Coldcard maker Coinkite has released a comprehensive security update for its Bitcoin hardware wallets, responding to a seed-generation flaw that allowed attackers to steal more than $100 million in Bitcoin—losses that have since climbed to roughly $130 million.

In a blog post on Thursday, Coinkite urged users of the Coldcard Mk4, Mk5, and Q to upgrade to firmware 5.6.1 or 1.5.1Q. The release follows a three-week review of Coldcard's systems that brought in outside security researchers as well as AI models, including Kimi.

"We are grateful to the security researchers who went above and beyond over the past weeks, reporting issues, reproducing edge cases, and reviewing our fixes," the company wrote. "Their work put this firmware under intense, sustained scrutiny and made this release stronger."

How the Exploit Worked

In July, attackers began draining Bitcoin from air-gapped Coldcard wallets by exploiting a firmware flaw dating back to 2021. The bug caused some wallet seeds—the randomly generated phrases from which a wallet's private keys are derived—to be generated with too little randomness, making their private keys easier to guess. The breach cut against the devices' core selling point: Coldcards are marketed on keeping private keys off networked computers entirely, yet the flaw let thieves compromise funds without ever touching the hardware. The first attack drained 594 BTC—worth about $38 million—from roughly 500 wallets in just 25 minutes.

Coinkite suggested the attackers may have used AI to examine older versions of its open-source firmware and uncover the flaw. By early August, Galaxy Research had tracked roughly $88.6 million stolen across 4,585 addresses, and said the attacks appeared deliberate, programmatic, and potentially orchestrated using a large language model.

The research firm continued tracking losses, and by August 14 it reported that attackers had stolen more than 1,778 BTC—worth roughly $112 million at the time—across three major attack waves and dozens of smaller incidents.

All told, the Coldcard exploit has resulted in roughly $130 million in stolen Bitcoin and raised questions about entropy, the randomness used to generate wallet keys. On some affected devices, the flaw reduced security from 128 bits of entropy to roughly 40 bits, making wallet seeds easier for attackers to guess without physical access to the device. The gap matters in practice: a 128-bit keyspace is treated as computationally infeasible to search, while 40 bits is within reach of ordinary computing hardware—the difference between a secret that is effectively unguessable and one that can be brute-forced.

New Security Measures

Coinkite said it fixed issues involving transaction signing, USB data handling, firmware validation, Delta Mode, and wallet backups. Coldcard now also requires users to add randomness when generating a wallet seed—using at least 65 key presses, 50 dice rolls, or 128 coin flips—which the device combines with its own randomness, so that seeds no longer depend on the device's internal generator alone.

The hardware wallet maker also replaced its Yasmarang backup pseudo-random number generator with SHA-256 Hash_DRBG, and added checks intended to catch failures in the hardware random number generator. Users who may have generated seeds on affected versions between 2021 and July 2026 must create a new seed using the updated firmware and move their Bitcoin, the company said.

More Than Seed Generation

Coldcard now checks a partially signed Bitcoin transaction, or PSBT, immediately before signing it. Previously, a compromised computer connected over USB could theoretically change a transaction after the user reviewed it but before the Coldcard signed it. The updated firmware stops the signing process and displays a warning if the transaction has changed. Coinkite described the issue as theoretical and did not say it had been exploited.

Coinkite also tightened USB data access, hardened Delta Mode, and changed how Coldcard handles wallet backups.

AI on Both Sides

While AI has played a role in patching vulnerabilities, it also plays a role on both sides of cybersecurity and cryptography.

"We're treating this as a serious reminder of how the whole security model of a hardware wallet lives or dies on randomness," Ledger CTO Charles Guillemet told Decrypt. "Cryptography is hard and implementing it securely is harder. This week's Coldcard incident made that visible in the most expensive way possible."

Earlier this month, swap service Boltz suspended operations after saying AI-assisted attackers were finding bugs faster than its developers could fix them. A volunteer Bitcoin Red Team also used AI agents to identify thousands of potential vulnerabilities across hundreds of Bitcoin projects. Together, the episodes illustrate how AI-assisted security review is now reaching across open-source Bitcoin software, well beyond any single vendor.

Coinkite said the investigation into the thefts remains ongoing as affected customers continue moving funds to new wallets.

"Law enforcement authorities continue investigating the thefts and are working to identify those responsible," Coinkite said. "We remain available to assist, and authorities are keeping us informed of material developments," adding that the company "remain committed to supporting every customer working through their migration until it's done."