Coldcard Post-Mortem: The $130M Exploit With No Culprit

On the morning of July 30, 2026, a single attacker emptied 1,196 Bitcoin addresses in about 41 minutes. Roughly 1,082.65 BTC, worth around $70.2 million at the time, moved out of wallets that had never once touched the internet, according to The Hacker News. The devices holding those coins were Coldcards, the air-gapped hardware wallets marketed for years as the paranoid Bitcoiner’s cold storage of choice. By August 7, the confirmed take had passed $130 million across more than 5,200 addresses, and it was still climbing.

The uncomfortable part is that none of the victims did anything wrong. They did not click a phishing link, paste a seed phrase into a fake website, or sign a malicious transaction. The flaw lived in the firmware, in the one job a hardware wallet exists to do: generate a secret so random that no one can ever guess it. For more than five years, some Coldcards were quietly generating keys that were not random enough. This is the post-mortem of an exploit that breaks nearly every assumption crypto’s incident-response culture is built on.

What Actually Happened: A Five-Year-Old Bug Wakes Up

Coinkite, the Toronto company that builds Coldcard, disclosed on July 30 that older firmware could generate weak wallet seeds. Within hours, the draining began. The timeline that followed reads less like a heist and more like a gold rush, with the loss figure revised upward almost daily. Blockhead reported that by August 2 the tally had reached 1,367 BTC (about $88.6 million) across more than 4,500 addresses, and described it as a number that had climbed steadily since the first reports.

Two days later the picture was worse. Forbes counted roughly 1,816 BTC (about $116 million) taken from more than 5,200 addresses, and TechCrunch put the running total past $130 million. Tom Robinson, co-founder and chief scientist of the blockchain analytics firm Elliptic, told TechCrunch that the $130 million estimate was “roughly correct,” a phrase that captures how provisional every number in this incident really is.

Coinkite moved fast on the fix. Patched firmware was published on July 31 at 9:33 a.m. EDT, according to Bitcoin Magazine, and the company followed with a detailed technical backgrounder explaining exactly what had gone wrong. The eerie inversion at the heart of the story is this: a hardware wallet’s entire selling point is that the private key never leaves an offline device. Here, the key never had to leave. The weakness was baked into the key at the moment of its birth.

The Root Cause: One Preprocessor Guard, Five Years of Weak Keys

Coinkite’s own technical backgrounder lays out a chain of failure that is almost banal in its smallness. In 2021, Coldcard migrated its cryptography stack to the widely used libsecp256k1 library. During that migration, wallet seed generation moved from Coldcard’s purpose-built routine, ckcc.rng_bytes(), to MicroPython’s generic ngu.random.bytes(). That path resolved to MicroPython’s software fallback generator rather than to Coldcard’s dedicated hardware random number generator.

There was supposed to be a safety net. The firmware included a compile-time check meant to abort the build if the hardware RNG was not enabled. But the check used an #ifndef preprocessor guard that tested whether the macro MICROPY_HW_ENABLE_RNG was defined, not whether its value was nonzero. The macro was defined and set to zero. So the guard looked at it, saw “defined,” concluded everything was fine, and never fired the intended error. The firmware compiled silently against the software fallback, which was a small, fast, deterministic routine never designed to produce cryptographic secrets. Instead of drawing entropy from a hardware noise source, affected Coldcards were seeding wallets from a predictable software function.

Coinkite did not soften the language. “A complex and subtle series of bugs prevented the hardware RNG from contributing randomness,” the company wrote, adding bluntly that “we were unaware of the bug until today.” A macro that was defined but zero, a guard that checked the wrong condition, a fallback that was supposed to be unreachable: one wrong preprocessor test, compiled into tens of thousands of devices, shipped for half a decade. It is the kind of latent defect that survives review precisely because it hides in plumbing no one thinks to re-examine, the same pattern that keeps surfacing even when reputable firms sign off on code that later breaks, a dynamic HOGE Wire has covered in the case of protocols that were audited and hacked anyway.

