A Build Flag Checked the Wrong Way Left Five Years of Coldcard Seeds Guessable, and Thieves Found It First

The failure behind this major hardware wallet theft is one line of preprocessor logic. Coldcard's cryptographic library checked whether a build macro was defined, not whether it was true, to decide whether to use the chip's hardware random number generator. Coinkite's production board configuration defines that macro as zero, because the company supplies its own wrapper. As a result, every firmware build from the March 2021 migration onward silently used MicroPython's deterministic "Yasmarang" pseudorandom generator instead, seeded from the chip's unique identifier and timer registers, to create Bitcoin seeds.

The consequences scale with the model. Mk2 and Mk3 devices produced seeds with roughly 40 bits of effective entropy. Mk4, Mk5 and Q devices mix in secure-element entropy at startup but hash it down to four bytes and replace only a single 32-bit word of generator state, leaving about 72 bits. The independent wallet firm Wizardsardine, which reviewed the root-cause analysis published by Block's Bitcoin engineering team, described the result as mixing two software generators together and leaving a Coldcard seed without a single bit of physical randomness.

Whoever found it did not file a bug report. The first mass sweep began at 01:31 UTC on 30 July 2026 and moved about 594 bitcoin out of roughly 500 single-signature wallets in 25 minutes, about 30 hours before Coinkite's first advisory. That advisory named only the Mk3 and was corrected the next morning to cover every current model. Fixed firmware shipped on 31 July, but updating a device does not repair a seed that was already generated, and CoinDesk reported the sweeps continuing days later. Coinkite chief executive Rodolfo Novak told users to move their funds before reading the rest of his own advisory. The company has declined to estimate total losses and has not offered compensation. Blockchain analytics firm TRM Labs traced early laundering through a coinjoin service, a tool that mixes multiple users' transactions together to obscure where funds came from, and through Tornado Cash on 4 August. A running Bitcointalk thread has tracked the stolen total upward for more than a week.

One method of generating seeds remained safe throughout. Seeds created with Coldcard's dice-roll option are unaffected, because that path hashes the user's rolls and never touches the faulty generator, and Coinkite puts the safe threshold at 50 or more fair, private rolls. That is why a once-marginal practice among Bitcoin users now looks like sound, mainstream advice. Goku Crypto News circulated video of a nine-year-old generating a Bitcoin wallet from dice and a developer's tool called QuailSeed, which converts the irregular speckle pattern on a quail eggshell into entropy from a single offline HTML file. Both are demonstrations rather than products. Both make the same point: the user can verify a die. The user cannot verify a compiled guard clause on a closed board.