Coldcard (Coinkite Firmware Exploit)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·3METhY…zjgaSummary
Coldcard is a Bitcoin-only hardware wallet produced by Toronto-based Coinkite Inc. A build configuration error introduced in firmware v4.0.1 (March 2021) caused seed generation to rely on a weak software pseudorandom number generator rather than the device's hardware true random number generator, reducing effective entropy to as little as 40 bits on older models. Beginning July 30, 2026, attackers exploited this flaw to drain an estimated 1,816+ BTC (approximately $116–$130 million, depending on source and wave count) from over 5,200 addresses across four coordinated attack waves, marking the largest hardware wallet compromise in recorded history.
Connected Entities
1 entitiesTimeline(11 events)
1 May 2018
MicroPython's Yasmarang PRNG entered the MicroPython codebase. It would later become the inadvertent fallback for Coldcard seed generation.
COINKITE Blog — Technical Deep Dive1 March 2021
Coldcard firmware v4.0.1 released. A build configuration error — MICROPY_HW_ENABLE_RNG set to zero with a #ifndef guard that does not check the macro's value — caused seed generation to route through the Yasmarang software PRNG instead of the STM32 hardware RNG. Effective entropy reduced to approximately 40 bits on Mk2/Mk3 devices.
COINKITE Blog — Technical Deep Dive1 May 2025
Bitcoin developer James O'Beirne reportedly flagged the randomness code issue to Coinkite. Coinkite's response was characterized as an argument from absence — that the flaw would likely have shown up in real-world losses already if it were genuine — rather than a technical rebuttal.
Phemex Academy — Coinkite Was Warned 14 Months Early30 July 2026
Exploitation begins. Wave 1: approximately 594–1,082 BTC drained from roughly 500–1,196 addresses in 25–41 minutes (figures vary by source). Attackers used reconstructed private keys derived from the weak PRNG output without physical device access.
The Hacker News — Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes31 July 2026
Coinkite issues emergency firmware patches for all affected models and publishes a security advisory advising all users who generated seeds between March 2021 and July 2026 to migrate to a new seed immediately.
Coldcard Security Advisory — COINKITE Blog1 August 2026
Coinkite updates its security advisory with additional model-specific firmware version information and user guidance.
Coldcard Security Advisory — COINKITE Blog4 August 2026
Attackers deposit 64.9 BTC to Wasabi Wallet and approximately 200 ETH to Tornado Cash. OP_RETURN messages on some transactions solicit money-laundering assistance. TechCrunch reports total losses have surpassed $130 million.
TRM Labs — The Largest Hardware Wallet Exploit of 20264 August 2026
TechCrunch publishes a report citing blockchain-monitoring firms confirming over $130 million in losses. Galaxy Research documents losses reaching approximately $100 million at this date.
Hackers steal over $130 million by exploiting bug in offline hardware wallets — TechCrunch7 August 2026
Reports indicate approximately 1,596 BTC confirmed stolen from approximately 7,300 addresses, with a potential fourth wave that could bring total to roughly 2,055 BTC (~$130 million).
Coldcard wallet breach drains $130M in Bitcoin from 7,300 devices — Cryptonomist17 August 2026
CoinDesk publishes a detailed investigation into how the bug went unnoticed for years, including reporting on the May 2025 O'Beirne warning and Coinkite's response at that time.
How a bug in Coldcard's code went unnoticed for years — CoinDesk19 August 2026
Reports emerge, citing Bitcoin Magazine and WuBlockchain, that the FBI may have identified alleged first-wave attackers using logs from a paid blockchain analytics provider. No arrest, charge, or named suspect has been publicly confirmed as of this writing.
FBI May Have Identified First-Wave Coldcard Theft Attackers — SpendNodeDecision Log
- hash: 8aaDLjy7nD2M7M8RL1QsjcJG9gKkuNyKWwjHNsYRFpQy
This investigation is cryptographically anchored to the Solana blockchain (1 event). 0 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 9/12/2026, 11:05:19 PM
last updated: 9/12/2026, 11:05:31 PM
avoid.net — verified advice for a post-truth world