Editor | Wu Says Blockchain

TL;DR

· Five-year random number vulnerability: Coldcard mistakenly connected the wallet seed generation path to a software pseudorandom number generator instead of the anticipated hardware random number generator during its 2021 code migration, resulting in the actual search space for the recovery phrases generated by some firmware being significantly lower than the design goal.

· Four suspected rounds of attacks still expanding: Galaxy Research previously identified three rounds of suspected attacks involving 4,585 addresses and 1,367.05 BTC. The fourth round emerged on August 3, with the latest observations showing approximately 448.7 BTC and 709 potential victim addresses. Assuming no overlaps between rounds, the total for the four rounds is approximately 1,815.75 BTC and 5,294 addresses; however, these numbers come from on-chain feature analysis and cannot be regarded as confirmed victim addresses or final losses on a one-by-one basis.

· Upgrading firmware does not fix old seeds: The risk depends on the device and firmware version used when creating the recovery phrases. Importing affected recovery phrases into other wallets or merely upgrading Coldcard firmware cannot restore the lost randomness. Users need to generate new seeds in a fixed firmware or another trusted environment before migrating funds.

· Community testing shows AI may locate vulnerabilities, but cannot complete attack attribution: After the vulnerability was disclosed, some community users claimed that Claude Code and GLM-5.2 pointed out the random number path issue in about 8 minutes and 20 minutes, respectively. However, these tests were not independently replicated, nor were the code version, model configuration, and operating environment fully disclosed. Coinkite acknowledged it previously used AI to review the code but did not find vulnerabilities. Currently, there is no evidence to prove that attackers discovered or exploited this issue using AI.

· Incident sparks custody method controversy: Following the vulnerability disclosure, the number of active Bitcoin addresses, long-unused BTC transfers, and inflows to centralized platforms increased synchronously. Some analysts speculate this may include users migrating funds, but on-chain data cannot establish a causal relationship. This incident reveals the key generation risks of specific hardware wallets, and does not imply the failure of Bitcoin's underlying cryptography or all self-custody solutions.

From July 30, 2026, UTC time between 01:10 and 01:51, a batch of Bitcoin addresses was completely cleared in about 41 minutes, involving 1,082.65 BTC, estimated to be worth approximately $70.2 million at that time. Galaxy Research initially counted the number of addresses involved as 1,196, later adjusting it to 1,195 when aggregating three rounds of activities. This article adopts the newer count of 1,195 addresses while noting this statistical difference.

According to feature analysis provided by Block engineers and security researchers, Galaxy stated that this core transaction set mostly used a fixed fee of 30 sat/vB and did not generate change outputs, indicating that the relevant operations might have been completed in bulk by automated tools. Subsequently, Galaxy also identified a small number of transactions with fees of about 4 sat/vB as exceptions, thus the fixed fee rate cannot be described as a common characteristic for all related transactions. The funds were primarily aggregated into four addresses.

This transfer occurred about 30 hours after Coldcard manufacturer Coinkite publicly disclosed the risk of the Mk3 firmware. Since then, multiple rounds of funds transfers with similar programmatic features have emerged. After identifying the first three rounds of activities, Galaxy raised the observed range to 4,585 addresses and 1,367.05 BTC, worth approximately $88.6 million. On August 3, the institute's research director Alex Thorn detected a fourth round of suspected organized attacks.

This incident did not involve the compromise of Bitcoin's underlying cryptography. Investigations by Block and Coinkite both pointed to the random number generation path of Coldcard firmware: some devices did not use the designed hardware random number generator when creating wallet seeds, but instead erroneously called a predictable software pseudorandom number generator.

In theory, attackers could enumerate candidate outputs based on device identifiers, startup times, timer states, and random number calling history without touching specific devices, then regenerate the corresponding recovery phrases and addresses to compare with publicly available addresses on the chain. However, public reports have yet to demonstrate a complete end-to-end experiment reconstructing a victim's recovery phrase from scratch and matching it to the stolen addresses.

