# A Build Flag Checked the Wrong Way Left Five Years of Coldcard Seeds Guessable, and Thieves Found It First

Galaxy Research has confirmed 1,719 bitcoin, roughly $111 million, taken from wallets whose keys were generated by a deterministic software routine instead of the chip's hardware randomness.

- Published: 2026-08-10T05:51:49.058Z
- Canonical: https://polylog.news/crypto/2026-08-10/a-build-flag-checked-the-wrong-way-left-five-years-of-coldca
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Bitcointalk Dev & Technical](https://bitcointalk.org/index.php?topic=5589927.0), [Polylog editors](https://polylog.news)

The failure behind this major hardware wallet theft is one line of preprocessor logic. Coldcard's cryptographic library checked whether a build macro was *defined*, not whether it was *true*, to decide whether to use the chip's hardware random number generator. Coinkite's production board configuration defines that macro as zero, because the company supplies its own wrapper. As a result, every firmware build from the March 2021 migration onward silently used MicroPython's deterministic "Yasmarang" pseudorandom generator instead, seeded from the chip's unique identifier and timer registers, to create Bitcoin seeds.

The consequences scale with the model. Mk2 and Mk3 devices produced seeds with roughly 40 bits of effective entropy. Mk4, Mk5 and Q devices mix in secure-element entropy at startup but hash it down to four bytes and replace only a single 32-bit word of generator state, leaving about 72 bits. The independent wallet firm Wizardsardine, which reviewed the [root-cause analysis published by Block's Bitcoin engineering team](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware), described the result as mixing two software generators together and leaving a Coldcard seed without a single bit of physical randomness.

Whoever found it did not file a bug report. The first mass sweep began at 01:31 UTC on 30 July 2026 and moved about 594 bitcoin out of roughly 500 single-signature wallets in 25 minutes, about 30 hours before Coinkite's first advisory. That advisory named only the Mk3 and was corrected the next morning to cover every current model. Fixed firmware shipped on 31 July, but updating a device does not repair a seed that was already generated, and [CoinDesk reported the sweeps continuing days later](https://www.coindesk.com/tech/2026/08/04/coldcard-urges-users-to-move-bitcoin-as-active-wallet-exploit-continues). Coinkite chief executive Rodolfo Novak told users to move their funds before reading the rest of his own advisory. The company has declined to estimate total losses and has not offered compensation. Blockchain analytics firm [TRM Labs traced early laundering](https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack) through a coinjoin service, a tool that mixes multiple users' transactions together to obscure where funds came from, and through Tornado Cash on 4 August. A [running Bitcointalk thread](https://bitcointalk.org/index.php?topic=5589927.0) has tracked the stolen total upward for more than a week.

One method of generating seeds remained safe throughout. Seeds created with Coldcard's dice-roll option are unaffected, because that path hashes the user's rolls and never touches the faulty generator, and Coinkite puts the safe threshold at 50 or more fair, private rolls. That is why a once-marginal practice among Bitcoin users now looks like sound, mainstream advice. Goku Crypto News circulated video of [a nine-year-old generating a Bitcoin wallet from dice](https://t.me/GokuCryptoNews/20329) and a developer's tool called [QuailSeed, which converts the irregular speckle pattern on a quail eggshell into entropy](https://t.me/GokuCryptoNews/20326) from a single offline HTML file. Both are demonstrations rather than products. Both make the same point: the user can verify a die. The user cannot verify a compiled guard clause on a closed board.

## What this means

Self-custody hardware was sold on the premise that removing the key from an internet-connected machine removes the counterparty. This incident relocates the counterparty rather than removing it. Control shifts to the vendor's build system, which no outside owner can inspect. The exposed parties are individual Bitcoin holders who followed best practice, and the beneficiaries are custodial platforms and spot exchange-traded funds, which absorb holders who conclude that outsourced custody with a balance sheet behind it is the cheaper risk. Coinkite's refusal to estimate losses or offer compensation sets the precedent that firmware defects carry no vendor liability, which raises the insurance and audit cost for every hardware wallet maker seeking institutional buyers.

## What to watch

- Whether Coinkite publishes the promised post-mortem and whether it names a loss figure. Continued silence would push the accounting onto blockchain analytics firms and plaintiffs' lawyers instead of the manufacturer.
- Whether competing wallet vendors publish entropy self-tests that a user can run on their own device. That would turn "trust the certification" into something checkable, and its absence tells you the industry expects the same class of bug to recur.
- Movement of the stolen coins through coinjoin services and mixers, and whether exchanges freeze any of it. Recovery so far is zero, and that outcome shapes whether holders treat self-custody defects as insurable.