How Much Entropy Is Enough, and Why 40 Bits Is Fatal

Every Bitcoin private key rests on a single assumption: that the number underneath it was chosen from a space so vast that no one could ever enumerate it. A standard 12-word BIP-39 seed is meant to encode 128 bits of entropy. That is a figure with 39 digits. Brute-forcing it is not merely hard; it is impossible for any computer that will ever be built. The word “random” on a hardware wallet’s box is doing enormous, load-bearing work.

On the affected Mk2 and Mk3 units, running firmware 4.0.1 through 4.1.9, the effective entropy collapsed to roughly 40 bits, per Coinkite’s backgrounder. Forty bits is about a trillion possibilities. A trillion sounds enormous to a person; to a modern GPU cluster it is an afternoon of work. On the newer Mk4, Mk5, and Q devices, the secure elements injected some real hardware entropy that was hashed in before the weak generator, leaving roughly 72 bits of effective search space. That is far harder than 40 bits, but it is still well short of the 128-bit design target, and the attackers plainly judged it worth grinding.

The crucial insight is that the attack requires stealing nothing from the device. Once the flawed generator is understood, an attacker can regenerate candidate keys entirely offline and simply check which ones hold funds on the public blockchain. Bitcoin’s transparency, normally a feature, becomes the oracle that tells the attacker which guesses paid off. That is the same structural move behind much of 2026’s exploit wave, in which attackers stopped fighting smart contracts head-on and went after the infrastructure feeding them, a shift HOGE Wire traced in its coverage of oracle manipulation hitting the price feed itself.

The Attack, Wave by Wave

Any honest accounting of this incident has to treat the loss total as a moving target and cite each figure to its own date and source, because they do not all agree and they should not be averaged. What follows is the forensic timeline as reported by the outlets that tracked it, from the first 41-minute drain to the running total that crossed nine figures within a week.

The total may never settle into a fixed number, and that is not a reporting failure; it is a property of the bug. Because the vulnerability sits in keys that were already generated, any address that still holds funds on affected firmware remains a target until its owner moves the coins. The exploit does not have a clean end state. It has an open tab.

A Dozen Hackers and No Kingpin

Most marquee crypto hacks arrive with a suspect. The 2025 Bybit theft came with the FBI naming North Korea’s Lazarus Group within days. A flash-loan drain comes with a specific exploiter address. The Coldcard incident has neither. Galaxy Research, the research arm of Galaxy Digital, documented more than one group racing the same pool of vulnerable addresses, and TechCrunch reported that at least a dozen distinct actors were involved.

The reason is structural. The moment Coinkite disclosed the flaw, the set of vulnerable addresses became public knowledge, and anyone with the compute to grind keys in the 40-to-72-bit range could join the hunt. It turned into an open competition rather than a targeted operation, which is exactly why no North Korea attribution has attached to this case the way it did to Bybit or to the spring 2026 bridge heists. There is no single operation to attribute. Attribution, in the sense crypto forensics usually means it, has no object here.

That absence matters for the post-mortem itself. Crypto’s response playbook assumes a counterparty on the other side of the theft: someone to trace, to name, or to negotiate with. You can open an on-chain conversation with the Euler Finance attacker; you can follow the Bybit funds through mixers; you can point at Lazarus. You cannot negotiate with a dozen anonymous grinders who owe each other nothing and were, in a sense, invited in by the disclosure. There is no one to write the ransom note to.

Did AI Find the Bug First?

One of the most striking claims came from Coinkite co-founder Rodolfo Novak, known in Bitcoin circles as NVK. Coldcard’s firmware is open source, and Novak raised the possibility that artificial intelligence, not a human researcher, surfaced the latent defect. “We believe this is a sober reality of the new AI paradigm,” he wrote, as quoted by Bitcoin Magazine. “AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts.”

His second remark was a warning to every open-source project in the space. “If your firmware is open-source or has ever been public,” he wrote, “assume it’s already being read by attackers and defenders alike.” The theory is unproven, and it should be labeled as such. But the shape is plausible. A defined-but-zero macro feeding a preprocessor guard is precisely the kind of needle a language model trained on C semantics could flag in seconds, in a spot where a tired human reviewer’s eye slides right past.

