Origin Unknown
The Coldcard debacle. Bitcoin's most trusted device failed the one test nobody was running.
A Bitcoin wallet is a very large number picked at random, and everything else about self-custody rests on how big the pool was that it came from. For a standard twelve-word seed phrase, that pool has thirty-nine digits in it, and since 128 bits is Coinkite’s own stated design target while a twenty-four word seed carries 256, the shortfall below reaches affected owners either way.
Coinkite’s own estimate, published on 30 July, is that seeds generated on a Coldcard Mk3 running any firmware the company shipped between March 2021 and last week were picked from a pool with about thirteen.
Thirteen digits is a large number in a household budget and a small one in a data centre. Between 01:10 and 01:51 UTC on 30 July, someone holding a list of candidate keys emptied 1,196 Bitcoin addresses in forty-one minutes and took 1,082.65 BTC, about $70.2 million at that day’s prices, according to Galaxy Research. Three further sweeps have followed.
The mechanism underneath is almost insultingly small. Coinkite wrote its own wrapper for the hardware random-number generator inside the Coldcard’s STM32 chip and switched MicroPython’s built-in version off by setting a configuration flag to zero. A library called libngu was supposed to refuse to build if no hardware generator was present, and it checked with a C directive that asks whether a name has been defined at all, rather than whether it has been set to anything.
The name was defined. Its value was zero. The build went ahead, and seed generation quietly resolved to a software pseudo-random generator seeded once from the chip’s factory serial number and two timer registers, then never fed anything again.
Block’s Bitcoin engineering team, which root-caused the fault and published on 30 July, compressed the consequence into one line: “XOR does not create entropy. If both inputs are reproducible, their XOR is reproducible.”
The reading that has dominated the five days since is the obvious one. CoinDesk’s headline on 31 July said the exploit “may push investors to ETFs,” and the Taproot developer Udi Wertheimer put the argument sharpest: “If you don’t want to worry yourself you need to pay someone else to be worried.”
That reading points at the wrong casualty, and the reason arrived the same day as the theft.
At 22:37 UTC on 30 July, some twenty-one hours after the sweep and thirteen minutes before Coinkite published its advisory, a Bitcoin Core contributor posting as instagibbs put up cryptographic proof that he had recovered the root key of a Coldcard Mk3 on his own desk. Nobody had given him its seed. He modelled the broken generator against the device’s keypad call trace and a measured eighty-thousand-state timer range, then searched until a derived key reproduced the wallet’s published extended public key and signed valid.
Caveats belong on that. Gregory Sanders works at Spiral, a Block initiative, and Block published the root-cause analysis, so this was not an outside party. His code was never released, only its hashes, and Coinkite has never addressed the result.
What the demonstration cost is the part to hold onto. One contributor, one device already in a drawer, published firmware, an ordinary computer, inside a day of the first reports. No laboratory, no certification body, no budget, and five years and four months in which nobody had tried.
Coinkite says it did not know. Its write-up on 30 July states plainly, “We were unaware of the bug until today,” and names the review gap precisely: existing review “verified that code but did not verify end-to-end symbol resolution and call reachability from wallet seed generation.” Weeks before the theft the company ran one of the best available AI models across its codebase looking for this exact class of problem, and it found nothing.
Its other conclusion is the uncomfortable one. The same write-up assumes “someone used AI to review previous versions of our firmware and stumbled upon this issue,” and NVK, the Coldcard co-founder, told Bitcoin Magazine on 31 July that “AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts.” No named researcher has corroborated it and the company has an obvious interest in the framing, so it stands as a hypothesis.
Take it at face value anyway, because it does not rescue human review. It buries it. Five years of the most motivated open-source scrutiny in finance found nothing, Coinkite’s own AI pass found nothing, and on the vendor’s own account the tooling that could finally see the flaw arrived on the attacker’s side first.
Reading, in the form the industry actually practised it, was never going to settle this. A reproducible build proves the binary on your device matches the published code. It does not prove the code does what a reviewer believes. And the output gives nothing away either: NIST’s guidance on entropy sources concedes that conventional statistical tests “will almost always fail” to assess a generator, because a good deterministic generator is built to look random and passes them.
