# Coldcard $88.6M Seed Entropy Exploit > A firmware build error gave Coldcard seeds as little as 40 bits of entropy for five years; attackers brute-forced the keyspace offline and swept $88.6M in BTC from 4,585 addresses in three waves. Source: https://defimon.xyz/blog/coldcard-hack-july-2026 · Published: 2026-07-30 · Network: Bitcoin · Impact: $88.60M --- ## TLDR Starting July 30, 2026, attackers drained Bitcoin from thousands of Coldcard hardware wallet addresses whose private keys they had computed offline, without ever touching a device. The first wave swept 1,082.65 BTC, about $70.2 million, from 1,196 addresses in roughly 41 minutes between 01:10 and 01:51 UTC; follow-up waves on July 31 and August 1 took 76.16 BTC from 1,478 addresses and 207.73 BTC from 1,912 addresses, bringing running totals tracked by blockchain researchers to 1,367.05 BTC, about $88.6 million, across 4,585 addresses. The root cause was a firmware build error shipped in March 2021: seed generation silently fell back from the hardware random number generator to a software pseudorandom generator seeded with predictable device data, leaving Mk3 seeds with roughly 40 bits of effective entropy instead of 128. Every seed generated on affected firmware over more than five years is brute-forceable and must be replaced. ## Technical Analysis Coldcard's seed generation was designed to draw randomness from the STM32 microcontroller's hardware true random number generator, mixed with entropy from the device's secure element. During a software-library migration in early 2021, that path broke. The firmware's build configuration contained a guard that checked only whether a setting was defined, not whether it was actually enabled. Two random-number functions shared a matching interface: one backed by the hardware generator, the other a weak software fallback intended for development boards without suitable hardware. With the guard evaluating the wrong way, the build silently selected the fallback, MicroPython's Yasmarang pseudorandom generator, and shipped it in firmware 4.0.1 in March 2021. The pattern of the bug, schematically: ```c // Intended: use the hardware TRNG when the flag is enabled #ifdef USE_HW_RNG // checks the flag EXISTS... rng = software_prng; // ...but its VALUE (0) meant "disabled", #else // so the weak path was selected anyway rng = hardware_trng; #endif ``` The fallback generator was seeded from predictable device information: an identifier similar to the chip's serial number and internal clock registers. That collapsed the keyspace. On Mk3 devices, effective entropy dropped to roughly 40 bits instead of the intended 128. On Mk4, Mk5, and Q devices, additional entropy contributed by the secure element left an estimated 72 bits, weaker than designed but far harder to enumerate. A 40-bit space is on the order of a trillion candidates, which is a feasible precomputation for a well-resourced attacker. The attack itself never involved a victim's device. The attacker enumerated candidate seeds offline, derived the corresponding BIP-39 wallets and addresses, and checked them against the public blockchain for balances, reportedly using a paid account at a well-known blockchain data provider to run the balance queries at scale. Once funded addresses were matched to recovered keys, the attacker signed ordinary transactions and swept the coins. The July 30 wave moved 1,082.65 BTC across six blocks in 41 minutes, a burst consistent with weeks or months of quiet precomputation followed by a coordinated cash-out. ## Impact Assessment Running totals stand at 1,367.05 BTC, about $88.6 million, across 4,585 addresses over three identified waves: 1,082.65 BTC from 1,196 addresses on July 30, 76.16 BTC from 1,478 addresses on July 31, and 207.73 BTC from 1,912 addresses identified on August 1. Investigators cautioned that final figures could change as tracing continues. The exposure window is unusually long. Vulnerable firmware spans versions 4.0.0 through 4.1.9 on Mk2 and Mk3, versions before 5.6.0 on Mk4 and Mk5, and versions before 1.5.0Q on the Q: any seed generated on an affected device between March 2021 and the July 31, 2026 patches is potentially compromised. Coinkite's Tapsigner, Opendime, and Satscard products are not affected. Users who added their own entropy with dice rolls, protected funds with a strong BIP-39 passphrase, or held coins in multisignature setups requiring keys from multiple devices were substantially protected, because the brute-forced seed alone was not sufficient to spend their coins. The incident lands in a year already defined by key and infrastructure compromise rather than smart contract bugs: roughly 70% of 2026's DeFi losses trace to compromised keys, devices, and infrastructure, a pattern covered in our [top 10 DeFi hacks of 2026](/blog/top-10-defi-hacks-2026). The Coldcard exploit extends that pattern to the hardware layer of self-custody, where the failure shipped silently in a build five years before it was exploited. ## Response and Recovery Coinkite published a security advisory as the incident unfolded and released emergency firmware on July 31, 2026: version 4.2.0 or later for Mk3, 5.6.0 or later for Mk4 and Mk5, and 1.5.0Q or later for the Q. The critical operational detail is that updating firmware does not repair an existing seed. Any seed generated on vulnerable firmware remains brute-forceable forever; affected users must generate a completely new seed on patched firmware and move their coins to addresses controlled by that seed. Coinkite CEO Rodolfo Novak said on July 31: "I'm sorry and I'm devastated. Our team is heartbroken about yesterday's news." The company said it must assume an attacker used AI tooling to inspect its open-source firmware, though no evidence has established how the flaw was actually found, and information on the sweeps has been passed to authorities. For DeFi teams, the broader lesson is the one 2026 keeps teaching: catastrophic compromise is visible on-chain before it is announced, and the response window is measured in minutes. The Coldcard sweeps were coordinated bursts any observer could see in the mempool and blocks as they landed. Defimon applies that principle to DeFi, streaming [real-time exploit alerts](/) across major EVM chains as structured data the moment anomalous extraction executes. ## Frequently Asked Questions ### What happened to Coldcard? A firmware build error shipped in March 2021 made Coldcard hardware wallets generate seeds from a weak software pseudorandom generator instead of the hardware random number generator, leaving as little as 40 bits of effective entropy. Starting July 30, 2026, attackers who had brute-forced the reduced keyspace offline swept about $88.6 million in Bitcoin from roughly 4,585 affected addresses in three waves, without ever touching a victim's device. ### Which Coldcard wallets are affected by the exploit? Seeds generated on Mk2 or Mk3 firmware versions 4.0.0 through 4.1.9, Mk4 or Mk5 firmware before 5.6.0, or Q firmware before 1.5.0Q are potentially compromised. Mk3 seeds have roughly 40 bits of effective entropy and are practically brute-forceable; Mk4, Mk5, and Q seeds retain an estimated 72 bits from secure element entropy. Tapsigner, Opendime, and Satscard are not affected. Seeds protected by user-supplied dice rolls, a strong BIP-39 passphrase, or multisig were substantially protected. ### Does updating Coldcard firmware fix the vulnerability? No. The July 31, 2026 firmware releases (Mk3 4.2.0, Mk4/Mk5 5.6.0, Q 1.5.0Q) fix seed generation going forward, but an existing seed created on vulnerable firmware remains brute-forceable forever. Affected users must generate a completely new seed on patched firmware and move all funds to addresses controlled by the new seed. ### How did attackers steal Bitcoin without touching the devices? The weak generator drew its seed from predictable device data, so the attacker could enumerate candidate seeds offline, derive the corresponding wallet addresses, and check them against the public blockchain for balances. Every step ran on the attacker's own machines; once a funded address matched a recovered key, the attacker simply signed a normal transaction and swept the coins, moving 1,082.65 BTC in 41 minutes in the first wave.