Cold Wallets Failed the Boring Way: A 2021 RNG Bug and $130M+ in Stolen Bitcoin

Bottom line: This was not phishing, not a supply-chain implant, and not someone photographing a seed. Coldcard firmware from March 2021 quietly generated many wallet seeds from a weak, partially predictable PRNG. Attackers are reconstructing candidate seeds offline and draining addresses. Update firmware before creating anything new, then migrate funds off any seed created on affected firmware unless you know you added enough private dice entropy.

The offline hardware wallet story took a hard hit. Not because someone cracked a steel safe, but because the machine that printed the keys used a weak random-number path for years.

By early August 2026, blockchain monitors were tying more than $130 million in Bitcoin thefts to wallets associated with Coldcard, the air-gapped Bitcoin signer made by Coinkite. TechCrunch reported Galaxy Research’s roughly $130 million figure and said Elliptic co-founder Tom Robinson called that estimate roughly correct. The same week, The Hacker News detailed Galaxy’s earlier map of a single July 30 sweep: 1,082.65 BTC from 1,196 addresses in 41 minutes, about $70.2 million at the time, later revised upward as more waves appeared.

Victims did not need to click a fake link. Their devices never had to touch the internet. The seed itself was weaker than the marketing promised.

What broke

Cold storage is supposed to mean the secret stays offline. Bitcoin still lives on-chain. What protects it is a seed phrase generated with enough entropy that guessing it is impractical.

Coinkite’s own security advisory and technical backgrounder say a 2021 integration error stopped the hardware true random number generator from contributing the way engineers intended. During a migration that brought in Bitcoin Core’s libsecp256k1 via the embedded libngu library, seed generation moved from the board-local ckcc.rng_bytes() path to ngu.random.bytes().

Block’s Bitcoin engineering write-up is the clearest public root-cause note. Production board headers set MICROPY_HW_ENABLE_RNG to 0 because Coldcard ships its own RNG wrapper. Libngu checked whether that macro was defined, not whether it was enabled. MicroPython therefore bound rng_get() to its software Yasmarang fallback: a deterministic generator initialized from the MCU unique ID and timer registers, not a cryptographic entropy source that keeps collecting fresh noise.

XOR-ing two weak generators does not invent entropy. Hashing a small family of outputs does not expand the family. BIP-39 checksum bits do not either. Once an attacker can constrain device identity, boot timing, and RNG call history, candidate seeds can be generated offline and checked against public addresses or xpubs.

Block dates the regression to commit work around March 1, 2021, shipping in firmware v4.0.0 on March 17, 2021. Older Mk2/Mk3 firmware through v3.2.2 used the direct hardware RNG path and sits outside this particular failure mode.

How weak is “weak”?

Numbers matter here, and vendors and researchers do not quote identical ceilings.

Coinkite currently estimates effective search space at roughly 40 bits for affected Mk2/Mk3 seeds and about 72 bits for Mk4 / Mk5 / Q seeds that received secure-element mixing, against the 128-bit target people associate with a normal 12-word BIP-39 seed.

Block is more conditional and less tidy. For Mk2/Mk3 v4 with known UID and call history, the fallback path can collapse toward deterministic or timer-bounded search. For current devices, the secure-element reseed path only pushes four bytes into reseed(), so once fallback state and call history are fixed, Block bounds the securely distinguished streams at most 2^32. It also publishes looser “everything independent” ceilings and immediately warns those are not cryptographic security claims. Block says it has not published a full end-to-end brute-force benchmark and is writing while active exploitation is already underway.

The practical translation: this is not “AES is broken.” It is “enough wallets sit in a searchable subset that well-resourced attackers can industrialize address checking against the public chain.”

Who is affected

Exposure depends on the firmware that generated the seed, not the firmware sitting on the device today. Updating does not heal an old seed.