July 30: Around 500 addresses were first concentrated in transfers

On July 30, on-chain researchers initially found that about 500 Bitcoin single-signature addresses were concentrated and transferred in approximately 25 minutes, involving approximately 594 BTC, valued at around $38 million, with about 562 BTC subsequently flowing into the same address. Most affected address balances exceeded 0.15 BTC, and some UTXOs had not been active for years.

At that time, a suspected victim stated they used a Coldcard device, leading the market to speculate that the event might be related to this hardware wallet. Coinkite co-founder and CEO Rodolfo Novak (NVK) initially denied that any specific device-level vulnerabilities had emerged, suggesting that relevant users might have imported previously leaked or low-randomness recovery phrases and noted that these transfers involved private keys from different wallets.

Bitcoin security researcher Jameson Lopp at the time noted that some users seemed only to have specific UTXOs transferred rather than their entire wallet balance, suggesting that attackers might have only obtained partial private keys rather than the complete recovery phrase. However, this judgment occurred before the root cause of the vulnerability was disclosed and can only be seen as a hypothesis proposed based on limited samples at that time.

Subsequently, Galaxy expanded the observation range for the same round of activity to 1,195 addresses and 1,082.65 BTC. Thus, the early estimate of approximately 500 addresses and 594 BTC belongs to a broader statistical range for the first round of events and cannot be simply summed with later data.

Coinkite issues warning, subsequently broadening the scope of affected devices

About 30 hours after the first large-scale transfers, Coinkite issued a cold card security announcement. The company initially focused the risk scope on Mk3 devices using specific firmware to create recovery phrases, stating that based on preliminary analysis at that time, Mk4, Q, and Mk5 were not affected.

As the Block security team and other researchers continued their analysis, Coinkite later expanded the affected scope. According to the company’s announcement updated as of August 1:

· Mk2 and Mk3: Seeds generated with firmware versions 4.0.1 to 4.1.9 are affected;

· Mk4 and Mk5: Seeds generated with firmware versions prior to standard version 5.6.0 are affected;

· Q: Seeds generated with firmware versions prior to standard version 1.5.0Q are affected;

· Mk4 and Mk5 Edge: Seeds generated with versions prior to 6.6.0X are affected;

· Q Edge: Seeds generated with versions prior to 6.6.0QX are affected.

Block's technical report listed the vulnerable versions for Mk2 and Mk3 as from 4.0.0 to 4.1.9 and noted that the relevant code path first appeared in version 4.0.0 released on March 17, 2021. This count differs from Coinkite's announcement, which starts from 4.0.1. For users who created seeds with 4.0.0, a more conservative approach before further clarifications by Coinkite is to consider them potentially affected and migrate funds.

TAPSIGNER, OPENDIME, and SATSCARD use different code bases and are not included in the scope of this announcement.

This means that Coinkite's initial judgment that Mk4, Q, and Mk5 were temporarily unaffected has since been corrected by later investigations. Determining whether a wallet is at risk should depend on the device and firmware version used to create the seed, and not on the version currently installed on the device, the time of purchase, or which wallet the recovery phrase is currently stored in.

2021 code migration allowed seed generation to access software pseudorandom numbers

On July 30, the Block Bitcoin Engineering and Security team released a technical analysis indicating that the issue dates back to March 2021. At that time, Coinkite migrated partial elliptic curve operations to libsecp256k1 used by Bitcoin Core and introduced libNgU for embedded MicroPython environments.

During the migration process, the wallet seed generation call was changed from ckcc.rng_bytes() to ngu.random.bytes().

The former path would call the hardware random number implementation written by Coldcard for the STM32 chip; the latter path mistakenly connected to MicroPython’s built-in Yasmarang software pseudorandom number generator due to an error in conditional compilation judgment.

