Coldcard's Five-Year Entropy Defect Accounts for Roughly a Tenth of 2026's $1.2 Billion in Crypto Theft

The running total of stolen crypto in 2026 has passed $1.2 billion across 276 incidents, and the Coldcard hardware wallet failure alone accounts for close to a tenth of that sum. The emergency notice on Bitcointalk tells Coldcard owners to treat any seed generated since March 2021 as compromised, regardless of what firmware the device runs today.

The root cause is not a smart contract and not a phishing message. Firmware version 4.0.0 caused affected devices to skip the STM32 chip's hardware random number generator during seed creation and fall back to MicroPython's Yasmarang software pseudorandom generator. On Mk3 units, that collapsed effective key entropy from 128 bits to as little as 40 bits, a search space small enough to enumerate. Beginning on 30 July, attackers moved 1,816 BTC, worth about $116 million, out of more than 5,200 addresses in four waves. One wave took 1,082 BTC from 1,196 addresses in 41 minutes. The keys were never stolen. They were derived.

A second, cruder attack surface is open at the same time. A counterfeit Trezor website has been appearing at the top of Google results as a sponsored listing, and at least one user says they lost their entire holdings after clicking through. That failure requires no cryptographic insight, only advertising spend.

Demand for the devices is nonetheless rising in places where custodial access is restricted. In Russia, hardware wallet sales more than doubled as new crypto rules approach, with the marketplace Wildberries reporting an average price 13% lower at 7,900 rubles and the electronics chain M.Video widening its range. Neither retailer identified what is driving the demand.