q standard: 1.5.0Q or later; Edge 6.6.0QX or later
- At least 50 independent private dice rolls at original generation, or a strong unique BIP-39 passphrase, materially reduce risk but Coinkite still advises migration
- TAPSIGNER, OPENDIME and SATSCARD use different codebases and are unaffected
The recommended sequence is calm and deliberate: verify the old backup and fingerprint, generate and verify the new seed on updated firmware, send a small test transaction, then move the rest. Rushing creates new loss risks. Multisig setups that mixed other vendors or used strong passphrases fared better, yet even those holders are urged to rotate.
Dice rolls and passphrases raise the cost of an attack on any single seed, which is why Coinkite still lists them as helpful. They do not restore entropy the generator never produced. Migration remains the only complete fix for seeds born on the weak path.
When the Weak Path Opened and Closed
The public record now supports a clear sequence from introduction of the flaw to the first large drains. Each step narrowed or widened the window of exposure for holders who generated seeds in that span.
- March 2021 – Firmware change routes seed creation through the new library path that falls back to Yasmarang.
- Versions 4.0.1 through 4.1.9 – Mk2 and Mk3 devices ship with the collapsed ~40-bit search space.
- Later Mk4, Q and Mk5 builds – Limited secure-element mixing lifts effective entropy only to ~72 bits.
- July 29-30 – First large automated sweep hits; individual victims begin posting losses the same week.
- Early August – Galaxy’s confirmed tally reaches 1,596 BTC across roughly 7,300 addresses.
- Fixed firmware releases – Coinkite ships patches for every track; new seeds generate correctly, old seeds stay weak.
Five years of public repository history meant the weak binding sat in plain sight. Discovery still required someone to resolve symbols across the library boundary rather than trust the build alone. Once that work was done, the same code that defenders could audit became a map for attackers.
Numerous Attackers Left Most Coins Sitting in Plain Sight
Galaxy described “numerous” hackers rather than a single mastermind. Transaction patterns differ across waves. Some funds moved to second-hop addresses; the large majority have not. Public tallies show roughly 90 percent of the stolen bitcoin still sitting at the initial attacker addresses with zero confirmed cash-outs through exchanges or mixers.
That visibility is the twist. The same on-chain transparency that lets researchers map victims also flags every subsequent move. One widely shared post observed that the attackers now sit on one of the most blacklisted stacks in Bitcoin history.
$1.6 million dollars in Bitcoin was drained from my account on July 29th in the Cold Card wallet hack. My Bitcoin was in cold storage. My keys were on a ColdCard device kept in a safety deposit box that had never been connected to the internet.
Jonathan Goodman, a Canadian entrepreneur, posted that account after losing 18.25 BTC. He had followed every standard precaution. The seed itself was the weak link. Similar stories continue to surface as victims come forward to help Galaxy refine address lists.
Galaxy’s Galaxy Research loss tally exceeding 100 million also notes the firm is sharing findings with U.S. authorities, SEAL, exchanges and investigators. The 600 reported addresses keep the stolen coins under constant watch.
Holding the coins motionless avoids immediate exchange freezes, yet it also keeps the entire stack inside the compliance dragnet. Any later attempt to move value through regulated rails will confront the same address lists already circulating among investigators and industry firms.
Open Source, Air Gaps and the AI Mismatch
Coldcard’s entire pitch rests on verifiable open-source firmware and true air-gapping. The bug lived in public repositories for five years. Thousands of eyes, the slogan goes. End-to-end symbol resolution from seed generation through the library boundary was never fully verified in practice.
Coinkite noted that both attackers and defenders now share the same advanced AI models. In this case the tools favored the side looking for subtle integration failures. The company’s own recent AI sweep found nothing serious. The irony is sharp: the transparency meant to prevent exactly this class of failure also made the weak path discoverable once someone looked hard enough with the right tools.
Hardware wallets still beat hot wallets and exchange custody on many threat models. This incident simply shows that seed generation is a single point of failure no amount of offline storage can paper over if the entropy source itself is broken.
Air-gapping protects keys after they exist. It cannot repair entropy that was missing at birth. The open-source record supplied the evidence needed to prove the failure after the fact, yet that same record did not guarantee the failure would be caught before funds moved.
Why Blacklisted Coins Still Shape Holder Choices
Nearly all of the stolen value remains visible at the first attacker addresses. That fact changes the risk calculus for everyone still deciding how to store bitcoin, not only for the victims already hit.
Researchers and compliance teams can watch the 600 reported addresses in real time. Any spend becomes a public signal. Attackers who hoped for quiet liquidation instead hold coins that carry permanent scrutiny. Victims who migrate promptly remove themselves from the remaining target pool while the weak seeds are still being farmed.
The standoff leaves a practical message for holders on the fence. Moving to fixed firmware and fresh seeds ends exposure to this specific flaw. Leaving vulnerable seeds in place keeps those wallets inside an active hunt whose operators have already shown they can sweep thousands of addresses in minutes.
Single-Sig Self-Custody Feels the Aftershock
The practical lesson landing across forums and reply threads is blunt. Firmware updates fix future seeds only. Existing vulnerable seeds must be abandoned. Passphrases and dice rolls that met the thresholds help, yet many ordinary users never added them. The episode echoes earlier supply-chain and client-side thefts such as earlier browser-plugin thefts from exchange accounts, only this time the target was the offline vault itself.
Some holders are already moving toward multi-vendor multisig. Others are weighing the convenience of regulated platforms. European savings banks have begun offering direct bitcoin access to tens of millions of customers through apps, a path that trades self-custody risk for counterparty risk. The banks rolling out direct bitcoin trading for millions arrive at a moment when pure hardware single-sig looks less absolute than it did a month ago.
Coinkite continues to help users migrate and insists the fixed firmware restores proper generation. The stolen coins mostly sit motionless. The larger damage is the reminder that even the most carefully designed offline device can ship a silent five-year flaw that no one, including its makers and their AI reviewers, caught until the drains began.
Users who generated seeds on affected Coldcard firmware between March 2021 and the July 2026 patches still need to finish moving funds. The bug is fixed for new wallets. The trust recalculation for single-signature hardware is only starting.
