Coldcard Hack Explained: The Seed Flaw and Self-Custody

1. Introduction: A Wallet Failure, Not a Bitcoin Failure

The Coldcard hack is the largest self-custody loss event Bitcoin has seen. Beginning on 30 July 2026, attackers swept coins out of thousands of addresses whose owners had done what the industry told them to do: buy a reputable hardware wallet, generate a seed offline, and keep it there. Nothing was phished. No device was stolen.

The cause was a firmware defect at Coinkite, the Canadian company behind the Bitcoin-only Coldcard. For more than five years, some devices generated recovery seeds using weak randomness. A wallet can sit in a safe, never touch the internet, and still be compromised if the key it holds was predictable the moment it was created.

That distinction matters. This was not a break in Bitcoin’s cryptography or its network, both of which performed exactly as designed. It was a quality failure in one link of the custody chain, and it forces an uncomfortable question: when you self-custody, how many parties are you still trusting?

Below: what happened, how the flaw worked, which devices are exposed, what the on-chain data shows, how the market responded, and what a Coldcard owner should do this week.

Incident at a Glance

Metric	Value
Bitcoin price	About $63,700
Bitcoin market cap	About $1.28 trillion
Confirmed stolen (Galaxy Research, 7 Aug)	1,719 BTC, about $111 million
Wider estimate (TRM Labs)	About 1,816 BTC, about $116 million
Upper bound flagged by researchers	More than $130 million
Addresses affected	More than 5,200
First sweep	594.48 BTC in about 25 minutes, 30 July
Vulnerable firmware introduced	Version 4.0.1, March 2021
Effective entropy after the bug	About 40 bits (Mk2, Mk3), about 72 bits (Mk4, Mk5, Q)
Entropy a 12 word seed should have	128 bits
Attack waves identified	Three to four, across more than 25 patterns

Data as of 12 August 2026. Verify before publishing.

2. What Happened, and When

The sequence was fast, and the disclosure trailed the theft rather than leading it.

• 30 July, 01:31 to 01:56 UTC: roughly 594.48 BTC, about $38.3 million at the time, was swept from around 500 single-signature wallets in a single 25 minute window.
• 30 July, full first wave: Galaxy Research later sized the opening wave at 1,082.65 BTC, about $70.2 million, taken from 1,196 addresses in roughly 41 minutes.
• 31 July: Coinkite published its first public advisory and shipped emergency firmware. The scope was widened the following day after further analysis.
• 2 August: Galaxy counted about 1,367 BTC, roughly $88.6 million, across 4,585 addresses in three waves.
• 7 August: Galaxy confirmed 1,719 BTC, about $111 million, across more than 25 distinct attack patterns, and warned the eventual total would likely exceed $130 million.

TRM Labs put the figure at roughly 1,816 BTC, about $116 million, from more than 5,200 addresses across four waves. The numbers differ because each firm uses a different confidence threshold, not because anyone is guessing. Confirmed totals require corroborating victim reports, so they lag the real figure by design.

One detail deserves emphasis: the fault was traced and disclosed by Block, the company behind the Bitkey wallet, rather than found in-house.

3. How the Coldcard Hack Worked: Entropy in Plain English

A Bitcoin seed is a very large random number, shown to you as 12 or 24 words. Its security comes entirely from being unguessable. A properly generated 12 word seed carries 128 bits of entropy, roughly 340 undecillion possible values, which no computing power available today can search.

Coldcard devices carry a dedicated hardware random number generator inside the STM32 chip for exactly this purpose. In firmware 4.0.1, released March 2021, a build configuration error routed seed generation away from that hardware source and into MicroPython’s built-in pseudorandom generator instead. A pseudorandom generator is deterministic: same starting state, same output, every time. Here the starting state came from non-secret chip data. That is the whole failure.