Coldcard's production configuration defines MICROPY_HW_ENABLE_RNG as 0. The developers intended to disable the MicroPython built-in hardware random number implementation in favor of Coldcard's version. However, the libNgU relevant code only checks whether the macro is defined, without further checking if its value is non-zero.

Since this macro, while equal to 0, remains in a "defined" state, the compilation process did not report an error, and the software fallback implementation was subsequently linked into the firmware with the same function signature. Such errors do not manifest as program crashes or seed generation failures; the device can still generate seemingly random recovery phrases, which is why users were not directly aware of the problem for a long time.

The software generator primarily initializes based on partial data from the MCU's unique identifier, SysTick, and RTC timer registers. This information is not cryptographically secret. If attackers are able to obtain or narrow down the range of device identifiers, startup times, timer states, and previous random number call counts, they could reproduce portions of the output stream in an offline environment, regenerating candidate recovery phrases and addresses.

For Mk2 and Mk3, Block indicated that the relevant seed generation path did not acquire subsequent cryptographic-level reseeding. Although Mk4, Mk5, and Q introduce additional entropy from security components, only 4 bytes from the digest actually entered the software generator state, which is 32 bits of data and unable to restore the originally expected randomness.

Coinkite initially estimated that the effective search space for affected Mk2 and Mk3 seeds is about 40 bits; Mk4, Mk5, and Q, due to additional security component data, have an effective entropy estimate of about 72 bits, still below the company's stated design security target of 128 bits.

Block provided conditional upper limits of approximately (2^{40.7}) and (2^{73.3}), but also emphasized that such estimates are highly dependent on the device and time information known to attackers and cannot be simply equated to standard cryptographic security strength or used to accurately calculate the cost of breaking each device.

Block noted that it has not yet completed a full end-to-end empirical test on real devices and victim wallets. Current public materials have not demonstrated the complete process of reconstructing a specific victim's recovery phrase from scratch and matching it to the actual stolen addresses. Therefore, the defect regarding random numbers has been confirmed at the code level, but the correlation between each on-chain address and that defect primarily stems from transaction behaviors, address features, and partial user information, rather than cryptographic reproduction on a case-by-case basis.

Galaxy identifies the first three rounds of activity, with no conclusion on whether they were executed by the same attacker

On August 1, Galaxy Research stated that it had identified three rounds of suspected activities targeting addresses generated by Coldcard based on Bitcoin on-chain data, involving a total of 4,585 addresses and 1,367.05 BTC, worth approximately $88.6 million.

In the address count used by Galaxy, the first round involved 1,195 addresses, the second round involved 1,478 addresses, and the third round involved 1,912 addresses, totaling 4,585 addresses. The initial figures used by Galaxy for the first round's analysis were 1,196 addresses, resulting in a statistical adjustment of one address between the two reports.

Galaxy stated that the first two rounds of activity shared similarities in funding aggregation structure, receiving address types, and address generation paths, reasonably leading to suspicion of a single operator; however, this remains unconfirmed. The third round displayed clear differences in funding aggregation methods, receiving addresses, and bulk transfer structure, indicating the original attacker may have switched tools, or it could be another attacker independently exploiting the same issue.

Galaxy expresses high confidence that internal transactions for each round could be controlled by the same operator but has not determined that all three rounds of activities were executed by the same person.

Galaxy also emphasizes that the relevant statistics are all derived from on-chain analysis and have not verified whether all addresses were indeed generated by the compromised Coldcard firmware. Fixed fees, no change structures, address ages, and funding aggregation methods help identify transactions that may belong to the same batch, but cannot individually prove each transfer was theft, nor confirm whether different batches were completed by the same attacker.

As of the time Galaxy released the summary analysis of the three rounds, the primary funds from the three rounds remained in potential attacker addresses identified. Galaxy also observed some smaller, suspected imitation or opportunistic attack funds beginning to disperse through peeling chains, cross-chain services, and offshore gambling platforms, but these funds should not be conflated with the flow of primary funds from the first three rounds.