According to Coinkite’s advisory, with Block’s overlapping table:

Device / track	Affected seed-generation window	Fixed new-seed firmware
Mk2 / Mk3	Coinkite: 4.0.1–4.1.9; Block also flags 4.0.0–4.1.9	4.2.0+
Mk4 / Mk5 standard	Before 5.6.0	5.6.0+
Q standard	Before 1.5.0Q	1.5.0Q+
Mk4 / Mk5 Edge	Before 6.6.0X	6.6.0X+
Q Edge	Before 6.6.0QX	6.6.0QX+
Mk1; Mk2/Mk3 through 3.2.2	Outside this regression for seed generation	n/a
TAPSIGNER, OPENDIME, SATSCARD	Different codebases; not affected	n/a

Two exceptions Coinkite still emphasizes:

1. Dice. If you entered at least 50 fair, independent, private dice rolls through Coldcard’s dice flow when the seed was created, Coinkite does not consider that seed at risk from this RNG bug alone. Fewer rolls, forgotten rolls, photographed rolls, or uncertainty: migrate.
2. BIP-39 passphrase. A strong, unique passphrase is a separate wallet the bare seed cannot open. Weak, reused, quoted, or uncertain passphrases do not count. Even with a strong passphrase, Coinkite still wants you to migrate when practical because the underlying seed remains damaged.

Wizardsardine’s long incident guide stresses two extra operational points people miss under panic:

• Advanced features that also consume ngu.random can remain risky even when the main seed used dice.
• Multisig only helps when no spending path can be satisfied with affected keys alone. A 2-of-3 built entirely from weak Coldcards is still weak. A seed born on a vulnerable Mk3 and later restored onto a newer device keeps the original entropy failure.

The theft pattern

This is not one tidy “the hacker” story.

TechCrunch said at least a dozen different hackers appeared to be targeting Coldcard users, citing Galaxy Research. The Hacker News summary of Galaxy’s July 30 wave is the sharpest single snapshot: more than a thousand addresses emptied in under an hour, with fee and change patterns Galaxy treated as operator fingerprinting for that sweep, not proof of seed recovery in public. Galaxy later raised observed totals as additional waves appeared and said it had shared large sets of suspected attacker addresses with investigators and compliance teams. Public reporting still separates on-chain correlation from a courtroom-grade proof that every drained address was mathematically shown to come from weak Coldcard entropy.

One named victim voice in TechCrunch’s piece is Jonathan Goodman, who said about $1.6 million left a setup he believed he had handled correctly: no shared seed, no internet-connected signing device, physical safes and deposit boxes. His complaint is the whole genre in one line. Operational discipline cannot outrun a broken generator.

Context for the wider year: TRM Labs counted 207 crypto hacks and about $972 million stolen in H1 2026. This Coldcard wave is not that whole number. It is a different failure class from the usual DeFi contract bug or exchange hot-wallet compromise: self-custody hardware marketed specifically to people trying to avoid those failure classes.

What to do if you might be exposed

Do not improvise a panic migration that loses the backup.

1. Read Coinkite’s advisory for your model and release track. Standard and Edge are different trains. A higher-looking Edge version is not automatically fixed.
2. Install fixed firmware before generating any replacement seed. Coinkite shipped emergency builds across Mk2/Mk3, Mk4/Mk5, Q, and Edge.
3. Generate a new seed on patched firmware. Record the backup. Verify wallet fingerprint and a receive address on the device screen.
4. Send a small test transaction first. Only then move the rest.
5. Keep the old backup until the new wallet has the full confirmed balance.
6. If Mk2/Mk3 is your only device, Coinkite documents a careful one-device dance: alternate old and new seeds, verify fingerprints every switch, and prefer a second fixed device if you have one.
7. Optional hardened path after the patch: dice-only import with enough rolls, or a new multi-vendor multisig so one brand’s entropy bug cannot satisfy the spend threshold alone.

Firmware update alone is not the fix for coins you already hold. The seed is the bug’s lasting residue.