• Intended strength: 128 bits
• Actual strength on Mk2 and Mk3: about 40 bits
• Actual strength on Mk4, Mk5 and Q: about 72 bits

Forty bits is roughly one trillion possibilities. That is a job for a laptop and some patience, not a supercomputer. Once an attacker knows the generator and its seeding data, they can enumerate every seed the device could plausibly have produced, derive the Bitcoin addresses for each, check the public blockchain for balances, and sweep whatever they find. The device never needs to be touched.

This is why a firmware update does not solve the problem for existing holders. Patching the device fixes future seed generation. It does nothing to a seed that was already created weakly, because that seed is already sitting in an attacker’s candidate list. The key was compromised at birth.

Readers who followed our work on the quantum computing threat to Bitcoin will recognise the shape of the argument: the danger is not weak mathematics, but a shrinking search space around your specific key. The difference is that quantum risk remains years away and theoretical, while this one has already been executed.

4. Who Is Affected, and Who Is Not

Coinkite’s advisory is specific about versions. Anyone holding a Coldcard should check theirs against this table rather than assume.

Model	Vulnerable versions	Fixed in
Mk2 and Mk3	4.0.1 through 4.1.9	4.2.0
Mk4 and Mk5	Anything before 5.6.0	5.6.0
Q	Anything before 1.5.0Q	1.5.0Q
Mk4 and Mk5 Edge builds	Anything before 6.6.0X	6.6.0X
Q Edge builds	Anything before 6.6.0QX	6.6.0QX

Two exemptions are worth understanding, because they are the difference between an urgent migration and a calm one.

• Dice rolls. If you added at least 50 fair, independent, private dice rolls during seed creation, your seed is not affected. The dice input alone supplied more than 128 bits of entropy, and it was hashed together with the device output, so the weak device contribution did not matter.
• BIP-39 passphrase. A strong passphrase adds real protection, but Coinkite is explicit that it is not a substitute for migration. A short, common, patterned, quoted or reused passphrase may itself be guessable once the underlying seed candidates are known.

If neither applies to you, treat the seed as compromised. Not “probably fine”, not “it has not moved yet”. Compromised.

5. What the On-Chain Evidence Shows

Bitcoin’s transparency is what allowed this to be measured so precisely. Every sweep is permanently visible, and forensic firms reconstructed the pattern within days.

• Sweeps clustered into distinct waves rather than a steady trickle, consistent with attackers precomputing candidate seeds in advance and then draining in bulk.
• The first wave concentrated on single-signature wallets, which are the easiest to sweep once a key is derived.
• More than 25 separate attack patterns were identified, pointing to multiple parties working the same vulnerability independently.
• A large portion of the proceeds was consolidated into a small number of addresses rather than immediately dispersed.

The uncomfortable implication is that vulnerable, unmoved coins stay visible to anyone who has run the same computation. Any seed generated on affected firmware and not yet migrated is a standing target, and moving the coins is the only way to stop being one.

6. What This Does Not Mean

Precision matters here, because the headline invites a broader conclusion than the facts support.

Bitcoin itself was not broken. The protocol, its cryptography, and the network operated exactly as designed throughout. Bitcoin faithfully honoured transactions signed with valid keys, which is what it is supposed to do.

Ledger and Trezor are not affected by this flaw. Ledger states its devices use a certified true random number generator inside the secure element chip, producing a full 256 bits of entropy for a 24 word recovery phrase. Trezor states it does not share Coldcard’s firmware code and mixes randomness from multiple independent sources, including the device, the connected host, and secure element chips on newer models.

That is a statement about this specific bug, not a guarantee about hardware wallets generally. The structural lesson is that security depends on the entire stack, including the entropy source, the firmware build process and the release pipeline. Coldcard’s firmware was public and open for inspection the whole time, and the defect still survived more than five years in the seed generation path. Coinkite also disclosed that a recent AI-assisted security review failed to catch it. Kraken’s chief security officer, Nick Percoco, has since called for independent testing of seed generation in production firmware across the industry.

