Coldcard entropy exploit: what happened and who is at risk

On 30 July 2026, bitcoin began leaving addresses tied to Coldcard wallets in rapid waves. Researchers and Coinkite traced the root cause to a long-lived firmware bug: some devices generated recovery seeds with far less entropy than intended, making private keys brute-forceable without physical access to the device.

Early on-chain tallies moved from hundreds of millions of dollars in the first day toward ~$116M+ across multiple waves (figures kept rising as more victim sets were linked). This is the largest hardware-wallet-linked seed failure of 2026 so far — and a hard lesson that “air-gapped” does not mean “entropy was correct.”

What went wrong

Coldcard firmware dating back to a March 2021 release path could fall back to a weak software PRNG instead of the intended hardware random source when creating BIP39 seeds.

• On older Mk2/Mk3 ranges, effective entropy was reported around ~40 bits instead of the expected ~128-bit class strength.
• Newer lines (Mk4 / Mk5 / Q) were described as stronger but still short of the design target in Coinkite’s own analysis until hotfixes landed.
• A seed created under the bad path stays weak forever, even if you later flash fixed firmware or import that seed into another brand of wallet.

Not a remote malware story. Attackers did not need to phish your laptop first. They could search the reduced key space and spend.

Who is at risk

Treat yourself as in-scope if you:

1. Generated a Coldcard seed on affected firmware versions (Coinkite’s advisory lists Mk2/Mk3 4.0.1–4.1.9, and pre-hotfix Mk4/Mk5/Q builds — verify against the official advisory for your exact model), and
2. Did not create the seed with sufficient independent dice rolls / external entropy that Coinkite considers out of scope, and
3. Did not protect the wallet with a strong BIP39 passphrase that was outside the attackers’ search (passphrases help only if they were actually used and remain secret).

Updating firmware alone does not save an old seed. Fixed builds stop new weak seeds. Existing weak seeds must be abandoned.

Coinkite published emergency hotfixes (including Mk4/Mk5 5.6.0+ and Q 1.5.0Q+ ranges — confirm the current numbers on Coinkite’s site). Tapsigner / Opendime / Satscard were reported on different code paths.

Ledger, Trezor, Blockstream Jade, and others publicly stated their seed-generation stacks were not hit by this Coldcard-specific bug. That does not mean you should ignore phishing pretending to be those brands (see our follow-up post).

What to do if you used Coldcard

1. Read Coinkite’s official advisory for your model — not a random tweet thread.
2. Install the hotfix firmware from official sources only.
3. Generate a brand-new seed on the fixed device (or on a different trusted signer).
4. Verify the new wallet fingerprint / receive address on the device screen.
5. Send a small test transaction, then migrate the rest.
6. Retire the old seed. Do not “restore the same backup onto new firmware” and call it done.

If you hold meaningful BTC on a single-signature Coldcard seed from the vulnerable window, treat migration as urgent — not optional.

WalletLab take

Open-source firmware is valuable because people can audit it. This incident shows audits and users can still miss a silent RNG fallback for years. For high-value cold storage, prefer:

• Verified entropy practices (dice / multi-source designs you understand)
• Multisig across independent vendors when balances justify the complexity
• A written migration plan before the next advisory drops

Bitcoin-only cold storage options we cover include Coldcard Mk5, Coldcard Q, Blockstream Jade Plus, and our bitcoin-only best-for hub. Also see Coldcard vs Jade Plus.