Galaxy stated it has provided approximately 600 suspected attacker-held addresses to U.S. federal investigators, compliance agencies, and cybersecurity investigators.

August 3: The fourth round of suspected attacks rises to about 448.7 BTC

On August 3, Galaxy Research director Alex Thorn stated that a fourth round of organized attacks was suspected to be happening at Coldcard.

Thorn initially discovered 218 transactions between blocks 960,778 and 960,792, involving 462 potential victim addresses, 216 new destination addresses, and approximately 388.93 BTC.

He noted that the relevant inputs did not date earlier than the time boundary of when the Coldcard firmware vulnerability emerged. During the observed period, an average of about 13.8 clearing transactions appeared per block, while the pre-event comparison window had about 0.3 transactions per block, resulting in an activity frequency about 45 times the normal level. Most transactions created a new destination address for each potential victim, with some funds subsequently entering second-hop addresses.

As more blocks were confirmed and samples cleaned, Thorn updated the fourth round data to about 448.7 BTC and 709 potential victim addresses. His correction process included excluding 89 multisig addresses and about 20.58 BTC in false positives, thus the newer figures should not be understood as merely a mechanical increase of new transactions in the initial statistics.

This data is still based on on-chain estimates derived from UTXO ages, address types, and transaction behaviors, and has not received individual confirmations from Coinkite, law enforcement, or all wallet holders.

Thorn also mentioned that there were still similar transactions waiting for confirmation in the memory pool, some of which had confirmed transactions enabling opt-in RBF. For users still in control of relevant private keys, and who have suspicious transactions awaiting confirmation but satisfying replacement conditions, attempting to broadcast a higher fee conflict transaction that sends funds to a safe wallet could be viable.

However, RBF only applies to unconfirmed transactions that allow replacement, and does not guarantee that users' new transactions will be packaged first by miners. Users also need to be wary of counterfeit recovery tools, phishing sites, and so-called customer service demanding recovery phrases in emergencies.

If the previously reported 1,367.05 BTC and 4,585 addresses from Galaxy are simply added to the fourth round updated value, the total observation scale for the four rounds is approximately 1,815.75 BTC and 5,294 addresses. However, this calculation assumes there are no overlaps between the addresses of each round and is only an arithmetic summary of on-chain observations, which should not be regarded as final losses confirmed by Coinkite or law enforcement.

Swan temporarily suspends some withdrawals, Nunchuk checks platform keys generated by Coldcard

On August 1, the Bitcoin financial service platform Swan stated that, due to the disclosure of the Coldcard vulnerability, it had temporarily stopped processing some Bitcoin withdrawals that appeared to be transferring to Coldcard wallets.

Swan stated that its own services were not affected by the vulnerability. The relevant restrictions are mainly based on the wallet labels users previously filled out for withdrawal addresses, as the platform cannot confirm only by label which specific device, firmware version, or seed the user is currently using are affected.

According to Bitcoin News’ report on Nunchuk's response, some platform keys were generated by Coldcard Mk4, but their actual use involved custom derivation logic, making them less likely to be directly included in queries established against standard derivation paths.

Nunchuk also stated that if attackers have sufficient time, it should still be assumed that these derived keys may eventually fall within the search scope. Currently, a complete technical announcement from Nunchuk released to the public has not been found, thus the above content should be understood as a media-translated company response, not as an independently verified security conclusion.

On-chain activities rose following the vulnerability disclosure, but it cannot be proven that all were caused by Coldcard.

CryptoQuant's research director Julio Moreno indicated that the number of daily active Bitcoin addresses rose from about 645,000 on July 30 to nearly 1 million on July 31, reaching the highest level since December 10, 2024, with a particularly significant increase in active sending addresses.

Moreno believes this may include Coldcard users migrating their BTC cautiously due to the vulnerability disclosure, but the active address data itself cannot identify wallet brands, nor can it prove a direct causal relationship between the two.

