On July 30 at 1:10 AM UTC, someone started moving bitcoin out of wallets that were supposed to be untouchable. Forty-one minutes later, 1,196 addresses had been drained of 1,082.65 BTC — about $70.2 million at the time. The victims never clicked a phishing link. Nobody stole their seed phrases. Their hardware wallets could have been sitting in safes, powered off, on another continent.
And the theft was not finished. By the time Galaxy Research mapped the full picture, the attacker — or attackers — had hit 4,585 addresses across three waves, taking 1,367 BTC worth roughly $89 million. This is the Coldcard heist, and it is one of the most unsettling security stories of the year because it quietly dismantles the core promise of cold storage.
The Numbers: Three Waves, One Broken Assumption
Galaxy Research’s on-chain forensics turned the incident from a mystery into a systematic sweep. The opening wave moved 1,082.65 BTC from 1,196 addresses in 41 minutes, broadcast across six blocks with three empty blocks in between — the signature of batched transactions, not human fumbling. The affected wallets spanned three address formats: 1,183 native SegWit, seven older SegWit, and six legacy. No attacker targeting a specific victim does that. A scanner does.
Then came the follow-ups. Galaxy flagged a third wave early Sunday, roughly 208 BTC drained from 1,912 addresses between Friday midday and Saturday morning UTC. The average haul dropped to about a tenth of a bitcoin per victim, and the operator changed tactics — sending each victim’s coins to its own destination instead of shared collector addresses, parking funds in P2WSH outputs that can carry multisig or timelock conditions, and batching six victims into each sweep.
Here’s the detail that tells you how far this goes: the average take per wallet keeps falling. The profitable end of the key space is being picked over. Galaxy says it is confident each wave is a single operator internally, but cannot prove the three waves are the same person — the chain simply doesn’t reveal coordination. What is clear is that the sweeping was still going almost three days after the first drain.
How You Empty a Wallet You Never Touched
The attack itself is elegant in the worst way. Every address and private key in a Bitcoin wallet derives from a single seed by fixed, public rules. Coldcard’s firmware was supposed to draw that seed from a dedicated hardware random number generator. Instead, it silently drew from a weak software routine, which shrank the universe of possible seeds from astronomically large to countable — on the newest models, roughly four billion candidates.
Four billion is a large number to a person and a small one to a computer. The attacker generates candidate seeds on their own hardware, derives the addresses each would produce, and checks those addresses against the public blockchain, which anyone can download. Every step runs on the attacker’s machine. The victim’s device is never involved — it can stay powered off in a safe, and the sweep still completes.
The operator even left a trail. Block’s Clay Garrett said the attacker used a paid account at a well-known blockchain data provider to query the source addresses during the sweeps, and the provider’s internal logs matched the suspected workflow with what he called extraordinary specificity — down to the number, timing, and sequence of requests. Block has passed the information to authorities. Nobody has named the attacker yet.
The Five-Year-Old Bug at the Bottom of It All
The root cause dates back to March 2021. Block’s Bitcoin engineering team, working with other security researchers, traced it to a firmware integration error: Coldcard’s production configuration defines MICROPY_HW_ENABLE_RNG as zero because Coinkite supplies its own hardware-RNG wrapper. But the libngu library checked whether that macro existed — not whether it was actually enabled. The build succeeded, and seed generation silently fell through to MicroPython’s deterministic Yasmarang software PRNG instead of the STM32 hardware random number generator.
Yasmarang was seeded from the chip’s unique ID and timer registers. The UID is fixed factory metadata — readable, semi-public in some cases. The timer values are timing state an attacker can narrow down. And critically, the fallback collected no fresh entropy after initialization. For a known UID, timer state, and call history, the entire output stream becomes reproducible.
Block’s assessment breaks down by model. On Mk2 and Mk3 running firmware 4.0.0 through 4.1.9, no cryptographic entropy was added at all — wallet generation is effectively deterministic for an attacker who knows the parameters. On Mk4, Q, and Mk5, the secure element adds entropy, but the firmware hashes it and keeps only four bytes, leaving at most 2^32 — roughly 4 billion — distinguishable output streams. Coinkite estimates effective entropy of about 40 bits on the Mk3 and roughly 72 bits on the Mk4, Mk5, and Q, against the 128 bits of a standard 12-word BIP-39 seed. Even the better-case numbers are nowhere near what cold storage is supposed to mean. Hashing the seed with SHA256d does not repair this; deterministic hashing cannot increase the number of possible inputs, and the BIP-39 checksum adds no entropy either.
