# Coldcard Seed Flaw Losses Pass $114 Million as Attackers Keep Sweeping Wallets

A build error routed seed generation through a software random number generator. That cut the randomness in each seed (its entropy) to as low as 40 bits on older devices, leaving thousands of wallets an attacker can reconstruct offline.

- Published: 2026-08-04T05:45:02.328Z
- Canonical: https://polylog.news/crypto/2026-08-04/coldcard-seed-flaw-losses-pass-114-million-as-attackers-keep
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcoin Magazine](https://bitcoinmagazine.com/news/coldcard-bitcoin-theft-continues), [Polylog editors](https://polylog.news), [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5589927.0), [CoinDesk](https://www.coindesk.com/markets/2026/08/04/bitcoin-nears-usd64-000-as-traders-look-past-the-fourth-coldcard-sweep)

The theft of bitcoin from Coldcard hardware wallets has now run for a fifth day. Bitcoin Magazine [now estimates more than $114 million taken in total](https://bitcoinmagazine.com/news/coldcard-bitcoin-theft-continues), and Watcher Guru [reported the figure crossing $100 million](https://t.me/WatcherGuru/14541) on Monday. CoinDesk described [a fourth sweep of vulnerable addresses](https://www.coindesk.com/markets/2026/08/04/bitcoin-nears-usd64-000-as-traders-look-past-the-fourth-coldcard-sweep) overnight. Bitcoin still trades near $64,000, up 1.9% over 24 hours.

The root cause is not a smart contract bug and not a physical attack on the device. It is a build error in the firmware from Coinkite, the Canadian company that manufactures Coldcard. A preprocessor guard checked only whether a configuration setting existed, not what value it held. As a result, the build linked seed generation to a software random number generator from MicroPython instead of the hardware random number generator. According to [The Hacker News](https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html) and [Crypto Briefing](https://cryptobriefing.com/coldcard-firmware-flaw-bitcoin-hack-89-million/), that software fallback was seeded from predictable startup values such as the device identifier and timer registers. Affected Mk2 and Mk3 firmware may have produced seeds carrying roughly 40 bits of entropy, and Mk4, Mk5 and Q devices roughly 72 bits. An attacker who can guess the startup conditions can reconstruct candidate seeds offline and then drain every address derived from them, with no network access to the device required.

The timeline is the part users are contesting. Crypto Briefing counts about 1,367 bitcoin taken from 4,585 addresses since July 30, with the first wave of more than 1,000 coins moving inside 41 minutes. That was roughly 30 hours before Coinkite published its advisory. Coinkite shipped patched firmware by August 1 and told holders whose seeds came from affected builds to move funds to new seeds, unless they had added independent entropy or used a strong passphrase. The [Bitcointalk advisory thread](https://bitcointalk.org/index.php?topic=5589927.0) carries the same instruction to act immediately. Funds have not been frozen or recovered, and no attribution has been made public.

Two arguments now run against each other. Coinkite's position is that a passphrase or user-supplied entropy protected careful holders, which shifts part of the exposure onto user practice. Holders answer that the whole proposition of a dedicated signing device is that they do not need to audit the manufacturer's build system. Both arguments can hold at once, and the practical result is identical. Seeds created on a specific range of firmware versions are guessable, and nothing the owner did after generating them changes that.

## What this means

This is a supply-chain failure inside the tool sold to eliminate counterparty risk, so the exposure runs directly to self-custody holders and indirectly to the wider case for personal key management. Every coin taken came from a device whose owner did exactly what the security guidance told them to do, which is the argument custodians and exchange-traded-fund issuers will now make to risk-averse holders. The offsetting force is that regulated custody concentrates keys with a small number of firms, so the choice on offer is between an audit failure at a device maker and a single institutional point of compromise.

## What to watch

- Whether the stolen coins move to mixing services or to exchanges, since exchange deposits create identifiable counterparties and a realistic path to freezing or attribution.
- Whether Coinkite publishes a full independent audit of its build pipeline, which would show whether the guard error was isolated or one of a class of defects in how firmware is compiled and signed.
- Whether other hardware wallet makers publish entropy verification results, because a second vendor with a similar defect would turn this from one company's error into an industry-wide assumption failure.