During the same period, the total volume of transactions under 1 BTC reached about 39,600 BTC, close to the 39,900 BTC recorded after the FTX bankruptcy in November 2022. The total recharge volume for transactions below 10 BTC at exchanges rose to about 7,300 BTC, the highest since February 6.

TimechainIndex founder Sani estimated that around July 31, the net inflow of Bitcoin to centralized platforms or identified entities was about 11,163 BTC, primarily flowing to River, Binance, Kraken, and OKX. Note that River is not a traditional pure exchange, so it is inappropriate to uniformly state that all data constitutes "net inflow to exchanges."

CryptoQuant analyst JA Maartunn noted that post-disclosure, around 77,402 BTC from older UTXO age ranges were re-transferred. This figure describes long-unused Bitcoin reappearing in on-chain activity and cannot be entirely attributed to Coldcard, nor does it imply that all these BTC have entered exchanges. Wallet migrations, address cleanups, custody method adjustments, and actual sales will all reflect in on-chain data.

Santiment suggests that the Coldcard incident may have weakened some traders' confidence in cold wallet and self-custody safety. However, this outcome stems from a short-term social media sample and is easily influenced by single-day news and extreme comments, making it impossible to judge whether market sentiment will persist.

PeckShield's safety report in July 2026 provisionally estimates losses related to Coldcard at about $70 million, marking it as the third largest crypto asset theft incident of that year, only behind Drift and KelpDAO/LayerZero.

This figure represents a snapshot at the stage of the release of the July monthly report and does not include all suspected addresses and fourth-round activities identified by Galaxy subsequently, nor does it equal the final losses confirmed by victims or law enforcement.

Incident sparks custody model controversy, but different solutions bear different risks

Bloomberg ETF analyst Eric Balchunas noted that, according to public data sources like PitchBook and LinkedIn, Coinkite has an estimated workforce of about 5 people. For a hardware wallet manufacturer responsible for the security of significant user assets, he believes this size may constitute a risk signal.

Balchunas opined that compared to larger institutions like Coinbase and Ledger, along with the regulated custodial systems behind Bitcoin spot ETFs, they may possess more security and compliance resources, although some solutions may incur higher fees. Coinkite's actual employee count has not been independently confirmed in its comments, hence "about 5 people" should be viewed as a third-party estimate it referenced, rather than a definitive fact.

Discussion around this viewpoint has mainly focused on the risk differences between centralized custody and self-custody.

Exchange and fund custodial systems face counterparty risks such as asset misappropriation, institutional bankruptcy, withdrawal freezes, internal attacks, regulatory enforcement, and single points of failure. Self-custody can mitigate some of these counterparty risks, but it transfers the responsibility for seed generation, backup, inheritance, signing devices, firmware supply chains, and user actions to asset holders.

The Coldcard incident illustrates that hardware wallets operating offline do not imply that all processes, such as seed generation, firmware building, and supply chain, have undergone rigorous verification. The issue occurred in the random number path for creating seeds, and the initially insufficient randomness of affected recovery phrases remains a problem, even if imported into wallets of other brands.

Simply upgrading the firmware will not fix already generated old recovery phrases. Users must create new seeds within the repaired firmware or other trusted environments and send assets to addresses controlled by the new seeds.

According to the Coinkite announcement, the fixed versions are:

· Mk2 and Mk3: version 4.2.0 or higher;

· Mk4 and Mk5 standard version: 5.6.0 or higher;

· Q standard version: 1.5.0Q or higher;

· Mk4 and Mk5 Edge: version 6.6.0X or higher;

· Q Edge: version 6.6.0QX or higher.

Coinkite indicated that introducing at least 50 fair, mutually independent, and non-leaked dice throws during seed creation can provide additional entropy not reliant on device random numbers. The dice must be real, fair, and independently executed by users; if the results are recorded, photographed, uploaded, or supplied by a third party, the additional protection will diminish.

