A firmware bug caused Coldcard hardware wallets to generate seeds from a software pseudo-random number generator rather than the dedicated hardware randomness chip designed for the task. The flaw effectively reduced the search space from 128 bits to approximately 40 bits on older device models, enabling attackers to calculate private keys and drain wallets that were never supposed to be reachable.

The coins sat on Coldcard devices—hardware wallets manufactured by Canadian company Coinkite that are designed to remain offline. Coldcards have been widely recommended in Bitcoin security circles specifically for their air-gapped design and transparent architecture, making the failure especially significant for users who chose the device precisely because of its security reputation. No phishing links, malware, or stolen devices were involved. The attackers simply deduced the private keys.

Galaxy Research has tracked more than 1,596 BTC stolen across three confirmed waves, with a suspected fourth wave that would raise the total to approximately 2,055 BTC—about $130 million at current prices. One individual sweep moved $70 million in 41 minutes. Coinkite says at least 15 separate attackers have participated. The vast majority of large-scale cryptocurrency thefts have relied on social engineering, exchange breaches, or smart-contract exploits; a vulnerability that let attackers compute keys purely from device metadata represents a fundamentally different threat surface.

The company published a technical backgrounder on August 1 explaining what went wrong. It is an unusually candid document; the short version is that the wallet was effectively rolling loaded dice for eight years without anyone noticing.

Zero Is Still Something

In 2021, Coinkite migrated Coldcard's cryptography onto libsecp256k1, the same library used by Bitcoin Core. The integration is where the problem began.

The migration quietly rerouted seed generation away from Coldcard's own hardware random number generator and onto MicroPython's software fallback—a small algorithm called Yasmarang, designed for devices that lack a randomness chip entirely.

🚨LOSSES FROM COLDCARD HACK EXCEED $100M

High confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents.

If we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).

More in the thread below 👇 pic.twitter.com/RAl3ib67qa

— Galaxy Research (@glxyresearch) August 3, 2026

Coldcard does have a randomness chip. It simply stopped being called.

The reason is almost too small to believe. A build guard used #ifndef, which checks whether a setting exists rather than whether it is switched on. Coinkite had defined that setting as zero, meaning "off." Because zero still counts as defined, the safety check passed and the build completed. Both versions of the function had identical signatures, so nothing appeared wrong. Build-configuration errors of this type—where a preprocessor directive silently selects the wrong code path—are a recognized class of defect in C and C++ development, but they are notoriously difficult to catch through testing because the compiled binary behaves normally in every observable way.

"The bulk of randomness on the COLDCARD was coming from a PRNG that I didn't know was actually in the source code base," Coinkite wrote, referring to a pseudo-random number generator—software that produces numbers which look random but follow a fixed recipe from a starting value. Feed the recipe the same starting value and the output is identical, every time.

On Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, that starting value was derived from the chip's serial number and its clock. Coinkite estimates the resulting search space at about 40 bits. Newer models mixed in a small amount of secure-element entropy, lifting the search space to roughly 72 bits.

Neither figure reaches 128, the intended target.

The gap matters more than it appears. Bits are exponents. A 128-bit search space holds more combinations than there are atoms in the observable universe, making brute-force searching effectively impossible. Forty bits amounts to roughly a trillion possibilities—a number a standard laptop can process. Each bit lost halves the attacker's required work.

Block's engineering team, which published its own analysis, put the newer devices' effective secure-element search space at 2^32 candidates, averaging around 2^31 trials. Their assessment for the older boards is blunter: given a known device ID, timer state, and call history, wallet generation is deterministic. And deterministic is the opposite of random—the property essential to cryptography.

Not "Weak." Predictable.

Coinkite suspects the vulnerability was discovered through automated code analysis. "We have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue," the company wrote, adding that it had recently run one of the best available AI models over the same code and found nothing. "Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys."

Fixed firmware has been released for every affected model. It does not repair existing seeds; those wallets must be regenerated and funds moved. Decrypt has covered how air-gapped storage changes after an exploit like this and tracked the losses climbing past $114 million.

