Coldcard Forces New Seed Rules After $130M Bitcoin Exploit
Coldcard maker Coinkite has tightened how its hardware wallets generate Bitcoin seeds after attackers exploited a years-old firmware flaw in a theft campaign estimated at roughly $130 million.
Summary:
- Coldcard now requires users to contribute randomness when creating new seeds.
- The seed-generation flaw could reduce effective security to roughly 40 bits on affected devices.
- Galaxy Research has confirmed at least 1,778.84 BTC stolen from more than 8,600 addresses.
- Updating firmware does not make an already vulnerable seed safe.
New firmware requires users to supply their own randomness through key presses, dice rolls or coin flips, while owners whose seeds were created on affected firmware must generate an entirely new wallet and move their Bitcoin. The distinction is critical: installing the patch fixes future seed generation, but it cannot strengthen a private key that was generated with insufficient randomness in the past.
The Coldcard Exploit Attacked the Seed, Not the Device
The unusual feature of the Coldcard incident is what attackers apparently did not need.
They did not have to steal a hardware wallet, obtain its PIN or trick its owner into approving a malicious transaction. The vulnerability affected the randomness used to create wallet seeds, making some private keys substantially easier to reconstruct computationally.
Coldcard devices are designed to generate seeds with enough entropy that searching the possible key space is computationally impractical. On affected devices, however, seed generation could fall back to a software pseudo-random number generator rather than obtaining randomness from the hardware source intended for that purpose.
Coldacrd reported that the effective security of some affected wallets fell from 128 bits to roughly 40 bits.
That difference is enormous.
A 128-bit search space contains roughly 3.4 × 10^38 possibilities. A 40-bit space contains about 1.1 trillion. The latter remains large, but it enters a fundamentally different computational range when attackers can automate searches and identify funded Bitcoin addresses against which candidate seeds can be tested.
Once an attacker reconstructs the correct seed, the hardware wallet itself no longer provides protection. The attacker can independently derive the same private keys and sign transactions elsewhere.
More Than 1,778 BTC Has Been Confirmed Stolen
The scale of the losses became clearer as researchers connected separate thefts to the same weakness.
Galaxy Research said on August 14 that it had confirmed with high confidence the theft of 1,778.84 BTC, then worth approximately $112.7 million, from more than 8,600 addresses. Researchers had communicated directly with 190 victims and identified three major attack waves alongside at least 33 additional attacker footprints.
Decrypt subsequently placed the broader estimate at roughly $130 million, incorporating additional suspected losses associated with the exploit.
The distinction between confirmed and estimated losses matters. Galaxy’s $112.7 million figure represented thefts it had attributed with high confidence as of August 14, while the larger $130 million estimate includes a broader set of suspected activity.
Galaxy also found that most confirmed stolen Bitcoin had not moved far. Of at least 1,778 BTC tracked at the time, approximately 1,531 BTC remained in attacker-controlled addresses, while about 246 BTC had subsequently moved. Around 65% of the moved coins entered CoinJoin transactions, according to the firm’s analysis.
Galaxy said it provided attacker addresses to exchanges, investigative companies and law enforcement in an effort to identify or freeze funds if they reached centralized services.
Coldcard Now Makes Users Add Their Own Randomness
Coinkite’s response changes seed creation at a basic level. Current Coldcard firmware no longer relies exclusively on randomness generated internally when users create a new seed. Instead, users must contribute their own entropy through one of three methods:
- 65 key presses with unpredictable timing, adding randomness from the timing and sequence of physical input.
- 50 rolls of a six-sided die, providing enough user-generated entropy to cross Coldcard’s 128-bit security threshold.
- 128 coin flips, where each heads-or-tails result contributes one bit of entropy.
The user-generated input is combined with fresh randomness produced by the Coldcard and its secure elements rather than replacing the device’s own entropy source.
🚨 New COLDCARD firmware is available: 5.6.1 for Mk4/Mk5 and 1.5.1Q for Q.
This release follows three weeks of sustained review since our July 31 hotfix. We continue to acknowledge the customers who suffered severe financial losses from the seed-generation attack.
Every newly… pic.twitter.com/zmrEwh58eI
— COLDCARD (@COLDCARDwallet) August 20, 2026
The thresholds are deliberate. Coldcard calculates that a six-sided die can contribute about 2.585 bits of entropy per roll, meaning 50 rolls provide more than 128 bits of potential entropy.
The revised process changes the failure model that made the original vulnerability so serious. If one internal randomness source fails or produces predictable output, independently supplied entropy provides another input from which the final wallet seed is derived.
That safeguard matters because seed security is established when the wallet is created. Once a weak seed already exists, adding randomness later cannot strengthen it, which is why affected users need an entirely new seed rather than simply a firmware update.
Why Updating Firmware Cannot Repair an Old Wallet
This is the most consequential part of Coinkite’s warning.
A firmware update changes what the device does in the future. It does not retroactively alter a seed phrase that already exists.