A strong and unique BIP-39 password phrase can add an independent layer of protection but cannot restore the lost randomness of the original seed nor replace the need for asset migration. For those confirmed or potentially using seeds generated by affected firmware, Coinkite still recommends creating new seeds and transferring assets.

For assets on a larger scale, using devices from different vendors to generate keys and form a multisig solution can reduce the risk of controlling enough signing keys from the same vendor’s fault. However, this effect depends on whether sufficient secure keys are retained within the multisig threshold, while also increasing the complexities of backup, inheritance, recovery, and daily operations.

The Coldcard firmware source code has been publicly viewable and verifiable for a long time, enabling Block and other researchers to quickly locate the root cause after the incident. However, the current code license for Coldcard includes restrictions such as the Commons Clause, making it inappropriate to simply describe it as freely open-source software that meets conventional open-source definitions; a more accurate description would be “public source code” or “source code available for public review.”

The code's public availability only provides conditions for review and does not prove that the code has been sufficiently audited. The error in the seed generation path existed for about five years, indicating that even when key security code is public, it may still lack sufficiently deep or continuous scrutiny over long periods.

Community post-event tests show AI may locate vulnerabilities, but cannot prove attackers used AI

Coinkite stated in its technical notes that, given Coldcard's source code can be publicly accessed, the company speculated that someone may have used AI to review old version code and find issues.

The company also disclosed that it had reviewed the code with a leading AI model weeks before the incident occurred, but the model did not uncover this vulnerability or any other serious issues. This situation illustrates that AI review results can be influenced by various factors, including code scope, prompts, context length, tool configuration, and validation processes, and should not be regarded as a deterministic security audit.

After the vulnerability disclosure, a Reddit user claimed to have submitted the Coldcard code to Claude Code and input a simple instruction like “check for vulnerabilities,” with the model pointing out the random number generation path issue in about 8 minutes.

The same community user also stated that a GLM-5.2 model, which was already released or trained before the event and had no internet access during operation, similarly identified the same issue in about 20 minutes.

These tests occurred after the vulnerability was disclosed, and did not fully disclose the specific code commits analyzed, whether they contained fixes or related hints, model versions, system commands, complete execution logs, or network isolation validation. Thus, the results cannot rule out the possibility that the model encountered code versions containing obvious clues, or that the experimenters were influenced by known conclusions when choosing and interpreting outputs.

At most, these community tests indicate that current code models may be able to track macros, dependencies, and function call paths while receiving minimal manual guidance, and reproduce or independently locate this type of issue. They cannot prove that the original attackers discovered the vulnerability using AI, nor can they prove that AI is currently capable of automatically completing the entire attack process from code review, vulnerability weaponization, seed enumeration, to on-chain fund transfer.

No publicly available attack tools, model invocation records, prompts, execution environments, or attacker identity information can support AI attribution. Coinkite's claim that attackers may have utilized AI remains speculative.

What is currently confirmed regarding the Coldcard incident is that: the random number integration error introduced in 2021 weakened the security of wallet seeds generated by some firmware; multiple rounds of on-chain fund transfers with programmatic features subsequently emerged; research institutions such as Galaxy consider these activities may be related to that vulnerability, but have yet to complete individual cryptographic verification of victim wallets.

The incident concerns key generation issues for specific products and firmware, not the failure of Bitcoin elliptic curve cryptography, SHA-256, BIP-39 standards or Bitcoin's consensus mechanism; nor can it be concluded that all hardware wallets or all self-custody solutions are insecure.

Note: The address counts, BTC scale, and USD values cited in this article are provisional statistics derived from public on-chain data and transaction features as of August 3, 2026, and do not represent that relevant addresses have been confirmed as generated by the affected Coldcard firmware, nor do they equate to final losses confirmed by Coinkite, law enforcement, or victims. The incident is still developing, and the scope of affected devices and firmware should be based on Coinkite's latest security announcements.