The whole point of a hardware wallet is that it's the boring, unhackable vault under your digital mattress — the thing you buy specifically so you never have to think about it again. So imagine the fun surprise for Coldcard owners this week: a five-year-old firmware bug meant their "random" seed phrases were about as random as a toddler's guess-the-number game, and someone finally noticed.

41 Minutes, $70 Million, One Bad Line of Code

On July 30, attackers drained 1,082.65 BTC — roughly $70.2 million — from 1,196 Coldcard wallet addresses in just 41 minutes. Galaxy Research later found more sweep waves, pushing the total toward 1,367 BTC (about $88.6 million) across 4,585 addresses. The root cause traces back to a March 2021 firmware integration error: a misconfigured setting caused the device to check whether a hardware flag simply existed rather than whether it was actually enabled, silently falling back to a weak software pseudorandom generator for seed creation.

That fallback used only the chip's unique ID and timer values for entropy — no real randomness collection — leaving Mk3 devices with roughly 40 bits of entropy instead of the 128 bits a secure Bitcoin seed needs. Attackers could brute-force candidate seeds offline and check them against public blockchain data to find funded wallets. Manufacturer Coinkite pushed emergency firmware on July 31, covering Mk2 through Mk5 and Q models.

The Part Where Updating Firmware Doesn't Actually Save You

Here's the gut punch: installing the patched firmware doesn't fix a wallet that's already compromised, because the weak seed was already generated and potentially already computed by an attacker. Affected users have to generate an entirely new seed on updated firmware and physically move their coins — the crypto equivalent of not just changing your locks, but moving to a new house.

This is the nightmare scenario for "cold storage": the one variable users can't personally audit — the quality of randomness inside a sealed device — was quietly broken for five years before anyone cashed in. Self-custody is supposed to mean trusting math instead of institutions, but the math still has to actually be random.

If you own a Coldcard, check your firmware version and move your funds — today, not "this weekend."

If this has you rethinking your own infrastructure, we build and harden sites for a living — say hello.

Source: The Hacker News