So the property was settled by reproduction rather than inspection. Sanders did not read the bug out of the code, he rebuilt a key and checked it against the chain. That work needed one device and a weekend, and it was nobody’s job.
Nick Percoco, chief security officer at Kraken, made the point on 2 August. The industry has no “universally enforced process that forces end-to-end validation of the RNG path, from approved design, to tested behavior, to the exact call executed at runtime,” he wrote, adding that “such checks are already standard across the rest of the security industry.”
Coldcard scored at or near the top of the category on the axis its buyers cared about, transparency: open firmware, reproducible builds, air-gapped operation, no cloud. It lacked the other axis, a separately certified hardware generator of the kind Ledger advertises, and that absence is the first thing a competitor reached for last week. It is also beside the point. A certificate covers the component it names, and this failure was in which function the software reached for at build time, a layer no certificate inspects, so neither axis was looking where the bug lived. That is what makes it a category problem rather than a Coinkite problem.
And it points at a fix that has nothing to do with picking a better manufacturer. Every mitigation that works here removes the need to trust the device’s randomness at all: dice you roll yourself, a protocol forcing the device to prove it did not choose the seed alone, keys spread across makers who share no codebase. Self-custody stops being a thing you buy and becomes a structure you assemble, and the assembly is the part no manufacturer was selling.
The Deep Dive
Within forty-eight hours the sophisticated answer had arrived, and it was multisignature. Unchained told clients to rotate any Coldcard-generated key onto a device from a different maker, warning that exposure was worst “if you use two Coldcard-generated keys for your Unchained 2-of-3 multisig vault.” Kevin Loaec of Wizardsardine put it cleanest on 1 August: spread keys across vendors, and “an entropy generation flaw in one of them therefore exposes a single key, which is not enough to reach the spending threshold.”
All correct, and all prospective. None of it reaches a key that already exists.
Nunchuk, to its credit, said so first. In an advisory posted before anyone asked, it disclosed that some of its own platform keys had been generated on a Coldcard Mk4, while noting they “are not used directly” because custom derivation logic sits in between, so a lookup table of compromised seeds “won’t be immediately included, though given enough time, we have to assume they will be.”
It widened that guidance within thirty-seven minutes, to the harder line that “any seed generated on-device on a Coldcard since 2021 should be treated as suspect.” A company behaving well, and it still shows the problem: a quorum is only diversified if you know where each key came from. Loaec’s standard fits in a sentence. “A seed whose origin you cannot establish should be treated as affected, and migrated like the rest.”
How much sits behind that sentence is unknown. Coinkite has never disclosed how many devices it has sold, and nobody, not Coinkite, Block or Galaxy, has estimated how many devices or seeds are affected. The only quantified figure in the episode is the money already gone, and even that splits.
Galaxy had 1,367.05 BTC across 4,585 addresses attributed by 2 August, roughly $88.6 million, plus a fourth wave of 448.7 BTC across 709 addresses flagged on 3 August by Alex Thorn on pattern matching alone. No victim had confirmed that wave as of Monday, and Galaxy had already cut it from 486.11 BTC after stripping out multisig false positives. Counting it takes the running total to about 1,816 BTC, near $114 million at Monday’s price of $62,670, per CoinDesk Data. Three quarters of that number is attributed and the last quarter is inferred.
What remains exposed rests on one contested number. Coinkite gives about 40 bits of effective search space on the Mk2 and Mk3 and about 72 on the Mk4, Mk5 and Q, against the 128 a twelve-word seed should carry, and that 72 is the most generous estimate anyone has published.
Block reaches the same devices another way. Coinkite added a reseed on Mk4-generation hardware drawn from the two secure elements, but the function accepts one 32-bit integer and writes it into a single word of the generator’s state, leaving the rest untouched, which caps an attacker’s work at 2^32. Wizardsardine read the same analysis as implying 50 to 60 bits. Nunchuk told its own customers the reseed “adds only 32 bits, which is brute-forceable.”
Forty bits separate the vendor’s estimate from the outside ones, the distance between an attack needing a national laboratory and one needing a weekend. Coinkite calls its figures preliminary. Block has not done full empirical testing.
