A flaw buried inside Coldcard firmware for more than five years just cost roughly 594 bitcoin — worth about $38 million — their owners. The theft, traced directly to the Coinkite seed vulnerability at the heart of the Mk3 hardware wallet, unfolded in under 30 minutes. Now, millions of dollars more may still be sitting in wallets quietly exposed to the same weakness.
Summary
Key takeaways
- An attacker swept approximately 594 BTC (~$38 million) from around 500 single-signature wallets between 01:31 and 01:56 UTC on July 31, 2026, exploiting a broken random number generator in Coldcard firmware.
- Coinkite has warned all users who generated a seed on a Mk3 running firmware 4.0.1 or later (from March 2021 onward) that their funds may be at risk.
- The bug also affects Mk4 and Mk5 devices before firmware 5.6.0, and Q devices before version 1.5.0Q, reducing seed entropy from 128 bits to roughly 72 bits.
- TAPSIGNER, OPENDIME, and SATSCARD are confirmed unaffected due to different codebases.
- Users who added at least 50 independent dice rolls during seed creation are considered protected; all others should migrate immediately to a new seed on fixed firmware.
How a Silent Firmware Bug Became a $38 Million Theft
The attack was methodical and fast. According to CoinDesk, 1,324 separate chunks of bitcoin moved across 500 transactions inside a three-block window, with 562 BTC then consolidated into a single address that has not moved since. Every drained wallet was single-signature, each held more than 0.15 BTC, and many had been dormant for years — their coins spanning 2021 to 2026, matching the flaw’s timeline almost exactly.
The root cause traces to a commit dated March 1, 2021, shipped in firmware 4.0.0. According to a report published by Block’s Bitcoin engineering and security teams, a build setting told the device to skip its own hardware randomness generator. A check in a supporting library then tested only whether that setting existed, not whether it was actually switched on. Key generation quietly fell through to a basic software substitute seeded from the chip’s serial number and clock registers — neither of which is secret.
The serial number is fixed factory metadata. Clock values are timing state that an attacker can narrow down or measure using a device of their own. What was designed to be an “impossible to guess” seed became, effectively, guessable. Block said it published its findings without full confirmation of exploitability because exploitation was already under way when the disclosure happened.
The scope goes beyond wallet seeds
The exposure doesn’t stop at seed phrases. Block noted that the same broken generator produced Coldcard’s paper wallet private keys — where the output becomes the key directly, with no further derivation — along with seed-splitting masks, device cloning keys, and Key Teleport transfers. The attack surface, in other words, is wider than just the wallets already drained.
Which Devices Are Affected — and Which Are Not
Coinkite confirmed that the issue is present on every Mk3 firmware version since 4.0.1. The impact on Mk4, Mk5, and Q is described as less severe but still serious: seeds generated on those devices before fixed firmware releases carry approximately 72 bits of entropy instead of the expected 128 bits. That reduction is meaningful — 72-bit entropy is not theoretically unbreakable under sustained, targeted attack.
Three product lines are explicitly clear: TAPSIGNER, OPENDIME, and SATSCARD are not affected, as they run entirely different codebases. Coinkite’s early analysis also indicated that Mk4, Q, and Mk5 are not affected in the same way as the Mk3, though the firmware threshold requirement still applies before generating any new replacement seed on those devices.
Exposure, critically, depends on the firmware version running at the moment the wallet was first created — not on when the hardware was purchased.
What Users Should Do Right Now
The company has published detailed step-by-step mitigation guidance. The path forward depends on which device a user holds and what they did when creating their seed.
If you added dice rolls during setup
Users who entered dice rolls when creating their seed may have unknowingly protected themselves. On affected firmware, Coldcard hashed device-generated entropy together with every dice roll provided. The thresholds matter:
- 50 to 98 independent, private rolls: dice input alone contributed at least 128 bits of entropy — seed considered safe from this RNG issue.
- 99 or more independent, private rolls: dice input contributed approximately 256 bits of entropy.
- Fewer than 50 rolls, or uncertain: follow the migration guidance immediately.