On restitution, holders should be clear-eyed. Coinkite apologised, patched the firmware and offered to help victims file police reports, but announced no reimbursement, and its terms of service disclaim liability for software defects. Self-custody means no counterparty is obliged to make you whole.

7. Market Reaction: Money Moved Toward Regulated Wrappers

Bitcoin trades at roughly $63,700 with a market capitalisation near $1.28 trillion as of 12 August 2026, down slightly on the day. There was no price collapse, which fits the nature of the event: a $116 million theft is a rounding error against a $1.28 trillion asset, and no coins were destroyed.

The flow data is more interesting. Spot Bitcoin ETFs including IBIT, FBTC, BITB and ARKB recorded inflows on every trading day after the exploit, totalling roughly $620 million. Bloomberg ETF analyst Eric Balchunas noted on 7 August that the events highlighted the technical and security risks of self-custody and, by comparison, the appeal of a regulated wrapper.

The honest caveat is that correlation is not attribution. There is no evidence that affected Coldcard users personally moved money into ETFs. Those are simply the flows recorded after the exploit, not identified transfers from victims, and presenting the $620 million as proof of a self-custody exodus overreads the data.

The direction of travel still matters for portfolio construction. Investors who decide that running their own key infrastructure is beyond their competence now have liquid, regulated alternatives that did not exist a few years ago: a spot ETF, a qualified custodian, or exposure through a brokerage. Our earlier look at Robinhood’s expanding crypto business covers one version of that route.

8. The Case For and Against Self-Custody After This

🐂 The case that self-custody still wins

• Bitcoin’s own security model was untouched. This was a vendor defect, and vendor defects are fixable.
• The flaw was found, disclosed and patched in public, on a public ledger, within days. Opaque custodians do not fail this legibly.
• Multisig using independently generated keys from different manufacturers would have contained this entirely. One vendor’s entropy failure cannot spend a two-of-three quorum.
• Dice-roll seed generation, a feature Coldcard itself ships, fully protected the users who used it.
• Custodial failures have destroyed far more value. Mt. Gox and FTX are the reference points, and neither was recoverable by patching firmware.

🐻 The case against do-it-yourself custody

• Self-custody does not remove third parties. It replaces the exchange with a hardware vendor, a firmware team, a chip supplier and a build pipeline, none of which you can audit.
• The failure was silent for over five years, with no symptom a user could detect. Operational discipline offered no defence.
• Most retail holders run single-signature setups on one device, precisely the configuration swept first.
• There is no recourse. No insurance, no regulator, no reimbursement, no reversal.
• Doing this properly means multisig, separated backups and periodic verification. That is real operational work, and most holders will not sustain it.

Our reading is that the meaningful split is not self-custody versus custodian. It is single point of failure versus distributed failure. A single hardware wallet holding a material allocation is a concentration risk whichever brand is printed on it. The same principle we applied to counterparty risk in stablecoins applies here: identify the entity whose failure loses you everything, then arrange things so that entity does not exist.

9. What Coldcard Owners Should Do Now

If you generated a seed on a Coldcard at any point since March 2021, and you did not use 50 or more private dice rolls, follow Coinkite’s official security advisory rather than any third-party instructions, including these.

The sequence Coinkite specifies is:

1. Update the device to the fixed firmware version for your model.
2. Generate a completely new seed on the updated device.
3. Record the new backup and verify it, including the wallet fingerprint and a receiving address.
4. Send a small test transaction first and confirm it arrives.
5. Migrate the remaining balance only after that confirmation.
6. Keep the old backup until the migration is complete and confirmed, then retire it.

A safety warning that matters more than usual right now. Never type a recovery phrase into a website, an app, a “wallet checker”, a support chat, or anything sent by someone claiming to be from Coldcard or Coinkite. Incidents like this reliably attract a second wave of phishing that harvests seeds from frightened users. Legitimate support will never ask for your recovery words.

