Coldcard Seed Flaw Losses Pass $114 Million as Attackers Keep Sweeping Wallets

The theft of bitcoin from Coldcard hardware wallets has now run for a fifth day. Bitcoin Magazine now estimates more than $114 million taken in total, and Watcher Guru reported the figure crossing $100 million on Monday. CoinDesk described a fourth sweep of vulnerable addresses overnight. Bitcoin still trades near $64,000, up 1.9% over 24 hours.

The root cause is not a smart contract bug and not a physical attack on the device. It is a build error in the firmware from Coinkite, the Canadian company that manufactures Coldcard. A preprocessor guard checked only whether a configuration setting existed, not what value it held. As a result, the build linked seed generation to a software random number generator from MicroPython instead of the hardware random number generator. According to The Hacker News and Crypto Briefing, that software fallback was seeded from predictable startup values such as the device identifier and timer registers. Affected Mk2 and Mk3 firmware may have produced seeds carrying roughly 40 bits of entropy, and Mk4, Mk5 and Q devices roughly 72 bits. An attacker who can guess the startup conditions can reconstruct candidate seeds offline and then drain every address derived from them, with no network access to the device required.

The timeline is the part users are contesting. Crypto Briefing counts about 1,367 bitcoin taken from 4,585 addresses since July 30, with the first wave of more than 1,000 coins moving inside 41 minutes. That was roughly 30 hours before Coinkite published its advisory. Coinkite shipped patched firmware by August 1 and told holders whose seeds came from affected builds to move funds to new seeds, unless they had added independent entropy or used a strong passphrase. The Bitcointalk advisory thread carries the same instruction to act immediately. Funds have not been frozen or recovered, and no attribution has been made public.

Two arguments now run against each other. Coinkite's position is that a passphrase or user-supplied entropy protected careful holders, which shifts part of the exposure onto user practice. Holders answer that the whole proposition of a dedicated signing device is that they do not need to audit the manufacturer's build system. Both arguments can hold at once, and the practical result is identical. Seeds created on a specific range of firmware versions are guessable, and nothing the owner did after generating them changes that.