{"id":206973,"date":"2026-07-31T15:22:11","date_gmt":"2026-07-31T15:22:11","guid":{"rendered":"https:\/\/mycryptomania.com\/?p=206973"},"modified":"2026-07-31T15:22:11","modified_gmt":"2026-07-31T15:22:11","slug":"coldcard-wallet-flaw-exposes-years-of-bitcoin-seeds-after-70m-in-btc-stolen","status":"publish","type":"post","link":"https:\/\/mycryptomania.com\/?p=206973","title":{"rendered":"Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen"},"content":{"rendered":"

Bitcoin Magazine<\/a><\/p>\n

Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen<\/a><\/p>\n

<\/div>\n

The popular Bitcoin hardware wallet Coldcard product, made by Coinkite, is at risk following a $70 million hack.<\/p>\n

Coinkite on Thursday admitted that its Coldcard Mk3 model was affected following the hack and advised users to move their funds. Then, on Friday, the company said<\/a> that users of the later hardware devices Mk4, Mk5, and Q should also take precautions.\u00a0<\/p>\n

Hackers on Thursday were first able to drain funds from 1,196 Bitcoin addresses because their private keys were not generated using sufficient entropy \u2014 or randomness.\u00a0<\/p>\n

Since then, a total of 1,082.65 Bitcoins have disappeared from wallets, according<\/a> to data from Galaxy Research and engineers at payments company Block.\u00a0<\/p>\n

While Coinkite has not admitted that the hack is linked to their wallets, the company has said that a wallet seed generation bug in Coldcard products meant the hardware\u2019s true random number generator wasn\u2019t actually being used on certain firmware versions.\u00a0<\/p>\n

Coinkite and other engineers in the Bitcoin space are still investigating reportedly ongoing drains still happening at the time of writing.<\/p>\n

What actually happened\u00a0<\/h2>\n

A firmware bug in Coldcard Mk3 devices (starting with version 4.0.1 in March 2021) caused seed generation to fall back to a weak software PRNG instead of the hardware true random number generator, producing seeds with only ~40 bits of entropy rather than the intended 128.\u00a0 This made private keys for many single-signature wallets (especially those created without dice rolls or a strong BIP-39 passphrase) predictable enough for attackers to brute-force.<\/p>\n

A total of 594.5 Bitcoins worth over $35.7 million at today\u2019s prices were moved to a new address<\/a> from single-signature addresses on Thursday.\u00a0<\/p>\n

\n

NEW: Over 594 BTC worth $38 million was stolen from Bitcoin hardware wallet Coldcard users.<\/p>\n

The attacker then moved around the BTC and consolidated 562 BTC into this address below. <\/p>\n

Users are urged to review the company’s official security guidance as soon as possible. pic.twitter.com\/exD2Wax7CY<\/a><\/p>\n

\u2014 Bitcoin Magazine (@BitcoinMagazine) July 31, 2026<\/a>\n<\/p><\/div>\n

More wallets were later drained, according to blockchain analysts, with the total now over $70 million.\u00a0<\/p>\n

Various affected users shared their experiences on social media, with one saying<\/a> that their Bitcoin had not been moved since 2021, and all of a sudden was swiped.\u00a0<\/p>\n

Bitcoin engineers have since said<\/a> that Coldcard products \u2014 specifically the Mk3 models \u2014 had\u00a0 \u201cfaulty entropy in wallet generation,\u201d meaning they did not use real randomness to create a seedphrase.\u00a0<\/p>\n

What to do\u00a0<\/h2>\n

Developers in the Bitcoin space have since urged users to move their funds if they used a Coldcard. Coldcard has issued guidance for users to take, which can be found here<\/a>.<\/p>\n

\n

The first post was the advisory and what users should do.<\/p>\n

This second post has the technical details: what actually went wrong, why our reviews missed it, the impact across Mk3\/Mk4\/Q\/Mk5, and what we changed.https:\/\/t.co\/HshUxevCl3<\/a><\/p>\n

( current evaluating Mk3 firmware release ) https:\/\/t.co\/Yfdx4XcztA<\/a><\/p>\n

\u2014 COLDCARD (@COLDCARDwallet) July 31, 2026<\/a>\n<\/p><\/div>\n

Coinkite first said that their Mk3 models were affected but then on Friday said that those who did not use sufficient entropy to create a seed \u2014 in this case, 50 dice rolls \u2014 should generate a brand-new seed on the updated device. Others have warned to ditch Coldcard completely to be sure their funds are safe.\u00a0<\/p>\n

\u201cEverything is fucked,\u201d wrote Kevin Loaec, CEO of Bitcoin security company, Wizardsardine.\u00a0<\/p>\n

\u201cEvery single mnemonic generated [via a Coldcard] since 2021 will be public in the next few days,\u201d Loaec warns.<\/p>\n

This post Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen<\/a> first appeared on Bitcoin Magazine<\/a> and is written by Mathew Di Salvo<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

Bitcoin Magazine Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen The popular Bitcoin hardware wallet Coldcard product, made by Coinkite, is at risk following a $70 million hack. Coinkite on Thursday admitted that its Coldcard Mk3 model was affected following the hack and advised users to move their funds. Then, […]<\/p>\n","protected":false},"author":0,"featured_media":206974,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-206973","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-discovery"],"_links":{"self":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/206973"}],"collection":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=206973"}],"version-history":[{"count":0,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/posts\/206973\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=\/wp\/v2\/media\/206974"}],"wp:attachment":[{"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=206973"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=206973"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mycryptomania.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=206973"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}