Coinkite has been hit by a major security lapse. A bug hidden in Coldcard hardware wallet firmware for over five years allowed hackers to steal roughly 594 BTC, valued near $38 million. The massive theft unfolded within half an hour early on July 31, 2026. The vulnerability stems from a faulty random number generator inside the Coldcard Mk3 firmware, compromising the seed generation process.
The attack was swift and precise. About 1,324 bitcoin transactions moved funds from roughly 500 single-signature wallets between 01:31 and 01:56 UTC. Each targeted wallet held at least 0.15 BTC, many untouched for years. The stolen coins’ activity dates align perfectly with the flaw’s introduction in March 2021.
How the Bug Worked
Investigations trace the root cause to a firmware commit rolled out on March 1, 2021, starting with version 4.0.0. Instead of using the device’s secure hardware randomness generator, the firmware defaulted to a weaker software-based method relying on the device’s serial number and clock registers. These inputs aren’t secret, so the seed’s entropy plummeted from 128 bits to around 72 bits, making it vulnerable to seed recovery attacks.
Besides Mk3 units with firmware 4.0.1 and later, the same flaw also affects Mk4 and Mk5 Coldcard devices running firmware versions below 5.6.0, as well as Q-series wallets before version 1.5.0Q. Users who created their seed without adding sufficient external randomness are at risk. Coinkite urges all affected users to migrate immediately to new seed phrases generated with updated firmware. Meanwhile, TAPSIGNER, OPENDIME, and SATSCARD wallets remain unaffected due to different codebases.
This incident sheds light on unexpected weaknesses in hardware wallet security, highlighting how a single overlooked software configuration can compromise millions in bitcoin. The theft has rattled confidence in Coldcard devices just as crypto markets have been eyeing regulatory changes and exchange developments elsewhere.
Bitcoin’s price barely reacted, slipping less than 1% within hours after news broke.
Disclaimer: this material is for informational purposes only and not financial advice.
