Coldcard Firmware Flaw Leads to $88.6 Million in Bitcoin Losses

The incident centers on a firmware integration error that compromised the random-number generator in several Coldcard models. For years, a MicroPython fallback generated predictable outputs, reducing the effective entropy of seed phrases. While newer models like the Mk4, Q, and Mk5 included additional secure-element entropy, they still fell short of the intended security standards, leaving users vulnerable.

Galaxy Research identified three separate attack waves occurring between July 30 and August 1. The first wave was the most aggressive, siphoning 1,082.65 BTC in a 41-minute window. While the first two waves exhibited similar transaction patterns—suggesting a single operator—the third wave utilized different methods, complicating the attribution process. Researchers caution that the current $88.6 million figure remains an estimate based on observed on-chain activity, and the total could rise as further patterns emerge.

Coinkite has issued firmware hotfixes to correct future seed generation, but these updates do not retroactively secure existing, compromised seeds. The company is urging users to generate entirely new seeds and migrate their assets, noting that firmware patches cannot introduce missing entropy to already created recovery phrases. Users are advised to verify new backups and perform test transactions before completing the migration. Coinkite maintains that seeds generated using physical dice rolls or protected by strong, unique BIP-39 passphrases remain more resilient, though migration is still the recommended course of action.