Why this still matters after the headlines move

Coldcard earned trust the hard way: open-ish firmware culture, Bitcoin-only scope, air-gapped habits, duress PINs, and a user base that lectures everyone else about seed hygiene. That reputation is why the incident stings. The failure mode is ordinary systems engineering, not cartoon villainy:

• a correct cryptographic library choice;
• a wrong entropy integration;
• a preprocessor check that tested the wrong predicate;
• a software fallback that still “looked random”;
• later secure-element mixing that improved newer units without restoring the full design target;
• and years of seed generation before public exploitation forced the disclosure.

Coinkite says it was unaware of the bug until the incident window, notes the source was public, and even floats that attackers may have used AI-assisted code review while a defensive AI pass missed it. Treat that as vendor narrative, not settled forensics. The durable lesson does not depend on whether a model found the bug:

“Hardware wallet” is not a synonym for “entropy was correct on the day your seed was born.”

For operators and anyone building custody workflows, the boring controls still win:

• Prefer multi-vendor multisig so one firmware class cannot move funds alone.
• If a device offers dice mixing, understand what it actually hashes and how many rolls count.
• Treat passphrases as high-skill tools with their own backup failure mode, not a sticker that says safe.
• Remember that exporting a weak seed into Sparrow, a phone wallet, or a multisig config does not launder the entropy.
• Separate device reputation from ceremony quality. Brand trust is not a substitute for generation-time assurance.

Self-custody remains rational. Blind faith in any single signer does not. The Coldcard wave is a reminder written in seven-figure withdrawals: offline can still mean “the secret never left the room,” while also meaning “the secret was guessable before it ever entered the room.”

Coldcard RNG vulnerability FAQ

What was the Coldcard RNG vulnerability?

A firmware integration error sent seed generation through a weak software pseudorandom-number fallback instead of adding the intended hardware entropy. That made some generated seeds substantially easier to search offline.

Which Coldcard models and firmware are affected?

The affected generation windows vary by model and release track. Coinkite lists Mk2/Mk3 4.0.1–4.1.9, standard Mk4/Mk5 before 5.6.0, standard Q before 1.5.0Q, and earlier Edge builds; Block also includes Mk2/Mk3 4.0.0.

Does installing fixed firmware protect an old seed?

No. A firmware update protects seeds generated afterward, but it cannot add entropy to an existing seed. Funds held by an affected seed should be migrated to a newly generated wallet.

Are Coldcard seeds created with dice affected?

Coinkite says seeds created with at least 50 fair, independent and private dice rolls through its dice flow are not at risk from this RNG defect alone. If the number or quality of rolls is uncertain, migrate.

Does a BIP-39 passphrase solve the Coldcard RNG problem?

A strong and unique passphrase creates a separate wallet that is harder to derive from the bare seed, but weak or reused passphrases offer little protection. Coinkite still recommends migration when practical.

Can an affected seed become safe when restored to a new device?

No. The entropy belongs to the seed, not the signer currently holding it. Restoring an affected seed to patched Coldcard firmware or another wallet does not repair its predictability.

Does multisig protect against the Coldcard RNG vulnerability?

Only if the spending threshold cannot be met with affected keys alone. Multi-vendor multisig can reduce dependence on one implementation, while a setup composed entirely of vulnerable seeds may remain exposed.

Were TAPSIGNER, OPENDIME and SATSCARD affected?

Coinkite says those products use different codebases and are not affected by this Coldcard seed-generation regression.

What should an affected Coldcard owner do first?

Check Coinkite's model-specific advisory, install the correct fixed firmware, generate and verify a new seed, test a small transfer, and then migrate the remaining funds while retaining the old backup until confirmation.

Does air-gapping prevent a weak-seed attack?

No. Air-gapping can keep a seed from leaving the device, but an attacker can still search predictable candidate seeds offline and compare their derived addresses with public blockchain data.

This article is news and information, not financial advice. If you believe your seed may be affected, follow Coinkite's model-specific guidance and verify every address on a trusted device before moving funds.