The Patch That Can’t Fix Your Seed
Coinkite shipped emergency firmware for every affected model and release track on July 31. But here is the hard truth of this bug: updating the firmware does not repair an existing seed. Exposure depends on the firmware that was running when your seed was created, not the version installed today. Restoring an old seed onto patched firmware — or into any other wallet — carries the weakness forward.
Coinkite’s guidance is blunt: if your seed may have been generated on vulnerable firmware, generate a new one on patched firmware and move your coins. A seed built from at least 50 fair, independent, private dice rolls is not at risk from this bug alone. A strong, unique BIP-39 passphrase creates a separate wallet the seed words cannot reach on their own — but Coinkite still recommends replacing the seed. Multisig helps only if your quorum is not built entirely from affected devices. And there is no self-test an owner can run to confirm exposure; you have to assume the worst rather than verify it.
The timing makes it worse. This follows Coinspect’s Ill Bloom research in early July, a separate weak-PRNG flaw in older software wallets tied to more than $5 million drained from addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon since May. Weak randomness in crypto is becoming a recurring theme — and every incident teaches the next attacker exactly where to look.
My Take: We Trusted the Box, Not the Math
Hardware wallets are the closest thing the digital world has to a physical vault. You buy one precisely because it keeps the private key away from anything that can be phished, stolen, or hijacked. The entire sales pitch is distance — the key lives on a device that never touches the internet. What this attack shows is that distance is not enough. The attacker did not reach the key; they rebuilt it from the same inputs the wallet used, because the wallet’s randomness was quietly broken for five years.
From where I sit, managing IT for a government institution, the lesson lands harder. We treat hardware as a trust anchor all the time — firewalls, HSMs, VPN appliances, network gear — and we assume that because it is a physical box with a vendor logo, the crypto inside is sound. Coldcard is a security-focused product from a respected Canadian company with a genuinely good reputation in the Bitcoin community. If that team can ship a config macro that silently disables the hardware RNG and a library check that fails to catch it, then every one of us who rubber-stamps vendor firmware as secure by design needs to rethink. Even the beyond-zero thinking Google pushed this year — trust nothing by default — still assumes the components underneath are sound. This case proves they are not always. It is the same instinct that makes developers trust dependencies without question — the reason I keep coming back to supply chain hygiene.
The chess move here was patience. The bug was introduced in March 2021. For years, the weakness sat there — a bounded key space, quietly waiting for someone with enough compute to walk it. The attacker did not invent a new technique. They just checked whether the fortress had a door, found it unlocked, and systematically walked every room.
The Bigger Picture: Breaking Keys Is Getting Cheaper
What worries me most is the trajectory. The cost of reproducing keys from weak randomness keeps falling, and the tools to do it keep improving. We already saw the patch-to-exploit window collapse to hours — the economics of finding and exploiting flaws are shifting under our feet. Now add AI to the mix: Anthropic published research this week showing one of its models halved the security of a candidate post-quantum algorithm in 60 hours, against a design that had survived two years of expert review. Google’s AI, meanwhile, helped fix 1,072 Chrome security bugs in two releases. The same capability curve that defends is the one that attacks.
For people in crypto, this is the moment to revisit the not your keys, not your coins mantra. It was always half the story. Your keys are only as safe as the randomness that created them, the firmware that guards them, and the supply chain that delivered them. Holding your own keys is necessary but no longer sufficient. The AI agent security crowd got its own wake-up call this week — the hardware wallet world just got a much louder one.
For the rest of us — and honestly, for the Philippines as crypto adoption keeps growing — the takeaway is the same. The hardware wallet industry needs verifiable entropy: documented RNG paths, reproducible builds, independent audits, and firmware that fails loudly instead of silently falling back to a software PRNG. A security product should never degrade silently. A library should check whether a feature is enabled, not merely whether the macro exists.
In the meantime, if you own a Coldcard, assume your seed could be compromised if it was created during the affected window, and migrate — new seed, patched firmware, move the coins. It is a hassle. It beats being the person whose wallet was drained in forty-one minutes.
Cold storage promised that a key was unreachable. What we learned is that it only promised it was unguessable — and that promise was quietly broken for five years. The question now is which other trusted boxes are carrying the same quiet flaw.