What Entropy Actually Is

Entropy measures how much an attacker does not know—in other words, uncertainty counted in bits. One bit equals one coin flip: two outcomes, with a guesser getting it right half the time. Ten bits equals 1,024 outcomes. Each additional bit doubles the guesser's workload.

A Bitcoin wallet is fundamentally a very large number kept secret. The address that people send coins to is mathematically derived from it, and the derivation works in one direction only—you can go from key to address, but never back.

The security of every wallet therefore rests on one question: How many numbers would an attacker have to try? If the number was chosen with 128 bits of entropy, the answer is "more than physics permits." If it was chosen with 40 bits, the answer is "give me some time."

This is the same property that makes the quantum computing threat worth debating—a quantum machine would attack the mathematical link between key and address. The Coldcard bug never required anything so sophisticated. It made the keys guessable before that math even came into play.

The vocabulary here gets slippery. A pseudo-random generator produces output that passes statistical tests for randomness—nothing a spreadsheet would flag. That output, however, is still fully determined by its seed value. It looks random but is not.

Statistical randomness and cryptographic unpredictability are different properties. Coldcard's output would have sailed through the first test while failing the second completely.

True randomness must come from physical noise: electrical jitter in a circuit, thermal fluctuation, radioactive decay. That is precisely what the hardware chip on the Coldcard was designed to provide. That is the chip the build flag disconnected.

Then Luke Dashjr Brought Up the Dice

As users scrambled to regenerate seeds, many turned to the obvious low-tech fix. Coldcards allow users to roll physical dice and feed the results in as entropy. Coinkite's own guidance treats seeds made with at least 50 independent, private dice rolls as not at risk from the bug. The company even sells a bag of "100 cute and tiny little dice" to facilitate the process.

On July 31, Bitcoin Core developer Luke Dashjr posted a warning: "Quite a few people suggesting/using dice to mitigate the Coldcard vulnerability. Note that common dice are not designed to be cryptographically secure. If you are going to do this, you probably should buy precision casino dice. And even then, have another source of entropy."

Bitcoin Twitter did not take it calmly.

"lol now you can't even roll dice," one user wrote. "Self custody is done for…" Another asked whether he should hire someone with Parkinson's to throw them.

should I hire someone with parkinsons to throw the dice? — Murern (@Bitcoin_Murern) July 31, 2026

The most technically useful reply came with arithmetic. Developer Justin Sharp ran the numbers on exactly how much a biased die costs in entropy:

"Overkill. A perfect d6 gives 2.585 bits per roll. A noticeably biased die, e.g. with one face landing 20% of the time instead of 16.7%, still gives about 2.55 bits. Across 99 rolls that's the difference between ~256 bits and ~252 bits of entropy."

Four bits out of 256. That is the entire penalty for a visibly unfair die.

Dashjr is not wrong that cheap dice have measurable bias—injection-molded pips remove slightly different amounts of plastic from each face, which is precisely why casinos use flush-filled precision dice. He is right about the physics and wrong about the stakes. Losing four bits from 256 leaves 252. Coldcard's bug left users at 40.

There is a sharper argument buried in his advice, and it is not about manufacturing tolerance. It is about not trusting any single source of entropy. Coldcard's failure was not that its randomness was slightly biased—it was that one component silently stopped contributing and nothing caught it.

What to Do About It

If you generated a seed on an affected Coldcard without dice rolls or a strong BIP-39 passphrase, that seed should be considered compromised.

The recommended steps: update the firmware, generate a new seed, verify the fingerprint, send a test transaction, then move all funds. Coinkite's advisory walks through the process model by model. Exported seeds carry the flaw with them—importing a compromised seed into a different wallet application does not solve anything.

For everyone else, the takeaway is not that hardware wallets are broken or that dice are a trap. It is that "random" is a claim, and claims need verification. Coldcard's source code was public the entire time. The intended hardware RNG was present in the binary. Reviewers confirmed it existed but never confirmed that the seed generator actually called it. The open-source model that Coldcard embraced is premised on exactly this kind of community scrutiny catching flaws before attackers do. Eight years of audits looked at the right code. Nobody checked whether it ran.