An attacker swept roughly 594.48 BTC, worth about $38 million, out of around 500 separate Bitcoin wallets in a 25-minute window early Friday, and the cause was not phishing or a stolen device. It was a Coldcard firmware flaw that quietly disabled the hardware wallet’s own randomness chip five years ago. The theft moved 1,324 unspent transaction outputs across 500 transactions between 01:31 and 01:56 UTC, all inside a three-block window, CoinDesk reported. Every drained wallet was single-signature and each held more than 0.15 BTC. Many had been dormant for years.
A seed phrase is the list of words a hardware wallet generates once at setup, and whoever knows it controls every coin in that wallet forever. Its only defense is that it is drawn at random from a pool too large to search.
Key takeaways
- 594.48 BTC, about $38 million, left roughly 500 single-signature wallets between 01:31 and 01:56 UTC on July 31, 2026.
- The bug entered Coldcard’s codebase in a commit dated March 1, 2021 and shipped in firmware 4.0.0 later that month, causing devices to fall back to software randomness seeded by a chip serial number and clock registers.
- Coinkite scopes confirmed exposure to Mk2 and Mk3 devices whose seeds were created on firmware 4.0.0 through 5.0.3, and says early analysis clears Mk4, Mk5 and Q.
- Wallets protected by a BIP-39 passphrase appear to face minimal risk. Bitcoin held above $64,000 through the sweep.
Published: July 31, 2026, 16:00 UTC
How a build setting broke five years of key generation
Coldcard’s firmware was not pulling seeds from its hardware random number generator at all. According to a report published by Block’s Bitcoin engineering and security teams, a build setting instructed the device to skip that chip, and a check in a supporting library tested only whether the setting existed rather than whether it was switched on. Key generation fell through to a basic software substitute.
That substitute was seeded from the chip’s serial number and clock registers. Neither is secret. The serial number is fixed factory metadata, and clock values are timing state an attacker can measure or narrow down on a device they own. The result was mnemonics carrying far less entropy than the 128 bits a 12-word BIP-39 seed is supposed to contain, which is the difference between a search space no computer will ever cover and one a laptop can grind through.
Block traced the change to a single commit dated March 1, 2021, which swapped the seed-generation call from ckcc.rng_bytes to ngu.random.bytes. Firmware 4.0.0 shipped on March 17, 2021. The drained coins span 2021 to 2026, matching the flaw’s lifespan almost exactly.
Which devices are exposed and what owners should do now
Exposure depends on the firmware a device was running the moment the wallet was first created, not on when the hardware was purchased. Coinkite, the Canadian firm behind Coldcard, published an advisory Friday warning users who generated a seed on an Mk3 running version 4.0.1 or later, and said “Mk4, Q and Mk5 are not affected based on our early analysis.” Independent reporting scopes the confirmed exploit to Mk2 and Mk3 seeds created on firmware 4.0.0 through 5.0.3.
Coinkite advises affected owners to treat those funds as at immediate risk and move them to a fresh seed generated on unaffected hardware. Users who added a BIP-39 passphrase, an extra user-chosen word layered on top of the seed phrase, are believed to face only minimal exposure, since the attacker would still need that word.
The blast radius extends past wallet seeds. The same generator produced Coldcard’s paper wallet private keys, where the output becomes the key directly with no further derivation, along with seed-splitting masks, device cloning keys and Key Teleport transfers. Anyone who used those features on an affected device should assume the same exposure.
What the attack says about self-custody assumptions
Block said it disclosed its findings to Coinkite, whose team acknowledged them, and that it published without completing exploitability testing because the sweep was already under way. Both companies describe their analyses as preliminary, which means the affected firmware range and device list could still widen.
The incident inverts the usual self-custody threat model. Hardware wallets exist to remove trust from internet-connected machines, and the buyer’s remaining assumption is that the device generates keys correctly. Here it did not, silently, for five years, across a product line marketed to the most security-conscious Bitcoin holders. That is a different failure from the contract-level exploits and bridge attacks that dominate 2026 loss tallies, because no user action could have detected it.
562 BTC of the stolen funds sits consolidated in a single address that has not moved. Bitcoin traded above $64,000 during early Asian hours with no visible price reaction, which tracks with a theft concentrated on long-dormant coins rather than exchange reserves. The open questions are whether the attacker holds more precomputed keys, and whether other wallet vendors relying on similar library checks have the same silent fallback in production.
Frequently asked questions
Is my Coldcard affected by the firmware flaw?
Only if the wallet seed was first generated on a Coldcard Mk2 or Mk3 running firmware 4.0.0 through 5.0.3, roughly March 2021 onward. What matters is the firmware version at the moment of seed creation, not the version installed today. Coinkite says Mk4, Mk5 and Q are unaffected based on early analysis.
Does a BIP-39 passphrase protect my funds?
Coinkite indicates passphrase-protected wallets face minimal risk. The passphrase is a user-chosen secret combined with the seed to derive keys, so even a fully predicted seed does not open the wallet without it. Analysis is still preliminary, so moving funds to fresh hardware remains the safer path.
Can the stolen 594 BTC be recovered?
Recovery is unlikely. Bitcoin transactions are final once confirmed, and 562 BTC has already been consolidated into a single address. Tracing is possible because the movements are public on-chain, but recovery would require the attacker to route funds through an exchange willing and able to freeze them.
