Major Bitcoin Wallet Flaw Drains 594 BTC in 25-Minute Sweep

A Coldcard randomness bug turned "impossible to guess" seeds into guessable ones — and $38 million is already gone.

An attacker exploited a flaw in how certain Coldcard hardware wallets generated cryptographic keys, stealing approximately 594 bitcoin — worth about $38 million — from roughly 500 single-signature wallets in under 30 minutes. Random number generation failures are among the most insidious classes of cryptocurrency vulnerabilities: wallets continue to function normally, funds appear safe, and there is no visible error — yet anyone who detects the flaw can silently compute private keys and sweep funds at will, sometimes years later.

The vulnerability, introduced in Coldcard firmware 4.0.0 in March 2021, caused affected devices to bypass their hardware randomness generator and fall back to predictable, software-based key generation seeded by nonsecret chip data.

Coinkite, the Canadian manufacturer of Coldcard, has warned users who created wallet seeds on Mk3 devices running firmware version 4.0.1 or later. The company stressed that its Mk4, Q, and Mk5 models appear unaffected based on early analysis. The theft has had little visible impact on bitcoin's market price.

How the Attack Unfolded

Approximately 594 bitcoin, valued at roughly $38 million, was swept from around 500 separate wallets between 01:31 and 01:56 UTC on Friday. The attack has been traced to the Coldcard key-generation flaw.

The theft moved 1,324 chunks of bitcoin across 500 transactions within a three-block window. Of the total, 562 BTC were consolidated into a single address that has not moved since. The consolidating address can be viewed on mempool.space.

Every drained wallet was single-signature, and each held more than 0.15 BTC. Many of the wallets had been dormant for years, with coins spanning from 2021 to 2026 — matching the flaw's introduction date almost exactly.

The Root Cause

Coldcard is a hardware wallet built by Coinkite, a standalone device designed to store bitcoin private keys offline, isolated from internet-connected computers. The Mk2, Mk3, Mk4, Q, and Mk5 are successive generations of the product, released over several years.

Exposure depends on the firmware version running on the device at the moment a wallet's seed was first created — not on when the hardware was purchased.

A wallet's seed, the secret recovery phrase that controls funds, is designed to be drawn at random from an astronomically large pool of possibilities, making brute-force guessing computationally hopeless. Coldcard's firmware, however, was not achieving that standard.

According to a report published by Block's Bitcoin engineering and security teams, a build-time setting instructed the device to skip its dedicated hardware randomness generator. A check in a supporting library tested only whether that setting existed — not whether it was actually switched on.

As a result, key generation silently fell through to a basic software substitute seeded from the chip's serial number and clock registers. Neither of those values constitutes a secret: the serial number is fixed factory metadata, and clock values are timing states that an attacker could narrow down or measure on a device of their own.

Block traced the change to a commit dated March 1, 2021, which shipped in firmware 4.0.0 that same month. The failure mode echoes a well-known 2013 incident in which a flaw in Android's SecureRandom implementation allowed attackers to predict Bitcoin wallet private keys generated on affected Android devices, prompting emergency warnings from wallet developers.

Disclosure and Response

Coinkite issued a warning on its official blog, advising users who generated a seed on an Mk3 running version 4.0.1 or later to take action. The company stated: "Mk4, Q and Mk5 are not affected based on our early analysis." Standard practice for affected users is to immediately generate a new seed on a device running unaffected firmware and transfer all funds to the new wallet.

Block said it disclosed its findings directly to Coinkite, whose team acknowledged the vulnerability. Both companies described their analyses as preliminary. Block noted that it published its report without completing full exploitability testing because active exploitation was already underway.

Scope Beyond Wallet Seeds

The exposure extends beyond standard wallet seeds. The same flawed random number generator was also used to produce Coldcard's paper wallet private keys — where the output becomes the key directly with no further derivation — as well as seed-splitting masks, device cloning keys, and Key Teleport transfers. The breadth of affected features means users who relied on any of these functions on an affected Mk3 device may also be exposed, even if they never used a standard wallet seed.

Bitcoin traded above $64,000 during the early Asian trading hours, with the widespread wallet drain appearing to have had minimal impact on the broader market.

Source: CoinDesk