Whether or not a model found this specific bug, the economics of hunting latent flaws in public code are shifting, and they cut both ways. The same transparency that lets defenders audit Coldcard lets adversaries, human or machine, read every line too. It is the double edge every open, verifiable system now lives on, the same unresolved tension HOGE Wire has documented in the world of verifiable compute, where the hardware that is supposed to be trustworthy keeps getting broken.

Why Patching Cannot Close This Case

Here is the single most important and most misunderstood fact of the entire incident: the fix does not fix existing wallets. Coinkite shipped patched firmware within about a day, but a patch only changes how future seeds are generated. A seed already created on vulnerable firmware stays weak forever, no matter how many times the owner updates the device. In Coinkite’s own words, updating “does not repair a seed that was generated by affected firmware.”

So there is no single remediation event, no moment at which the case closes. Every affected user has to generate a brand-new seed on patched firmware and move every satoshi to the new addresses. Until they do, their funds sit in the open, waiting for a grinder to reach that address. Bybit’s loss was a fixed sum the instant the transaction cleared. Coldcard’s loss has no natural ceiling and no closing date, because the vulnerability is distributed across every un-migrated key still holding value.

There were two ways to escape the bug entirely, both of which involved a user adding entropy the buggy generator could not spoil. Owners who set up their device with 50 or more independent dice rolls supplied their own randomness by hand. Owners who added a strong BIP-39 passphrase layered a secret on top of the seed. Coinkite and independent reporting agree that seeds created either way were never at risk from this flaw alone. For everyone else, the only real fix is migration, and the clock is still running.

The Ghost of 2013: When Weak Randomness Last Emptied Wallets

None of this is new. In August 2013, a flaw in Android’s java.security.SecureRandom implementation let some Bitcoin wallet apps reuse the same “random” value when signing transactions, which allowed attackers to reconstruct private keys directly from data already public on the blockchain. The official bitcoin.org security alert named the affected apps and prescribed the identical remedy being prescribed now: generate a fresh key on fixed software and move the coins.

Thirteen years separate the Android SecureRandom failure from the Coldcard entropy bug, and the failure shape is the same in both: a randomness source that was not as random as everyone assumed, plus a public ledger that turns a subtle mathematical weakness into instant, irreversible theft. Weak randomness is not an exotic, once-in-a-generation flaw. It is one of the oldest and best-documented failure classes in all of cryptography, and it keeps finding new routes into production.

The recurrence is the real lesson. A network can spend billions of dollars a year buying security at its base layer, and that spend means nothing if the key sitting on top of it was born guessable, a gap between protocol-level and key-level security that HOGE Wire examined in its look at hashrate growth and the real price of Bitcoin’s security. Coldcard owners were, in effect, protected by the most expensive proof-of-work network on earth and undone by a preprocessor macro.

A Post-Mortem Without a Defendant

Crypto has built an elaborate culture around exploit post-mortems: the blameless technical writeup borrowed from Google’s site-reliability engineers, the on-chain negotiation with the attacker, the live transparency dashboard, the bug bounty, the governance vote to reimburse. Nearly all of it assumes there is a someone and a something to act on. A protocol with a treasury. A DAO with a token. A team that can absorb the loss. An attacker who can be reached. The Coldcard incident removes every one of those anchors at once.

There is no protocol treasury. Coinkite is a private hardware company, not a DeFi protocol sitting on a token war chest, and there is no realistic path by which a small manufacturer backstops $130 million and counting. There is no DAO, no token, and no governance mechanism to pass a reimbursement plan. There is no single attacker to negotiate with; the Euler Finance attacker returned nearly all of a roughly $197 million haul after an on-chain conversation and a bounty, and the Poly Network attacker famously gave back almost everything in 2021, but you cannot run that script against a crowd. And because un-migrated seeds stay vulnerable, there is no closing event, no final loss figure, no verdict.

