Loading story…
An attacker linked to thefts from vulnerable COLDCARD hardware wallets has begun swapping stolen Bitcoin for Ether through THORChain, moving about 10% of the tracked funds to a new Ethereum address while most remains in the original Bitcoin wallets. Galaxy Research attributed the thefts to weak seed-phrase generation in firmware released from 2021 through July 2026, which made affected private keys computationally predictable; continued draining of a deliberately weakened test wallet indicated automated scanning remained active.
Coinkite issued critical firmware updates 5.6.2 for COLDCARD Mk4/Mk5 and 1.5.2Q for COLDCARD Q, restoring visibility into full device entropy, adding offline seed-mixing verification, and hardening multiple device functions. Updating alone does not secure wallets whose seeds were generated by affected firmware: users must generate a new seed on patched firmware and migrate all assets to new addresses.
See which actors are running it and whether you're in range.
8 events from the most recent confirmed update back to the earliest known activity.
An attacker associated with the third COLDCARD theft wave began converting stolen Bitcoin to Ether through THORChain. About 10% of the Bitcoin under its control was swapped, with the operations traced to a new Ethereum address shared with law enforcement and asset-tracking organizations.
COLDCARD released experimental EDGE 6.6.1X for Mk4 and 6.6.1QX for Q devices, incorporating synchronized fixes for seed entropy, USB, Virtual Disk, PSBT, BIP-322, and signing issues. The vendor said these previews were not qualified to the standard of normal releases.
An address linked to the operation withdrew Bitcoin from a deliberately weakened test wallet created by researchers, indicating that automated scanning for predictable private keys was still active.
An earlier estimate found that approximately 87% of identified Bitcoin stolen across several COLDCARD attack waves and attackers remained unmoved as of August 25.
COLDCARD's August 20 release added required user-sourced entropy during seed generation and additional security hardening.
COLDCARD stated that firmware released on July 31 corrected the seed-generation failure for newly created seeds. Previously generated seeds remained at risk and would require replacement.
Galaxy Research attributed the thefts to insufficient randomness in seed-phrase generation in COLDCARD firmware released from 2021 onward, which allegedly made private keys remotely derivable without physical access to the devices.
COLDCARD released critical firmware 5.6.2 for Mk4/Mk5 and 1.5.2Q for Q devices, restoring visibility into device entropy, adding offline seed-mix verification, and introducing multiple USB, transaction-validation, Virtual Disk, and wallet-state hardening changes. The vendor warned that upgrading alone does not secure seeds generated by affected firmware between 2021 and July 2026; users must generate new seeds and migrate funds.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
blog.coinkite.com
Open sourcexakep.ru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Coinkite issued a security update for **COLDCARD** hardware wallets after a seed-generation flaw made some recovery phrases predictable and enabled attackers to reconstruct wallet keys and steal funds. Reporting on the incident said the weakness affected the devices' random-number generation process, including a fallback tied to deterministic data such as serial numbers, and may have exposed more than **4,500 wallets**. The thefts reportedly totaled about **1,367 BTC**, valued at roughly **$86 million**, and law enforcement is investigating. Coinkite urged **COLDCARD Mk4, Mk5, and Q** users to upgrade to firmware **`5.6.1`** for Mk4/Mk5 and **`1.5.1Q`** for Q, but warned that upgrading alone does **not** secure wallets created with vulnerable firmware. Users with potentially affected seeds were told to generate a **new seed** on fixed firmware and move funds immediately. The company said a July 31 hotfix corrected seed generation for newly created wallets, while the latest release adds broader hardening across seed generation, transaction signing, USB handling, firmware-update validation, Delta Mode, backups, and TRNG self-tests.
Aug 21, 2026
A flaw in **COLDCARD** hardware wallet firmware made some recovery seeds predictable, and attackers used the weakness to steal about **594.48 BTC**—roughly **$38 million**—from around **500 wallets** in a coordinated sweep lasting about **25 minutes**. Reporting tied the theft to wallets created on affected devices, with the losses spread across roughly 500 transactions in three blocks and most of the stolen funds—about **562 BTC**—later consolidated into a single address. The targeted wallets were reportedly **single-signature** wallets holding more than **0.15 BTC** each, and many had been dormant for years. The weakness was traced to firmware logic that failed to properly use the device hardware random number generator and instead relied on a predictable fallback with a **32-bit reseed** mechanism, reducing entropy in generated seeds. Coinkite said the issue affects **Mk3** devices running firmware **4.0.1 and later**, and also affects **Mk4, Mk5, and Q** devices that generated seeds before fixed firmware was released; the company urged users to update firmware, create entirely new seeds, and move funds because updating alone does not repair already weak seeds. Coinkite added that wallets protected with sufficient independent dice-roll entropy or a strong **BIP-39 passphrase** are better protected, while **TAPSIGNER**, **SATSCARD**, and **OPENDIME** are not affected.
Aug 11, 2026
Coinkite disclosed an ongoing security incident in which vulnerable **COLDCARD** firmware generated wallet seeds with weak entropy, allowing attackers to reproduce seeds offline and steal funds. The company said a build and link integration error during its `libNgU` migration caused seed generation to use MicroPython’s non-cryptographic **Yasmarang** PRNG instead of the intended hardware true random number generator, despite `MICROPY_HW_ENABLE_RNG=0` being meant to disable the software path. Coinkite halted shipments, destroyed remaining affected inventory, released patched firmware for newly generated seeds, and warned that seeds already created on vulnerable devices remain at risk; **SATSCARD, OPENDIME, and TAPSIGNER** were not affected. External reporting said the exploitation began rapidly, with Galaxy Research estimating attackers drained **1,367 BTC**—about **$88.6 million**—from **4,385 addresses** across multiple attack waves after an initial 41-minute sweep of 1,082.65 BTC from 1,196 addresses. Coinkite urged users who created seeds on affected firmware without at least **50 independent private dice rolls** and a strong unique **BIP-39 passphrase** to move funds to a new wallet immediately, while preserving affected devices for possible recovery and law-enforcement action. The company also temporarily suspended its normal 120-day customer data blanking process to preserve records for ongoing and anticipated legal proceedings, while allowing customers to request exemption from that retention protocol.
Aug 12, 2026