Coldcard's $130M Entropy Failure: When a Hardware Wallet Rolled Software Dice
Fifteen attackers. 7,300 wallets. $130 million in Bitcoin — drained before Coinkite finished drafting its public warning.
The first thefts landed hours ahead of the official disclosure. That timing is the detail the headlines keep missing. The attackers knew before the vendor spoke. They were already scanning the blockchain, running weak-key recovery scripts, pulling funds from wallets whose owners still believed they were untouchable.
Audit passed, but logic flawed.
This isn't a zero-day exploit in the classic sense. No remote code execution. No compromised supply chain. This is worse. This is a coin flip. Coldcard firmware routed BIP39 seed generation through MicroPython's software PRNG instead of the hardware true-random number generator. The result: private keys drawn from a 40-bit to 72-bit entropy space. The industry standard: 128 bits minimum. That gap is not a safety margin. It's a lottery ticket — and fifteen different players just claimed the jackpot.
Coldcard sits on a peculiar throne in Bitcoin's self-custody pantheon. No touchscreens. No Bluetooth. No convenience. It's the device for the paranoid professional — the anti-Ledger, treating every extra feature as betrayal. Coinkite built its reputation on being the fortress. That fortress just emitted a software-dice sound.
Be precise about the failure chain. Certain firmware versions diverted seed generation to a pseudorandom generator inside MicroPython's runtime instead of the hardware TRNG. Galaxy Research, which flagged the drain, estimates Mk2 and Mk3 units carried roughly 40 bits of entropy; the Mk4 improved to about 72. All fall far below the 128-bit floor modern cryptography treats as the minimum. That's not a bug. It's a catastrophic design regression.
The attack requires no physical access. No malware. On Bitcoin, public keys are public record — visible the moment an address spends, or immediately for Taproot outputs. Given a public key and a key space restricted to 2^72, recovery becomes a computational chore. Pollard's kangaroo algorithm needs about 2^36 group operations for a 72-bit scalar interval. For Mk2 and Mk3's 40-bit space, it's 2^20. That's not an attack. That's a weekend script on rented GPUs.
Galaxy has documented 73 confirmed victim reports, with a real count that could reach thousands. The discrepancy is the quiet horror. Long-term holders who haven't opened their vaults in years don't know yet. Their wallets are still on the table. The table is still being looted.
The attacker roster is expanding in real time. Fifteen distinct draining operations identified at last count, with new entrants joining daily. Any analyst with a node and a script can fingerprint the low-entropy keys. Marginal cost of joining the hunt: near zero. Reward: nine figures.
Coinkite's response has been swift, transparent, and structurally insufficient. A hotfix went out to every affected model and release track. Co-founder Rodolfo Novak issued a public apology. Law enforcement across multiple jurisdictions is investigating. None of it reaches the wallets already contaminated.
Read the disclosure's fine print twice: updating firmware does not fix seeds generated by vulnerable firmware. The low entropy is baked into the master private key at generation time. The only remediation is migrating Bitcoin to a newly generated wallet — ideally on a device with independently verified randomness. Coinkite cannot un-roll those dice. No patch can.
This is the moment I keep returning to. Based on my 2023 audit of EigenLayer's slasher contracts, I've learned to distinguish an upstream bug from a fallback bug. An upstream bug gets caught in review. A fallback bug — a shadow path that silently activates when the primary source fails — hides in the code path nobody exercises. The MicroPython PRNG detour is exactly that. Its existence implies the hardware TRNG was bypassed, misintegrated, or never wired into seed generation. Firmware architecture flaw, not a typo. My stress-testing scripts during the 2020 Uniswap fork sprint taught me the same rule: inspect what your system does when the primary source of trust fails.
Victims are advised to report losses to authorities, and global law enforcement is involved. But on-chain, reporting is only as useful as the next hop: if the hackers route through CoinJoin before touching a KYC'd exchange, the trail cools fast. The migration itself creates fresh operational risk — phishing addresses, clipboard hijackers, and the human error of moving a fortune in panic.
Now the detail that should keep the market awake. Ninety percent of the stolen Bitcoin hasn't moved. The attackers are not panicked opportunists liquidating into the nearest exchange. Early waves did move — probing mixers, CoinJoin rounds, OTC desks — but the bulk sits in identifiable wallets. Call it the hardware-wallet echo of an algorithmic stablecoin's death spiral: mechanism failing, operators apologizing, inventory waiting for a better exit. Stablecoin algorithm failing. Run. This time, the algorithm is your seed.
Bitcoin's price barely reacted — that's the wrong takeaway. $130 million is small relative to BTC's daily volume. The 90% that remains parked is a slow-bleed balance-sheet hazard, not a single-day shock.
The mainstream take is writing itself: hardware wallets failed; self-custody is a luxury for the technically elite; return to the warm embrace of custodial exchanges. I'll take the other side of that trade.
This event is the strongest argument for self-custody's auditability, not against it. The vulnerability was discovered by open research in an open system. Victims are identifiable. Attacker addresses are tagged. Funds are traceable. When a custodian loses nine figures — and custodians have lost far more — users get a press release and a settlement. Here, the whole attack surface sits on a public ledger, in real time. Transparency is the feature that saved the rest of us.
The next brand of smugness to flag is competitive. Ledger and Trezor will run victory laps, and Coldcard's market share will bruise. But no comparable vendor has published an independent, third-party audit of its firmware seeding paths. This is a bug class, not a brand defect. If Coldcard's software fallback could silently engage for months, assume other embedded firmware hosts shadow paths nobody has audited.
I argued during the Terra/Luna collapse that markets confuse consensus with safety. In 2022, the consensus said an algorithmic peg had implicit backing. It didn't. In 2026, the consensus says a hardware wallet's brand guarantees cryptographic soundness. It doesn't. Entropy is the one thing a logo cannot fake. Fork detected. Volatility imminent — not in BTC's price, but in the battle for who holds the keys.
Watch the migration flows. Watch the 90% hoard. Tagged Bitcoin moving in volume is the signal that attackers have found their exit ramp — and that the pressure finally reaches price.
The larger watch-item is Coldcard's post-mortem, and whether rivals commission the independent entropy audits they've been dodging. If the flagship of self-custody shipped software dice for months undetected, what else is hiding in your security stack? Trust is an assumption. Verifiability is the only defense. Check your firmware version. Then check it again.