Coldcard Firmware Exploit: How Predictable Entropy Enabled a $70 Million Bitcoin Theft Without Physical Access
Key Takeaways
- •More than 1,082 BTC valued at approximately $70 million was stolen from 1,196 Coldcard wallets in a coordinated 41-minute sweep on July 30, nearly double the initially reported 594 BTC.
- •A firmware bug introduced in March 2021 caused affected Coldcard Mk3 devices to generate seed phrases using predictable software-based randomness instead of the secure hardware random number generator.
- •Attackers were able to reconstruct victims' private keys entirely offline without ever physically accessing devices or recovery phrases, defeating the wallet's core air-gapped security model.
- •On newer Coldcard models including Mk4, Q, and Mk5, the vulnerability would have reduced the possible seed space to approximately four billion combinations, which is computationally feasible to brute-force.
- •The incident reveals that entropy generation in hardware wallets represents a single point of failure whose correctness cannot be easily verified by end users or third-party auditors after setup.
The theft of more than 1,000 BTC, valued at approximately $70 million, from vulnerable Coldcard Bitcoin wallets represents one of the most significant hardware wallet compromises on record. Coldcard, manufactured by Canadian Bitcoin security firm Coinkite, is widely regarded as one of the most security-focused hardware wallets on the market, prized for its air-gapped design that keeps private keys isolated from internet-connected devices. What sets this incident apart is that attackers never required physical access to the devices or to users' recovery phrases — defeating the very threat model the wallet was built to defend against.
Researchers now estimate that 1,082.65 BTC was stolen from 1,196 wallets in a coordinated sweep lasting just 41 minutes on July 30. This figure nearly doubles the initial estimate of 594 BTC. According to Galaxy Research, the funds were drained across six consecutive Bitcoin blocks, with wallets emptied in rapid succession.
Unlike most hardware wallet attacks, which typically rely on social engineering — tricking users into revealing seed phrases, installing malicious firmware, or surrendering their devices — this exploit targeted the wallet creation process itself. A firmware bug introduced in March 2021 caused affected Coldcard Mk3 devices to generate recovery seed phrases using predictable, software-based randomness instead of the device's secure hardware random number generator.
This meant attackers could mathematically reconstruct victims' private keys remotely, without ever touching the hardware wallets. It represents one of the rare documented cases where a flaw in the wallet's entropy generation — not user error or phishing — led directly to large-scale theft. The failure echoes a class of vulnerability seen in other cryptographic systems, most notably the 2008 Debian OpenSSL bug, where a single code change collapsed the pool of possible keys generated by millions of servers, forcing a global re-issuance of SSH and SSL certificates.
How the Exploit Worked
The attack chain proceeded through the following stages:
-
Wallet creation: During setup, the Coldcard hardware wallet is designed to generate a cryptographically secure random number known as the seed, which forms the foundation of the wallet's security.
-
Seed-derived credentials: Every private key, public key, and cryptocurrency address the wallet will ever create is mathematically derived from this seed using standardized, publicly known algorithms. As long as the seed remains unpredictable, the wallet remains secure.
-
Hardware RNG design: Under normal operation, the wallet's firmware obtains entropy from a dedicated hardware random number generator (RNG), producing a seed that is effectively impossible to predict or reproduce.
-
Firmware build misconfiguration: An internal build setting mistakenly instructed the firmware to bypass the hardware random number generator during wallet creation.
-
Validation failure: Instead of verifying whether the hardware RNG was actually enabled, a supporting software library only checked whether the configuration option existed. Because of this flawed validation logic, the firmware proceeded without raising any errors.
-
Weaker fallback: Rather than using unpredictable hardware entropy, the firmware generated the seed using a basic software routine.
-
Predictable inputs: The software routine was seeded using two sources: the device's factory-assigned serial number, which never changes, and the chip's clock registers, whose values can be estimated or reproduced by an attacker using another device of the same model.
-
Collapsed seed space: Instead of selecting from an astronomically large number of possible seeds, affected wallets could only generate a much smaller, finite set. On older Coldcard Mk2 and Mk3 devices, researchers found the seed generation could be determined outright. On Mk4, Q, and Mk5 models, the possible seed space was reduced to roughly 4 billion combinations.
-
Offline brute-force: Because four billion possibilities are well within the capabilities of modern computers, an attacker could systematically generate every candidate seed on their own hardware, entirely offline.
-
Address derivation: For every generated seed, the attacker derived all corresponding cryptocurrency addresses using the same public derivation standards the wallet employs.
-
Blockchain comparison: Since blockchain addresses and balances are public, the attacker checked whether any generated address matched one holding cryptocurrency.
-
No victim interaction required: The entire attack was performed offline. The victim's Coldcard never needed to be connected to the internet, unlocked, or physically accessed. The device could remain powered off in a safe while the attacker conducted the search elsewhere.
-
Multiple address formats: According to Galaxy's analysis, compromised wallets included 1,183 using modern Native SegWit addresses, 7 using older SegWit addresses, and 6 using legacy address formats.
-
Automated enumeration: Rather than targeting individual victims, the attacker systematically tested every possible seed and every address derivation path until funded wallets were found, indicating an automated sweep.
-
Indefinite search capability: Because the attack is entirely offline, the attacker can pause, expand, refine, and resume the enumeration process at any time, increasing the probability of discovering additional vulnerable wallets.
Implications for Hardware Wallet Security
The incident challenges one of Bitcoin's core security assumptions: that hardware wallets provide strong protection as long as users keep their recovery phrases offline. In this case, the wallets themselves generated weak seed phrases, rendering even properly stored devices vulnerable years after they were created.
The flaw specifically affects Coldcard Mk3 wallets created using firmware version 4.0.1 or later during the affected period. Newer Coldcard models are not believed to have been impacted by actual theft, though researchers noted that the seed space on Mk4, Q, and Mk5 models would have been reduced to approximately 4 billion combinations if the bug were present.
The attack underscores how even trusted hardware security can be fundamentally undermined if cryptographic randomness fails at the point a wallet is created — a vulnerability that no amount of user vigilance can mitigate. The broader implication for the hardware wallet industry is that entropy generation represents a single point of failure whose correctness is difficult to verify externally, since the randomness produced during manufacturing and setup is not easily auditable by end users or third-party reviewers after the fact.