This applies only to the final seed words shown after the dice were added. If there is any uncertainty about the roll count, whether they were private, or which word set was used, migration is the only safe course.
If you used a BIP-39 passphrase
A strong, unique BIP-39 passphrase adds an independent security barrier on top of the compromised seed. The protection is real, but conditional: a short, common, patterned, or reused passphrase may be guessable and should not be treated as adequate protection. Coinkite is explicit that even users with strong passphrases should migrate to a freshly generated seed as soon as practical, and should not enter the passphrase on any website or untrusted device.
For users whose only option is the Mk3
Coinkite has provided an interim path. Users can create a passphrase-protected wallet on the Mk3 and move funds from the original wallet into it, treating this as a temporary measure. The company’s guidance walks through the process: entering a long, random, unique passphrase on the device itself (never on a computer or phone), backing it up separately from the seed words, verifying the wallet fingerprint (XFP) before any transaction, and sending a small test amount before moving the remainder.
An advanced fallback also exists: on an empty Mk3 running firmware 4.1.9, users can navigate to Import Existing > Dice Rolls and enter at least 99 independent rolls of a fair six-sided die. This path hashes the roll sequence directly without using the device’s broken generator. Coinkite stresses this is an advanced procedure — a one-device migration requires safely alternating between old and new seeds, and the dice-roll sequence must be treated as secret key material: never photographed, saved digitally, or entered on a networked computer.
For Mk4, Mk5, and Q users
Before generating any replacement seed on these models, users must first upgrade: Mk4 and Mk5 to firmware version 5.6.0 or later, and Q to version 1.5.0Q or later. Only after confirming the fixed firmware is installed should a new seed be generated. The process involves recording and verifying the backup before depositing any funds, verifying a receive address on-device, sending a small test transaction, and keeping the old backup until the entire migration is confirmed complete.
Why This Is Bigger Than One Theft
The $38 million drain is alarming on its own, but the broader implication cuts deeper. Cold storage hardware wallets exist precisely because they are supposed to be the last line of defense — air-gapped, offline, and cryptographically sound. A flaw that reduces seed entropy from 128 bits to 72 bits by silently bypassing the hardware randomness generator doesn’t just threaten one product line. It undermines the foundational assumption that offline key generation is inherently safer than software alternatives.
Block disclosed its findings to Coinkite, whose team acknowledged them. Both companies describe their analyses as preliminary. That both organizations chose to publish before completing full testing — precisely because exploitation was already active — reflects a calculated decision to prioritize user warning over conventional responsible disclosure timelines. Coinkite has confirmed the investigation is ongoing and says further details will follow. For affected users, the window for calm, careful migration is open now, but it may not stay open indefinitely.
FAQ
Which Coinkite devices are affected by the seed entropy vulnerability?
Mk3 devices running firmware version 4.0.1 or later are affected, as are Mk4 and Mk5 devices before firmware version 5.6.0, and Q devices before version 1.5.0Q. The Mk3 is the most severely impacted. TAPSIGNER, OPENDIME, and SATSCARD are not affected.
How can users protect their funds if they have used an affected device?
Users should migrate funds to a new seed generated on a device running fixed firmware. Before doing so on Mk4, Mk5, or Q, upgrade to the required firmware version first. As an interim measure, applying a strong, unique BIP-39 passphrase adds an independent layer of protection. Users who added at least 50 independent dice rolls during the original seed creation are considered safe from this specific RNG issue.
Are all Coinkite cold wallet devices affected by the vulnerability?
No. TAPSIGNER, OPENDIME, and SATSCARD are not affected because they run different codebases from the Mk-series devices.
What is the recommended approach for users who only have access to a Mk3 device?
Advanced users can create a dice-only seed on Mk3 firmware 4.1.9 by selecting Import Existing > Dice Rolls and entering at least 99 independent dice rolls. This bypasses the faulty RNG entirely. For less advanced users, applying a strong, unique BIP-39 passphrase and moving funds to the passphrase-protected wallet is the recommended interim step before migrating to a new seed on a fixed device.
Article produced with the assistance of artificial intelligence and reviewed by the editorial team.
