The cause of omissions, the extent of thefts and manufacturer's recommendations
As of July 30, 2026, the attackers began transferring bitcoin from wallets whose seed phrases were generated on Coinkite’s Coldcard hardware wallets. The devices were not physically or remotely attacked. A firmware flaw weakened randomness when generating seed phrases, so attackers were able to regenerate possible seed phrases offline and derive private keys from them, without physical access to the devices.
Coinkite released a security warning and patched firmware for all affected models at the end of July. Since the problem is in the way the key originated, the firmware update does not fix seed phrases that have already been generated on the affected versions.
Source: cointelegraph
Where did the omission occur
Every wallet starts with a seed phrase that arises from random data, or entropy. The weaker the entropy, the smaller the number of possible keys that an attacker has to try. Coldcard was supposed to use only the hardware random number generator built into the device to generate the seed phrase.
According to Coinkite’s technical explanation, in March 2021, the company switched cryptographic operations to the libsecp256k1 library from Bitcoin Core, for which the libNgU library was added. During this integration, a firmware error occurred, due to which the generation of the seed phrase used the Yasmarang software generator from MicroPython instead of the hardware generator. Coinkite emphasizes that the hardware generator did not fail during operation, but the error occurred when compiling the firmware. Both implementations had the same function signature, so neither the firmware development nor previous code reviews revealed that the wrong one was used.
The target level of protection was 128 bits. According to Coinkite’s preliminary estimate, the effective search space for the Mk2 and Mk3 models is about 40 bits, and for the Mk4, Mk5 and Q models about 72 bits, as these models additionally included entropy from the two security chips in the calculation.
Source: cointelegraph
Which devices are affected
For the Mk2 and Mk3 models, seed phrases generated on firmware versions 4.0.1 to 4.1.9 were affected, and for the Mk4, Mk5 and Q models, seed phrases generated on versions prior to the patched releases were affected. The first patched versions were 4.2.0 for the Mk2 and Mk3, 5.6.0 for the Mk4 and Mk5, 1.5.0Q for Q, and 6.6.0X and 6.6.0QX for the Edge releases. Since additional updates have been released since then, Coinkite recommends using the latest available firmware version for the respective model. The TAPSIGNER, OPENDIME and SATSCARD products use a different code and according to Coinkite are not affected.
Coinkite lists two exceptions. Seed phrases where the user added at least 50 independent and private dice rolls are not considered by the company to be at risk due to this flaw. According to Coinkite, a strong and unique BIP-39 password (passphrase) is an additional barrier to accessing the funds behind it, but it does not fix the seed phrase generated on the affected firmware. Coinkite therefore recommends that users who use passphrase migrate to a new seed phrase as soon as possible.
Source: cointelegraph
What is the scale of thefts
According to an analysis by TRM Labs, in the first wave, about 594 BTC were transferred from about 500 wallets to one address within 25 minutes, followed by several more waves. According to an estimate by Galaxy Research as of August 25, 2026, 1,789.28 BTC from 8,865 addresses were then attributed to the theft, worth $114.7 million at the time of the theft. According to the same source, 1,561 BTC, or 87.3 percent of that amount, were still in addresses controlled by the attackers at the time, while some of the funds from later waves were moved through CoinJoin transactions and other methods of covering the trail.
In doing so, Galaxy also relied on 221 victim reports comprising 790.72 BTC, with a median loss per report of 1.04272 BTC. According to Galaxy’s assessment, multiple different attackers operated with high reliability, and the addresses of the attackers were shared by the company with crypto exchanges, compliance firms, and law enforcement agencies. The numbers change as new victims come forward.
Some of the exposed funds were moved before the attackers. According to a post by Alex Thorn of Galaxy, the 52.37 BTC removed from vulnerable wallets by white hat researchers were transferred on September 21, 2026, to the address of the Wyoming-based Crypto Recovery Trust, established to return funds to owners.
Source: cointelegraph
How Other Manufacturers Generate Keys
The case prompted other manufacturers to publicly explain how their devices reach entropy. Vincent Bouzon, director of product security at Ledger, states that Ledger devices generate seeds using a hardware generator in the Secure Element chip, whose entropy source is certified to the AIS-31 PTG.2 standard. According to Trezor’s CTO Tomáš Sušánka, Trezor combines the randomness from the device with the randomness provided by the computer to which it is connected, in addition to entropy checks when creating the wallet. According to Zach Herbert, CEO of the Foundation, their Passport combines randomness from separate hardware components, and the firmware is released as open source with reproducible builds.
Nick Percoco, chief security officer at Kraken, has proposed an industry standard that would include independent verification of the source of entropy, confirmation that the firmware does indeed call the intended hardware generator, and certification related to specific hardware and firmware versions. In his opinion, existing certifications often check individual components, but not whether the firmware uses them in manufacturing in the correct way.
Source: cointelegraph
What Coinkite recommends to users
According to Coinkite’s instructions, users of affected seed phrases are advised to update their device to the latest available firmware version for that model, generate a brand new seed phrase, and check its backup. Coinkite then recommends checking the new address and a small test transaction before transferring the rest of the funds, and keeping the old backup until the transfer is confirmed.
In mid-August, Galaxy Research said that among the theft transactions, it did not find any that took funds from a multi-signature (multisig) wallet, where multiple keys are required to be transferred. The case of Coldcard shows that the protection of funds in self-storage depends not only on the device on which the key is stored, but also on the way that key is generated.