If an affected Coldcard generated a weak seed, every Bitcoin address and private key derived from that seed inherits the problem. Updating the same device while continuing to use those words therefore leaves the underlying wallet exposed.
Coinkite’s current guidance says users with affected seeds must install fixed firmware, generate a completely new seed, verify the new wallet and transfer funds to addresses derived from it.
Simply importing the old seed into a patched Coldcard would not solve the problem either. The imported seed retains exactly the same entropy it had when originally created.
READ MORE: BitMart’s Restart Plan Faces a Problem a License Cannot Fix
Coinkite says the vulnerability affected releases beginning with firmware 4.0.1, with specific fixed-version thresholds depending on the Coldcard model and firmware track. Its current security status lists 4.2.0 for Mk2/Mk3, 5.6.0 for standard Mk4/Mk5 devices and 1.5.0Q for the Q as minimum fixed releases.
The company has since issued newer standard firmware, including 5.6.1 and 1.5.1Q, following a broader security review.
The Firmware Review Found Problems Beyond Randomness
A roughly three-week security review identified additional issues involving transaction signing, USB handling, backups and other wallet functions. The company subsequently strengthened several parts of the firmware.
One change addresses the period between reviewing and signing a partially signed Bitcoin transaction, or PSBT.
According to reporting on the update, Coldcard now checks the PSBT again immediately before signing. The change is designed to prevent a compromised USB-connected computer from modifying transaction information after the user has reviewed it but before the hardware wallet produces a signature.
Coinkite also replaced the Yasmarang backup pseudo-random number generator with SHA-256 Hash_DRBG and introduced checks intended to detect failures involving hardware randomness.
Those changes are broader than the fix required to stop the original seed-generation weakness. They indicate that Coinkite treated the incident as a reason to reassess multiple trust boundaries inside the wallet’s firmware rather than patch only the code path already known to have failed.
Why Air-Gapped Storage Was Not Enough
Coldcard has built much of its security model around reducing a wallet’s exposure to network-connected devices. Transactions can be moved through MicroSD cards, allowing private keys to remain offline.
The exploit demonstrates a limitation of that model.
Air-gapping protects the communication path. It cannot compensate for insufficient entropy at the moment the private key is created.
If an attacker can reproduce the seed computationally, there is no need to communicate with the victim’s Coldcard at all. The attacker can derive the wallet independently, observe its addresses on Bitcoin’s public blockchain and sign a transaction using the reconstructed private keys.
That makes seed generation one of the few moments when a hardware wallet’s internal implementation can determine the security of every transaction the owner makes years later.
The affected firmware dates back to 2021, creating a long exposure window before the weakness became publicly apparent. Coinkite’s firmware archive now explicitly labels affected historical releases as vulnerable and warns that existing seeds still require migration.
The Remaining Risk Is in Wallets That Have Not Moved
Galaxy Research reported no confirmed new attacker wave after August 6 as of its August 14 update, but it cautioned against interpreting the slowdown as proof that remaining vulnerable wallets were safe. One possible explanation was that many users had already migrated. Another was that attackers had already drained much of the easily identifiable exposure.
The unresolved population is therefore more important than the latest firmware adoption number.
Every affected seed that still controls Bitcoin represents a key that cannot be strengthened through an update. The security boundary changes only when the coins move to addresses derived from a newly generated seed.
Coinkite is also preparing a formal technical postmortem, while its current security page describes the available independent checks as validation of specific remediation mechanisms rather than a complete audit of every firmware binary.
That postmortem will be the next significant technical document to watch because it can establish more precisely how the flawed seed-generation path persisted across releases, what testing failed to detect it and which controls have been added to prevent the same class of failure from returning.
The information presented in this article is intended for informational purposes only and should not be interpreted as financial, investment, or trading advice. Coinspress.com does not promote or advocate for any particular investment strategy, asset, or cryptocurrency project. Cryptocurrency markets are highly volatile and unpredictable – always perform your own research and seek guidance from a qualified financial professional before making any investment decisions.
Alexander Stefanov
Reporter at CoinsPress
Alex is Editor-in-Chief of Coinspress and co-founder of Millennial Media Group, with nearly a decade of experience covering financial markets - crypto first, then everything else. It started in 2016 with Bitcoin. Like most people at the time, he didn't fully understand it - so he kept digging. Blockchain, tokenomics, the projects, the cycles. That curiosity never stopped, and eventually pulled him into traditional markets too: equities, commodities, macro. Not because he left crypto behind, but because you can't properly understand one without the other. What drives him is straightforward: he wants to know why something is happening, not just that it's happening. Most market coverage stops at the headline - price up, price down, here's a chart. Alex finds that kind of reporting actively unhelpful. If you walk away from an article without understanding the mechanism behind the move, what did you actually learn? He holds a degree in Tourism from New Bulgarian University - not the most obvious path into financial markets, but markets have a way of pulling in people who are simply too curious to stay out. He has authored over 200 in-depth analyses and more than 10,000 articles across crypto and traditional finance. He still thinks every day in markets teaches him something new. That's probably why he hasn't stopped.
