Loading story…
Coinkite issued a security update for COLDCARD hardware wallets after a seed-generation flaw made some recovery phrases predictable and enabled attackers to reconstruct wallet keys and steal funds. Reporting on the incident said the weakness affected the devices' random-number generation process, including a fallback tied to deterministic data such as serial numbers, and may have exposed more than 4,500 wallets. The thefts reportedly totaled about 1,367 BTC, valued at roughly $86 million, and law enforcement is investigating.
Coinkite urged COLDCARD Mk4, Mk5, and Q users to upgrade to firmware 5.6.1 for Mk4/Mk5 and 1.5.1Q for Q, but warned that upgrading alone does not secure wallets created with vulnerable firmware. Users with potentially affected seeds were told to generate a new seed on fixed firmware and move funds immediately. The company said a July 31 hotfix corrected seed generation for newly created wallets, while the latest release adds broader hardening across seed generation, transaction signing, USB handling, firmware-update validation, Delta Mode, backups, and TRNG self-tests.
Track how attackers are adapting to this technology.
7 events from the most recent confirmed update back to the earliest known activity.
Coinkite disclosed that hackers exploited a seed-generation failure in COLDCARD firmware, causing severe financial losses for some customers. It warned that seeds generated on affected firmware from 2021 through July 2026 may be unsafe and advised users to generate a new seed on fixed firmware and move funds.
Coinkite published a broader security update for COLDCARD Mk4, Mk5, and Q devices, recommending users upgrade to firmware 5.6.1 or 1.5.1Q. The company said the release added defense-in-depth changes across seed generation, transaction signing, USB handling, firmware validation, Delta Mode, backups, and TRNG self-tests.
By August 3, reported losses had climbed to about 1,367 BTC, valued at roughly US$86 million, affecting more than 4,500 wallets. The article says the reported loss amount more than doubled from the initial July 31 figure.
Initial reporting on the exploitation of the Coldcard flaw said losses were approximately US$38 million. This figure was later reported to have more than doubled within days.
Coinkite said a July 31 firmware hotfix corrected the seed-generation failure for newly generated seeds. The company later emphasized that this did not make already vulnerable seeds safe.
Jonathan Goodman later discovered that all three of his Coldcard wallets had been emptied within minutes of one another. The article anchors these thefts to July 29.
Coinkite said law enforcement authorities are investigating the thefts and working to identify those responsible. No specific start date for the investigation is provided in the references.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
2 references tracked. Mallory keeps watching after this page renders.
cysecurity.news
Open sourceblog.coinkite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A flaw in **COLDCARD** hardware wallet firmware made some recovery seeds predictable, and attackers used the weakness to steal about **594.48 BTC**—roughly **$38 million**—from around **500 wallets** in a coordinated sweep lasting about **25 minutes**. Reporting tied the theft to wallets created on affected devices, with the losses spread across roughly 500 transactions in three blocks and most of the stolen funds—about **562 BTC**—later consolidated into a single address. The targeted wallets were reportedly **single-signature** wallets holding more than **0.15 BTC** each, and many had been dormant for years. The weakness was traced to firmware logic that failed to properly use the device hardware random number generator and instead relied on a predictable fallback with a **32-bit reseed** mechanism, reducing entropy in generated seeds. Coinkite said the issue affects **Mk3** devices running firmware **4.0.1 and later**, and also affects **Mk4, Mk5, and Q** devices that generated seeds before fixed firmware was released; the company urged users to update firmware, create entirely new seeds, and move funds because updating alone does not repair already weak seeds. Coinkite added that wallets protected with sufficient independent dice-roll entropy or a strong **BIP-39 passphrase** are better protected, while **TAPSIGNER**, **SATSCARD**, and **OPENDIME** are not affected.
Aug 11, 2026
Coinkite disclosed an ongoing security incident in which vulnerable **COLDCARD** firmware generated wallet seeds with weak entropy, allowing attackers to reproduce seeds offline and steal funds. The company said a build and link integration error during its `libNgU` migration caused seed generation to use MicroPython’s non-cryptographic **Yasmarang** PRNG instead of the intended hardware true random number generator, despite `MICROPY_HW_ENABLE_RNG=0` being meant to disable the software path. Coinkite halted shipments, destroyed remaining affected inventory, released patched firmware for newly generated seeds, and warned that seeds already created on vulnerable devices remain at risk; **SATSCARD, OPENDIME, and TAPSIGNER** were not affected. External reporting said the exploitation began rapidly, with Galaxy Research estimating attackers drained **1,367 BTC**—about **$88.6 million**—from **4,385 addresses** across multiple attack waves after an initial 41-minute sweep of 1,082.65 BTC from 1,196 addresses. Coinkite urged users who created seeds on affected firmware without at least **50 independent private dice rolls** and a strong unique **BIP-39 passphrase** to move funds to a new wallet immediately, while preserving affected devices for possible recovery and law-enforcement action. The company also temporarily suspended its normal 120-day customer data blanking process to preserve records for ongoing and anticipated legal proceedings, while allowing customers to request exemption from that retention protocol.
Aug 12, 2026
An attacker linked to thefts from vulnerable **COLDCARD** hardware wallets has begun swapping stolen Bitcoin for Ether through **THORChain**, moving about 10% of the tracked funds to a new Ethereum address while most remains in the original Bitcoin wallets. Galaxy Research attributed the thefts to weak seed-phrase generation in firmware released from 2021 through July 2026, which made affected private keys computationally predictable; continued draining of a deliberately weakened test wallet indicated automated scanning remained active. Coinkite issued critical firmware updates `5.6.2` for COLDCARD Mk4/Mk5 and `1.5.2Q` for COLDCARD Q, restoring visibility into full device entropy, adding offline seed-mixing verification, and hardening multiple device functions. Updating alone does not secure wallets whose seeds were generated by affected firmware: users must generate a new seed on patched firmware and migrate all assets to new addresses.
Sep 4, 2026