Now to why nobody caught it, which is not that the tools are missing. Reproducible builds, the discipline Coldcard’s buyers valued most, verify that a shipped binary corresponds to published source, and that is all they claim. Common Criteria evaluation, the EAL5+ and EAL6+ ratings the industry advertises, assesses only the component named in its security target, usually the secure element’s silicon and cryptographic library.
The entropy standards ought to have mattered and they stop short too. NIST’s SP 800-90B validates an entropy source as a bounded entity and certifies it standalone; AIS-31 requires a stochastic model of the physical noise source plus continuous health tests, and Ledger’s generator holds its PTG.2 class. Neither would have caught this, because the STM32 generator inside the Coldcard worked perfectly and nothing was calling it.
Only FIPS 140-3 reaches further, testing raw samples across restarts, a million of them over a thousand power cycles, to catch a device producing correlated output between boots. That is exactly the Coldcard failure mode, and no consumer hardware wallet is obliged to hold it.
There is precedent for how badly that boundary fails. In October 2017 researchers at Masaryk University disclosed that Infineon smartcard chips had been generating RSA keys in a constrained form since at least 2012, letting the private key be computed from the public key alone. Those chips were certified. The certificate covered the silicon, not what the silicon had been told to compute.
Set the loss beside the recourse next, because the reporting here has been too quick. Coinkite sells “as-is” and caps its aggregate liability, at section 18 of its terms, “to direct damages not to exceed the purchase price we have received for such Products,” with section 19 adding that the limits apply “irrespective of the nature of the cause of action” and “shall survive a fundamental breach or breaches.”
That last phrase is the most revealing line in the document, because fundamental breach is a doctrine the Supreme Court of Canada laid to rest in Tercon Contractors v British Columbia in 2010. Coinkite is a Toronto company that has chosen Ontario law and a Toronto forum, so the framework that replaced it governs, and it asks whether the clause covers this breach, whether it was unconscionable when formed, and whether public policy bars enforcing it. The last two belong to the court.
The statute does more damage than the case law. Ontario’s Consumer Protection Act applies where either party is in Ontario, which for a Toronto seller covers every direct sale it makes anywhere, and section 9(3) voids any term negating the implied conditions of merchantable quality and fitness for purpose. That disposes of the “as-is” disclaimer, and sections 7(2) and 8 void the arbitration clause and the class action waiver. Abroad it is weaker still: the UK Consumer Rights Act says such a term “is not binding on the consumer,” the EU’s unfair terms directive grey-lists it by name, and Australian Consumer Law voids it.
The obstacle is the clock rather than the contract. No court anywhere has ruled on a hardware wallet maker’s liability cap, and the two cases that came closest died on procedure: the Ninth Circuit revived Baton v Ledger in December 2022 by refusing to enforce Ledger’s French forum clause against Californian consumers, and an Illinois court rejected the same manoeuvre in April 2025. Neither reached the merits, and Canadian certification alone runs to two years.
Insurance sits in the same fog. AnchorWatch, a Lloyd’s of London coverholder since November 2024, runs the only underwritten product for Bitcoin in self-custody, up to $100 million a vault at premiums from 0.6 percent. Its published perils are coercion, wrench attacks, kidnapping, burglary, fire, flood, tornado and wildfire, alongside a broader clause covering permanent loss of control, subject to policy terms. Manufacturing defect is named nowhere in either direction, and the vaults support Coldcard as signing hardware.
Estonia, hit by the same Infineon flaw, blocked the certificates on 760,000 identity cards at midnight on Friday 3 November 2017 and had roughly 740,000 updated, because one operator held the whole infrastructure. Bitcoin has no such operator and can never have one. Remediation is a transaction each owner must construct, sign and broadcast, having first worked out which firmware produced a seed they may have created in 2021 and not touched since.
A certificate at least expires on its own. A Bitcoin seed does not. It sits stamped into a steel plate in a safe deposit box, referenced in an estate file, held by an executor who has never heard the word entropy, and it stays sweepable for as long as it sits there.
So the question with money attached to it is where the fix lands. All four paths below are already running in some measure; what follows prices which one becomes dominant, not which one occurs.
