The $70 Million Coldcard Firmware Exploit: How a 41-Minute Heist Broke the Promise of Hardware Wallet Security

On July 30, 2026, an attacker drained 1,082.65 BTC (roughly $70.2 million) from 1,196 Bitcoin addresses in a tightly coordinated 41-minute window between 01:10:20 and 01:51:26 UTC . The first $30 million was taken in just 10 minutes by prioritizing the largest wallets first — including one holding $1.8 million . The attacker never touched a single physical device. Everything was done remotely by regenerating wallet seeds .

A separate earlier wave of the same exploit swept 594 BTC (~$38 million) from about 500 single-signature wallets in a 25-minute burst around 01:31 UTC . Galaxy Research, Chainalysis, and Block's engineering team all independently linked the thefts to the same Coldcard vulnerability .

How the Attacker Used a Blockchain Analytics Service

Block's Bitcoin Engineering and Security team, led by engineer Clay Garrett, identified that the attacker used a paid account at a well-known blockchain-services provider to efficiently identify and query vulnerable addresses . The attacker's on-chain pattern — unusually rapid, sequential sweeps of addresses sharing the same weakness — tipped off investigators. Block confirmed trace evidence connecting the operator's activity directly to that provider's infrastructure .

Block's investigation found what Garrett described as "extraordinary specificity, down to the account level" . The analytics service effectively served as a reconnaissance tool, letting the attacker quickly map which addresses were generated on vulnerable firmware and prioritize the richest targets .

Root Cause: A Single Preprocessor Mistake

The bug was introduced in a March 2021 firmware commit (beginning with Mk3 firmware version 4.0.1) during a migration to Bitcoin Core's libsecp256k1 library . A build-configuration macro error caused the firmware to bypass the device's dedicated STM32 hardware random number generator (TRNG) and instead fall back to MicroPython's deterministic Yasmarang software RNG .

The production board configuration set MICROPY_HW_ENABLE_RNG to zero because Coldcard had a separate hardware-RNG wrapper. But the libngu library failed to call that wrapper correctly: its guard condition (

#ifndef MICROPY_HW_ENABLE_RNG

This reduced effective entropy to roughly 32–40 bits (down from the intended 128+ bits), meaning only about 4 billion possible seed values — trivially brute-forceable with modern hardware . Seeds generated without user-added dice rolls or a BIP 39 passphrase were fully exposed .

Coinkite CEO Rodolfo Novak (NVK) later acknowledged the error: "I explicitly set MICROPY_HW_ENABLE_RNG to zero, thinking we didn't need either version, but that's not what it does" .

Affected Devices and Firmware

Affected	Unaffected
Coldcard Mk3, firmware 4.0.1 through 5.0.3	Mk4, Q, Mk5 (per initial Coinkite analysis)
Seeds generated without user dice rolls or BIP 39 passphrase	Seeds generated with user-supplied dice rolls or passphrase

Coinkite later expanded its advisory to include certain Mk4, Mk5, and Q firmware versions after further analysis, and released emergency firmware updates for all affected models .

Implications for Affected Users

• Funds are unrecoverable. The stolen bitcoin has been consolidated and is likely being laundered through standard mixing services .
• Even after applying the firmware patch, old seeds remain compromised. Users must generate an entirely new seed on patched firmware and sweep all funds to new addresses .
• Users who generated seeds on Mk3 between March 2021 and July 2026 must treat those seeds as burned, even if they haven't lost funds yet — their wallets remain exposed to the same attack .
• Extra passphrases or user-supplied dice rolls mitigated the bug and protected some users even on vulnerable firmware .

Implications for the Self-Custody Debate

This exploit has shaken one of the core promises of self-custody — that a hardware wallet's secure element guarantees cryptographic safety regardless of software bugs .

• Cold storage is not failsafe. Binance founder Changpeng Zhao (CZ) publicly warned that even air-gapped hardware wallets can be rendered insecure by firmware flaws .
• The debate is now pivoting toward whether self-custody is worth the operational risk for average investors. Some analysts predict a shift back toward regulated custodians and Bitcoin ETFs as a result .
• The bug sat undetected in open-source code for over five years, showing that open-source transparency alone does not guarantee security. Some researchers now argue that AI-driven automated auditing — rather than human-only code review — is needed to catch subtle RNG integration errors before they are exploited .
• The incident also highlights a single point of failure: if a hardware vendor makes one entropy mistake, every wallet generated on that firmware is simultaneously vulnerable — a systemic risk that custodial solutions partially hedge through key-splitting and multi-party computation.

For a detailed technical breakdown, see Block's engineering report and Coinkite's technical backgrounder .