Coldcard Fake Hardware Audit Phishing Campaign

2021-03-01

Coldcard firmware version 4.0.0 shipped with a coding error that routed seed generation to a deterministic software PRNG (Yasmarang) instead of the STM32 hardware RNG, reducing effective entropy to approximately 40 bits on Mk3 devices.

2026-07-30

Block and independent researchers identified active exploitation of the Coldcard firmware RNG flaw. Coinkite published a preliminary vulnerability disclosure. An attacker drained 594 BTC ($38 million) from approximately 500 single-signature wallets in a 25-minute window.

2026-07-31

Coinkite released emergency patched firmware (4.2.0+ for Mk3; 5.6.0+ for Mk4/Mk5; 1.5.0Q+ for Q) and advised all users on affected firmware versions to generate new seeds and migrate funds. Coinkite confirmed the vulnerability in a formal blog announcement.

2026-08-01

Galaxy Research tracked two additional waves of on-chain exploitation bringing total losses to 1,367 BTC (approximately $88.6 million) across 4,585 victim addresses, with at least 15 separate attackers identified.

2026-08-02

Coinkite dispatched security advisory emails to all reachable customer addresses using its store and newsletter subscription systems, reaching addresses retained from purchases beginning in 2019. This prompted public criticism over data retention practices inconsistent with prior company statements.

2026-08-03

Proofpoint documented the fake hardware audit phishing campaign, reporting that attackers had launched spoofed Coinkite emails directing victims to a cloned Coldcard website where a 'Start Hardware Audit' button delivered a GitHub-hosted batch file installing ScreenConnect remote-access software. A live human chat operator was observed guiding victims through the process.

2026-08-04

Trezor issued an urgent public phishing warning citing the surge in scam activity exploiting the Coldcard incident, advising users never to share recovery seeds and to verify all communications through official channels. Foundation issued a parallel warning about impersonation emails steering users to malicious downloads.

2026-08-04

Galaxy Research estimated potential losses could reach 2,055 BTC ($130 million) as a suspected fourth exploitation wave was under investigation. The Coldcard exploit and secondary phishing campaign together represented one of the largest self-custody security incidents in Bitcoin's history.