The result is a post-mortem that is unusually honest at the technical level and unusually powerless at the human level. Coinkite can tell you, in exquisite detail, exactly which macro failed and why. It cannot give the 5,200 owners their Bitcoin back, and no mechanism in crypto’s response toolkit is built for a failure with no counterparty. The table below contrasts the shape of this incident with the recent hacks whose playbooks it cannot borrow.

What the Experts Are Saying

The most quotable line came from a victim. Jonathan Goodman, who Forbes reported lost 18.25245043 BTC (about C$1.6 million), described the particular cruelty of a self-custody failure that no amount of personal discipline could have prevented. “I never shared my seed phrase with anybody. My devices never touched the internet,” he said. “Perhaps the hardest part about this is that I did everything right.”

Security professionals homed in on the mechanism. Vincent Bouzon, a cybersecurity expert at the French hardware wallet maker Ledger, told Forbes that the failure was foundational: “Every wallet ultimately depends on a root secret generated from high-quality entropy. Generation must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.” The phrase “silently downgrade” is the entire incident in two words. Ido Ben-Natan, co-founder and chief executive of the security firm Blockaid, made the same point from the user’s side, telling Forbes that a hardware wallet’s security ultimately comes down to the firmware and systems that users interact with but never actually see.

The incident also reopened an old argument about open-source security. Andrew Lazutkin, chief technology officer of the wallet maker Tangem, told Forbes that “this incident is a good example of why open-source firmware should not automatically be equated with better security.” That is a pointed claim in a community that often treats openness as a synonym for safety. Coldcard’s firmware was public and auditable for years, and the bug still survived multiple releases. The takeaway is not that closed source would have been safer; it is that “open, therefore audited, therefore safe” is a chain of inference with a broken link in the middle.

Where the Regulators Are Not

For a US Coldcard owner staring at an emptied address, the natural next question is who to complain to. The honest answer is no one. The Securities and Exchange Commission oversees securities, exchanges, and brokers. A hardware manufacturer that sells a device and never once custodies a customer’s coins is none of those things, and nothing in the SEC’s remit reaches a company whose product generated a weak key. There is no deposit insurance for self-custody, no complaints window, no regulator to escalate to.

The one US body with even a plausible hook is the Federal Trade Commission, which polices unfair or deceptive practices. There is now a fresh precedent for it wading into crypto security. In December 2025, the FTC settled with Illusory Systems, the company behind the Nomad bridge, over what it called unfair security practices, requiring the firm to stand up a new information-security program. As DL News reported, industry groups objected that the agency was effectively writing security standards for code, a role no regulator was ever given. Whether that theory could ever reach a hardware wallet maker is completely untested.

Europe’s much-discussed rulebooks offer no more shelter. Both MiCA and the Digital Operational Resilience Act govern crypto-asset service providers, meaning exchanges, custodians, and issuers, not the manufacturers of the devices people store keys on. A hardware wallet maker sits in the same regulatory blind spot as a fully decentralized protocol, which is to say outside the frame entirely. Anyone trying to map which rules actually bite in 2026 and which merely sound like they do can consult HOGE Wire’s guide to the regulatory deadlines that really decide the year. For this failure class, the frame is simply empty, and the published post-mortem is the only public accounting there will ever be.

What Coldcard Owners Should Do Right Now

If you hold Bitcoin on a Coldcard, the sequence below is the widely reported remediation path. Treat it as context and verify every version number and instruction against Coinkite’s own advisory before you act, because a rushed migration is its own attack surface.

• Update the firmware immediately to the patched build for your model: 4.2.0 or later on Mk3, 5.6.0 or later on Mk4 and Mk5, 1.5.0Q or later on the Q, and the corresponding 6.6.0X or 6.6.0QX builds on Edge firmware.
• Understand that updating alone does not secure an existing wallet. If your current seed was generated on affected firmware, treat it as compromised no matter how the device behaves.
• Generate a brand-new wallet on the patched firmware and move all funds to the new addresses. Do not reuse the old seed for anything.
• If you set the device up using 50 or more independent dice rolls, or added a strong BIP-39 passphrase, you supplied entropy the bug could not weaken; confirm your setup, but you were very likely not exposed to this specific flaw.
• Do not panic-migrate onto an unfamiliar device or a hot wallet. Move deliberately, to a freshly generated seed on a patched, trusted device, and double-check receiving addresses.

