Coldcard didn't get hacked. it just never generated a real random number. here's what actually happened. back in march 2021, a firmware update meant to enable coldcard's true hardware randomness generator shipped with a bug. a supporting library only checked if the setting existed, not whether it actually worked. key generation silently fell back to a weak software substitute, seeded from the device's serial number and internal clock. neither of those is secret. neither is random enough. your seed phrase is supposed to come from a range of possible values so large it's effectively unguessable. this bug collapsed that range down to something computationally reproducible. the device never got compromised. it just never had real randomness underneath it in the first place. someone found this and drained wallets on july 30. first estimate: $38 million from about 500 wallets. galaxy research's fuller trace a day later: closer to $70 million, nearly 1,200 addresses, most of it gone in a 40 minute window. some of these wallets hadn't moved since 2021. coinkite has expanded the warning beyond mk3 to certain mk4, mk5, and coldcard q firmware. the ceo took full accountability publicly. the part everyone needs to actually hear: updating your firmware does not fix this. if your original seed was generated on the broken firmware, that seed is permanently weak. the update changes how the device behaves going forward. it cannot repair a number that was already picked. the only real fix. generate a brand new seed on the updated firmware. move every dollar off any address tied to the old seed. if you own a coldcard, check coinkite's advisory today, not eventually. more wallets could still be drained, and there's no way to independently confirm your seed is safe without going through this. cold storage is only as secure as the randomness that created it. that assumption just got tested publicly, and it failed for real people. not financial advice.(CyrilXBT)