{"id":53785,"date":"2026-07-31T10:22:11","date_gmt":"2026-07-31T15:22:11","guid":{"rendered":"https:\/\/bitcoinmagazine.com\/?p=53785"},"modified":"2026-07-31T11:25:01","modified_gmt":"2026-07-31T16:25:01","slug":"coldcard-wallet-exposed-after-bitcoin-hack","status":"publish","type":"post","link":"https:\/\/bitcoinmagazine.com\/news\/coldcard-wallet-exposed-after-bitcoin-hack","title":{"rendered":"Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen"},"content":{"rendered":"<div id=\"bsf_rt_marker\"><\/div>\n<p class=\"wp-block-paragraph\">The popular Bitcoin hardware wallet Coldcard product, made by Coinkite, is at risk following a $70 million hack.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Coinkite on Thursday admitted that its Coldcard Mk3 model was affected following the hack and advised users to move their funds. Then, on Friday, the company <a href=\"https:\/\/blog.coinkite.com\/entropy-technical-backgrounder\/\" target=\"_blank\" rel=\"noopener\">said<\/a> that users of the later hardware devices Mk4, Mk5, and Q should also take precautions.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Hackers on Thursday were first able to drain funds from 1,196 Bitcoin addresses because their private keys were not generated using sufficient entropy \u2014 or randomness.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Since then, a total of 1,082.65 Bitcoins have disappeared from wallets, <a href=\"https:\/\/x.com\/glxyresearch\/status\/2083181683067506899\">according<\/a> to data from Galaxy Research and engineers at payments company Block.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While Coinkite has not admitted that the hack is linked to their wallets, the company has said that a wallet seed generation bug in Coldcard products meant the hardware&#8217;s true random number generator wasn&#8217;t actually being used on certain firmware versions.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Coinkite and other engineers in the Bitcoin space are still investigating reportedly ongoing drains still happening at the time of writing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What actually happened&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A firmware bug in Coldcard Mk3 devices (starting with version 4.0.1 in March 2021) caused seed generation to fall back to a weak software PRNG instead of the hardware true random number generator, producing seeds with only ~40 bits of entropy rather than the intended 128.&nbsp; This made private keys for many single-signature wallets (especially those created without dice rolls or a strong BIP-39 passphrase) predictable enough for attackers to brute-force.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A total of 594.5 Bitcoins worth over $35.7 million at today&#8217;s prices were moved to a new <a href=\"https:\/\/mempool.space\/address\/bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r\" target=\"_blank\" rel=\"noopener\">address<\/a> from single-signature addresses on Thursday.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">\ud83d\udea8 NEW: Over 594 BTC worth $38 million was stolen from Bitcoin hardware wallet Coldcard users.<br><br>The attacker then moved around the BTC and consolidated 562 BTC into this address below. <br><br>Users are urged to review the company&#39;s official security guidance as soon as possible. \u203c <a href=\"https:\/\/t.co\/exD2Wax7CY\">pic.twitter.com\/exD2Wax7CY<\/a><\/p>&mdash; Bitcoin Magazine (@BitcoinMagazine) <a href=\"https:\/\/x.com\/BitcoinMagazine\/status\/2083155812608798827?ref_src=twsrc%5Etfw\">July 31, 2026<\/a><\/blockquote><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">More wallets were later drained, according to blockchain analysts, with the total now over $70 million.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Various affected users shared their experiences on social media, with one <a href=\"https:\/\/www.reddit.com\/r\/Bitcoin\/comments\/1vatgl4\/full_panic_one_of_my_wallets_was_drained\/\" target=\"_blank\" rel=\"noopener\">saying<\/a> that their Bitcoin had not been moved since 2021, and all of a sudden was swiped.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Bitcoin engineers have since <a href=\"https:\/\/x.com\/jamesob\/status\/2082946043696574756\">said<\/a> that Coldcard products \u2014 specifically the Mk3 models \u2014 had&nbsp; &#8220;faulty entropy in wallet generation,&#8221; meaning they did not use real randomness to create a seedphrase.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What to do&nbsp;<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Developers in the Bitcoin space have since urged users to move their funds if they used a Coldcard. Coldcard has issued guidance for users to take, which can be found <a href=\"https:\/\/blog.coinkite.com\/entropy-technical-backgrounder\/\" target=\"_blank\" rel=\"noopener\">here<\/a>.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-rich is-provider-x wp-block-embed-x\"><div class=\"wp-block-embed__wrapper\">\n<blockquote class=\"twitter-tweet\" data-width=\"550\" data-dnt=\"true\"><p lang=\"en\" dir=\"ltr\">The first post was the advisory and what users should  do.<br><br>This second post has the technical details: what actually went wrong, why our reviews missed it, the impact across Mk3\/Mk4\/Q\/Mk5, and what we changed.<a href=\"https:\/\/t.co\/HshUxevCl3\">https:\/\/t.co\/HshUxevCl3<\/a><br><br>( current evaluating Mk3 firmware release ) <a href=\"https:\/\/t.co\/Yfdx4XcztA\">https:\/\/t.co\/Yfdx4XcztA<\/a><\/p>&mdash; COLDCARD (@COLDCARDwallet) <a href=\"https:\/\/x.com\/COLDCARDwallet\/status\/2083081854597374168?ref_src=twsrc%5Etfw\">July 31, 2026<\/a><\/blockquote><script async src=\"https:\/\/platform.x.com\/widgets.js\" charset=\"utf-8\"><\/script>\n<\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Coinkite first said that their Mk3 models were affected but then on Friday said that those who did not use sufficient entropy to create a seed \u2014 in this case, 50 dice rolls \u2014 should generate a brand-new seed on the updated device. Others have warned to ditch Coldcard completely to be sure their funds are safe.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Everything is fucked,&#8221; wrote Kevin Loaec, CEO of Bitcoin security company, Wizardsardine.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">&#8220;Every single mnemonic generated [via a Coldcard] since 2021 will be public in the next few days,&#8221; Loaec warns.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Over $70 million in Bitcoin has been pinched. Coldcard has since urged its users to take precautions. <\/p>\n","protected":false},"author":3860,"featured_media":53786,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4378],"tags":[76,1263,443,1692,594],"class_list":["post-53785","post","type-post","status-publish","format-standard","has-post-thumbnail","category-news","tag-bitcoin","tag-coinkite","tag-cold-storage","tag-coldcard","tag-hack"],"author_data":{"id":3860,"name":"Mathew Di Salvo","nicename":"mathewdisalvo","avatar_url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2026\/07\/cropped-Mathew-Di-Salvo-scaled-1.jpeg"},"featured_image_url":"https:\/\/bitcoinmagazine.com\/wp-content\/uploads\/2026\/07\/Coldcard-Wallet-Flaw-Exposes-Years-of-Bitcoin-Seeds.jpg","_links":{"self":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/53785","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/users\/3860"}],"replies":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/comments?post=53785"}],"version-history":[{"count":2,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/53785\/revisions"}],"predecessor-version":[{"id":53796,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/posts\/53785\/revisions\/53796"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/media\/53786"}],"wp:attachment":[{"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/media?parent=53785"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/categories?post=53785"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bitcoinmagazine.com\/wp-json\/wp\/v2\/tags?post=53785"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}