The grim arithmetic is that every hour a vulnerable seed goes un-migrated is an hour an attacker’s grinder might reach it. Unlike an exchange hack, where the loss is frozen at the moment of the breach, this is a race that individual owners are still running one address at a time.

The Deeper Lesson: Trust You Cannot See

The entire proposition of a hardware wallet is that you do not have to trust anyone. The key is generated on a device in your hand, never leaves it, and cannot be guessed. Bouzon’s phrase, an architecture “that cannot silently downgrade,” names the exact promise that broke. The downgrade was silent. There was no error, no warning, no visible symptom. The device looked and behaved exactly as it should while producing keys an attacker could later reproduce at leisure.

That is the frightening general lesson, well beyond one product. Self-custody users are told to verify receiving addresses, guard their seed phrase, and avoid phishing, all of which the victims here did faithfully. None of that advice touches the layer where this failed. The trust that matters most, that the randomness under your key is genuine, is precisely the trust an ordinary user has no way to inspect. You cannot eyeball 128 bits of entropy. You take it on faith that the box did its job.

Crypto’s post-mortem culture is superb at autopsy and weak at preventing the invisible. It can reconstruct, to the line of code, how a defined-but-zero macro sent a fallback generator into production for five years. It cannot return the coins, and it has no mechanism to guarantee that the next silent downgrade gets caught before it ships. Until it does, the most accurate label for this incident is the one it wears best: a post-mortem with no defendant, and no verdict but the ledger.

Frequently Asked Questions

What is the Coldcard entropy bug?

It is a firmware flaw, present since a 2021 code change, that caused some Coldcard hardware wallets to generate wallet seeds using a weak software randomness routine instead of the device’s hardware random number generator. Affected seeds carried far less entropy than the 128-bit design target, roughly 40 bits on the Mk2 and Mk3, which made the underlying private keys guessable. Coinkite disclosed the flaw on July 30, 2026.

How much Bitcoin was stolen in the Coldcard hack?

The total climbed through early August 2026. Early tallies reached about $88.6 million (roughly 1,367 BTC) by August 2; by August 4, Forbes counted about $116 million across more than 5,200 addresses, and TechCrunch reported the running total had passed $130 million, a figure Elliptic’s Tom Robinson called roughly correct. Because vulnerable seeds stay exposed until owners migrate their funds, the number has no fixed ceiling.

Is my Coldcard affected, and what should I do?

Coldcards running affected firmware (Mk2 and Mk3 on 4.0.1 to 4.1.9, plus pre-patch Mk4, Mk5, and Q) may have generated weak seeds. Update to the patched firmware for your model, then generate a brand-new seed on the patched device and move all funds to the new addresses, because updating alone does not repair an existing seed. Seeds created with 50 or more dice rolls or a strong passphrase were not at risk from this bug.

Who hacked the Coldcard wallets?

There is no single culprit. Galaxy Research documented more than one group, and TechCrunch reported at least a dozen distinct actors racing to drain the same set of vulnerable addresses once the flaw became public. Unlike the Bybit hack, no North Korea or Lazarus attribution has stuck, because this was an open race rather than one targeted operation.

Can victims of the Coldcard exploit get their money back?

Realistically, it is unlikely. Coinkite is a private hardware manufacturer with no token treasury, DAO, or deposit insurance, and there is no single attacker to negotiate with, so there is no mechanism comparable to the Euler on-chain settlement or an exchange-backed response. In the United States the SEC does not regulate device makers, and self-custody losses carry no consumer guarantee, so recovery depends on tracing and freezing funds at exchanges, which is uncertain.

By Marcus Okafor, HOGE Wire security desk.