Coinkite, the manufacturer behind Coldcard hardware wallets — a brand widely used by Bitcoin holders who prioritize self-custody and open-source security — disclosed that a build error caused wallet seeds to be generated from a software fallback rather than the intended hardware random number generator, leaving them far more predictable than designed. The company believes an attacker used artificial intelligence to discover the vulnerability in its open-source firmware — a flaw the company's own AI review of the same code had failed to detect weeks earlier.

The vulnerability was exploited early Friday, resulting in estimated losses of 594 BTC, approximately $38 million. Funds were drained from roughly 500 wallets within a span of 25 minutes, with 562 BTC since consolidated into a single address.

On Thursday, Coinkite published a security advisory for its Mk3 model along with a technical breakdown, after determining that seeds produced by its devices were significantly more guessable than intended.

COLDCARD Mk3 Security Advisory

If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.

Mk4, Q and Mk5 are not affected based on our early analysis.

Read the advisory and migrate carefully:

— COLDCARD (@COLDCARDwallet) July 30, 2026

How the Vulnerability Works

Coldcard's firmware calls a function to fetch randomness during seed generation. Two implementations of this function existed in the codebase with identical signatures: the hardware generator that Coinkite developed, and a software fallback inherited from MicroPython. A preprocessor guard checked only whether a setting was defined, without verifying its actual value, allowing the build to compile against the fallback without raising any errors. Seed generation had been relying on this fallback since a code migration in March 2021. The flaw went undetected for over five years despite Coldcard's code being publicly auditable on GitHub.

Impact Across Models

Every current Coldcard model is affected to some degree. Coinkite estimates the effective search space for an Mk3 seed at approximately 40 bits, compared to the 128 bits a Bitcoin seed is designed to provide. At 40 bits, the number of possible seeds is small enough that an attacker with knowledge of the vulnerability could systematically test candidate seeds using standard computing resources. The additional entropy supplied by the secure elements in the Mk4, Q, and Mk5 raises their effective search space to roughly 72 bits, which the company says materially improves security without reaching the intended target. Coinkite's Tapsigner, Opendime, and Satscard products use different code and are unaffected.

AI Suspected in Discovery of Flaw

Coinkite stated it must assume "someone used AI to review previous versions of our firmware" to uncover the vulnerability. The firm said it had run one of the best available AI models over its own code a few weeks earlier, and the model "did not find this bug or anything serious." The company noted that attackers and defenders have access to the same tools, but in this instance, "it did not help us, and only helped the bad guys." The incident highlights an emerging asymmetry in AI-assisted code review: the same large language models that can help developers spot bugs can also help adversaries find exploitable weaknesses at scale, potentially compressing the window between vulnerability introduction and active exploitation.

What Owners Must Do

Coinkite has released an emergency hotfix — firmware version 5.6.0 for the Mk4 and Mk5, and version 1.5.0Q for the Q. However, updating the firmware does not repair a seed that was already created on affected firmware. Owners must generate a new seed on patched hardware. The company recommends using a strong BIP-39 passphrase, performing at least 99 dice rolls, or both. Mk3 owners, whose model is no longer supported, are directed to a separate migration path.

A seed created on an affected Coldcard remains vulnerable even after being restored to a different manufacturer's device — a point emphasized by rival hardware wallet maker Trezor, which assured its own users that their funds are safe. Because the weakness is in how the seed phrase itself was originally generated, no subsequent software update or device transfer can make that seed safe to continue using.

Block published an independent analysis on Friday and confirmed that none of its products are affected. The company's hardware lead, Max Guise, urged anyone exposed to move their funds as soon as they safely can.

1/ Earlier today, our Bitcoin engineering and security teams at Block began investigating reports of non-Bitkey wallets being drained. To proactively protect our customers, we began investigating immediately. Here's what we found 🧵

— Max Guise (@max_guise) July 31, 2026