Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)
Last changed 2026-10-17 · Community evidence — A moderator rejected a piece of community-submitted evidence: This TechCrunch link is already accepted on this page (same_url_accepted_for_page: b2c8355a-e2c6-4b33-a5ac-e83c90e9abc9); a duplicate copy adds nothing new. Trust score now 11. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4PKVes…4yzsSummary
A build-integration defect introduced in Coldcard firmware version 4.0.1 (March 2021) silently routed BIP-39 seed generation to a weak software pseudorandom number generator instead of the device's STM32 hardware random number generator, reducing effective entropy from the intended 128 bits to as low as 40 bits on Mk3 devices and approximately 72 bits on Mk4, Mk5, and Q models. Beginning July 30, 2026, at least 15 independent threat actors exploited the flaw to brute-force private keys offline and sweep affected wallets without physical device access. As of August 10, 2026, losses exceed 2,055 BTC (approximately $130 million USD) across more than 7,700 addresses, making this the largest hardware wallet exploit on record.
Connected Entities
5 entities · 60 linked investigations- TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
- Trust Wallet→mentioned with→Bitcoin(60%)
- Coinkite→mentioned with→Bitcoin(70%)
- Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)→mentioned with→Trust Wallet(80%)
- Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)→mentioned with→Coinkite(70%)
- Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)→mentioned with→Bitcoin(70%)
- Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)→mentioned with→TraderTraitor / UNC4899(60%)
Connected Through
4 shared actors · 505 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- ♦Bitcointoken
- □TraderTraitor / UNC4899organization
- □Trust Walletorganization
- ♦Coinkitetokenalso inColdcard / Coinkite Firmware Seed-Generation Exploit (July-August 2026)·0$91M Bitcoin Social Engineering Theft — Hardware Wallet Impersonation (August 2026)·0Coldcard / Coinkite — August 2026 Multi-Actor Attacker Cluster·0Blockstream Jade — Fake Firmware Phishing Campaign (August 2026)·0Coldcard Fake Hardware Audit Phishing Campaign·0
Community submissions
- https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/(techcrunch.com)
“[Scout] TechCrunch reports that, according to Galaxy Research, hackers have stolen around $130 million by exploiting a firmware flaw affecting the Coldcard hardware wallet, with at least a dozen different hackers said to be targeting affected devices. One victim, Jonathan Goodman, claimed to have had $1.6 million stolen from his Coldcard wallet.”
— avoid-scout(unverified)
- https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack(www.trmlabs.com)
“[Scout] TRM Labs reports that losses from the Coldcard firmware entropy exploit stood near 1,816 BTC (close to $116 million) as of its assessment, with at least four waves of theft identified. The root cause was a build configuration error that caused seed generation to fall back on a weak software random number generator instead of the device's hardware entropy source; firmware version 4.0.1, released in March 2021, contained the bug, reducing key strength from 128 bits to as little as 40 bits on older devices.”
— avoid-scout(unverified)
1 submission awaiting moderator review.
Timeline(8 events)
March 2021
Coldcard firmware version 4.0.1 released, introducing the build-integration defect that routes seed generation to MicroPython's Yasmarang software PRNG instead of the STM32 hardware RNG.
COLDCARD Security Disclosure History — Coinkite30 July 2026
First confirmed attack wave begins. Approximately 1,082.65 BTC ($70.2 million) drained from 1,196 addresses within 41 minutes using offline brute-force seed recovery. Coinkite publishes initial security advisory.
Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes — The Hacker News31 July 2026
Coinkite CEO Rodolfo Novak (NVK) issues public apology, accepts full corporate responsibility. Emergency patched firmware released at 9:33 AM EDT for all affected model lines (Mk2/Mk3 v4.2.0, Mk4/Mk5 v5.6.0, Q v1.5.0Q, Edge variants). Second confirmed theft wave recorded. CoinDesk reports approximately $38 million stolen in the initial period.
Coldcard Security Advisory — COINKITE Blog; CoinDeskAugust 2026
Third wave of thefts identified over the weekend of August 1–2. Cumulative losses approach $89 million per Fox Business reporting.
Coldcard bitcoin hardware wallet flaw linked to $89M bitcoin theft — Fox Business3 August 2026
Fortune publishes in-depth coverage. TRM Labs and Galaxy Research estimate losses at approximately 1,816 BTC ($116 million) across 5,200+ addresses. Fortune confirms Block Engineering published the technical RNG analysis and Galaxy Research mapped attack patterns.
Bitcoin owners rocked by $116 million hack — Fortune4 August 2026
Fourth wave of thefts detected. Galaxy Research's Alex Thorn publicly states at least 15 independent attackers are now exploiting the vulnerability. A 64.9 BTC Wasabi Wallet coinjoin deposit and approximately 200 ETH to Tornado Cash observed, indicating early laundering activity. Galaxy confirms 1,596 BTC stolen across approximately 7,300 addresses; estimates up to 2,055 BTC ($130 million) including unconfirmed fourth wave. TechCrunch reports total losses exceed $130 million. Galaxy begins supplying attacker/victim address clusters to federal law enforcement.
15 Attackers Exploit Ongoing Coldcard Hack as Losses Approach $130M — Crypto Times; TechCrunch5 August 2026
TRM Labs publishes comprehensive incident report, classifying the event as the third-largest crypto hack of 2026 and the largest hardware wallet exploit on record.
The Largest Hardware Wallet Exploit of 2026 — TRM Labs10 August 2026
Coinkite's internal tracking logs exceed 2,000 BTC in total stolen funds. Approximately 90% of stolen Bitcoin remains unmoved on-chain. No formal class action or regulatory action filed as of this date. Investigation ongoing.
Coinkite firmware update tracking; Galaxy Research ongoing reportingDecision Log
- slot 457936992 · hash GLNyiNCTYtjjDW3e53gmjWv6JEKd6gF3QXiAM2mUnHRh
- slot 457920415 · hash AZvDjHWAeH7Ld1wkxx4VYByK165tCh9d6KicB8wNBadJ
- slot 457904068 · hash BjtGohziv6CV2Vno8GGJqdM5aNXtp2Qzw4hS5T4xwZ12
- slot 457450609 · hash 5yGY8GXs2WNerV2DbVAm2asgoPRKJxt5ghBpQ9g3Tpyr
- slot 443516219 · hash 2Y3i1q54ir6s1zNW74Dm8JdFifvYB5rAjEtELXPgXqBb
- slot 443516216 · hash 5dRmhv6qJp8V6WPS69Xt2YYHttKmLsW9fxuVxDfN3eSm
- slot 443506901 · hash Gaa9YCNcjXyNEkZXKfv8F6Xd6sFJ6p9rcmPtLmBkpqFA
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 22 of 23 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 8/10/2026, 11:06:36 PM
last updated: 10/17/2026, 6:27:56 AM
9 viewsavoid.net — verified advice for a post-truth world