Anyone rebuilding from scratch should also weigh whether a single device is the right structure at all, or whether a multisig quorum spanning two or three manufacturers better fits the size of the holding.

Follow OneMoreBitcoin on YouTube for regular crypto market updates.

10. Outlook: What Changes From Here

The Coldcard hack will be remembered less for its dollar total than for what it revealed about the shape of self-custody risk. The threat model most holders carry in their heads is theft, coercion and phishing, all of which assume an attacker must reach the device. This attack did not need the device at all, and no amount of vault discipline would have helped.

Three things are worth watching: whether independent, third-party entropy audits of production firmware become standard across manufacturers, whether multisig moves from an enthusiast setup to a default for meaningful balances, and whether regulated wrappers keep absorbing flows from holders who decide the operational burden is not theirs to carry.

What would change this assessment is straightforward. Another entropy or key-generation defect at a second major vendor would turn a company-specific failure into a category-wide one, and that would justify a much harder look at whether consumer hardware custody suits large allocations. Absent that, the conclusion is narrower. The tools work. The way most people deploy them, on one device, with one vendor and no redundancy, does not.

Offline was never the same thing as secure. It only ever meant one attack surface had been removed.

FAQ

Is the Coldcard hack a problem with Bitcoin itself?

No. Bitcoin’s protocol and cryptography were not compromised at any point. The defect was in how one manufacturer’s firmware generated wallet seeds, which made specific users’ private keys guessable. The network processed the resulting transactions normally because they carried valid signatures.

How do I know if my Coldcard is affected?

Check your model and firmware version against Coinkite’s advisory. Mk2 and Mk3 devices running 4.0.1 through 4.1.9 are affected, as are Mk4 and Mk5 below 5.6.0 and Q below 1.5.0Q. If you added at least 50 private dice rolls when creating the seed, that seed is safe regardless of firmware version.

Is updating the firmware enough to protect my coins?

No, and this is the single most misunderstood point of the incident. Updating fixes how the device generates future seeds. A seed that was already created with weak randomness stays weak forever, so you must generate an entirely new seed on the patched device and move your Bitcoin to it.

Are Ledger and Trezor wallets affected?

Not by this flaw. Ledger uses a certified true random number generator inside its secure element, and Trezor does not share Coldcard’s firmware code and mixes several independent randomness sources. Both issued statements to that effect, though neither statement is a general guarantee about all future hardware wallet defects.

Will affected users get their Bitcoin back?

There is no reimbursement programme. Coinkite apologised, released patched firmware and offered to help victims file police reports, but its terms of service disclaim liability for software defects. On-chain forensics can trace the funds, but tracing is not recovery.

Does this mean I should stop self-custodying Bitcoin?

Not necessarily, but it is a reason to review the structure rather than the brand. The holders who were fully protected either used dice rolls or held keys in multisig arrangements spanning different manufacturers. If you are unwilling to run that kind of setup, a regulated custodian or spot ETF may be the more honest fit for your circumstances.

Disclaimer:

This article is for educational and informational purposes only. It does not constitute investment, financial, legal or tax advice, and it is not a recommendation to buy, sell or hold any digital asset.

Cryptocurrency is highly volatile and speculative. Prices can move sharply at any hour of any day, and you can lose some or all of the capital you invest. Digital assets are not bank deposits, they are generally not covered by deposit protection or investor compensation schemes, and the regulatory treatment of a token, platform or service can change quickly. Further risks include exchange or custodian failure, smart contract vulnerabilities, bridge and oracle failure, loss of private keys, and scheduled token unlocks that expand supply.

Investors should conduct their own due diligence and consider their own circumstances, time horizon and risk tolerance before making any financial decision. Consult a licensed financial adviser if you are unsure. Past performance is not indicative of future results.

OneMoreBitcoin and OneMoreMoney.com accept no responsibility for any loss incurred from reliance on the information provided in this article.