Begin with the cheapest answer, because cheap answers usually win. A device can be made to prove it did not choose your seed alone, and Trezor has shipped exactly that since firmware 2.8.7 in January 2025: the device commits to its own randomness before it sees the host’s, then the host recomputes the derivation and refuses to proceed on a mismatch. A Coldcard in its broken state fails that check.
The objection is that eighteen months have passed and not one competitor has copied it, which makes the same fact evidence against diffusion as easily as for it. Ledger has gone further, arguing on 2 August that “a seed you cannot predict beats a promise that it was random.” What changed on 30 July is not the cost of the feature but the demand for it: until last week no buyer was asking a vendor to prove which generator had run, so answering that question earned nothing, and there is now a nine-figure failure with a named victim and a specific mechanism that would have prevented it. Forty-four percent is where that lands, still the clear leader and lower than it would be if the diffusion had ever been observed working, and it is far kinder to the manufacturers than the commoditisation everyone is predicting because it lets them keep the customer with a firmware release. Confirmation is two or more major vendors making user-verifiable seed generation the default inside twelve months.
Twenty-four percent says the fix lands in the arrangement instead, with holders carrying it through quorums across makers who share no codebase, and the device demoted to a component nobody can sell independence from. The coordinators moving inside forty-eight hours is the argument for it. Against it is a decade of evidence: multisig has been advocated continuously since 2014 and remains a small minority of self-custody, because assembling three devices is work. If multi-vendor key generation is the default rather than the advanced option at Unchained, Casa, Nunchuk or Liana by October, this is the world you are in.
An institution taking it on carries nineteen percent, by attestation or by judgment. Percoco has sketched the specification, and independent verification of the integrated randomness path is both testable and fundable. A court declining to enforce a wallet maker’s liability cap does the same work by another route, since one ruling reprices every set of terms in the category. Both are live, both are slow, and the number reflects the twelve-month clock rather than any doubt about direction.
The smallest path is that nothing lands and the marginal holder leaves. On 31 July, Julio Moreno, head of research at CryptoQuant, recorded Bitcoin transfers under one BTC moving onto exchanges at 39,600 BTC, against 39,900 BTC on 16 November 2022, the day after FTX filed. That is a real signal, and it is one day of it against a multi-year move the other way, and the people who buy air-gapped Bitcoin-only hardware are the least likely in this market to stop holding their own keys. Thirteen percent, still below the twenty-five a blind guess across four paths would assign, and it sits there on that evidence.
Two developments would move these numbers. A Coinkite review confirming the low end of Block’s range pulls weight toward exit, because a brute-forceable Mk4 population is a reason to leave rather than reorganise. A court reaching the merits on a liability cap, rather than dying on a forum clause as the Ledger cases did, roughly doubles the institutional path.
The calendar gives four ways to test it. Coinkite’s formal technical review comes first, carrying every entropy figure now in circulation on its back, and a confirmation near 72 bits buys the newer installed base time while anything near 2^32 turns a subset migration into a general one. Then whether a second major vendor ships user-verifiable seed generation before year end, the cheapest move available to any of them and the cleanest confirmation of the base case. Farside’s ETF flow data through the second week of August tests the exit path, and argues against it so far, since 31 July ran a $265 million net outflow rather than the inflow the ETF case predicts. Last, whether any complaint against Coinkite survives its first jurisdictional motion, because the first wallet maker to defend a cap on the merits sets the price of every other set of terms in the industry.
The oldest fix here is also the crudest, and it is the only one that worked on the day. Coinkite’s advisory notes that a seed built from fifty or more private rolls of a fair six-sided die was never at risk, because the dice supplied entropy the device could not have chosen. Every serious answer now on the table is a more elegant version of that same manoeuvre. The industry spent a decade selling people reasons to trust the machine, and what it has to sell them next is a way of not having to.
Sources:
Coinkite Inc., “COLDCARD Seed Generation Warning,” 30 July 2026, updated 1 August 2026.
Coinkite Inc., “Technical Deep Dive into the Entropy Issue,” 30 July 2026, updated 1 August 2026.
Coinkite Inc., “Terms and Conditions,” sections 16, 18 and 19, coinkite.com/terms.
Block Bitcoin Engineering and Security, “Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware,” 30 July 2026.
Gregory Sanders (@theinstagibbs), seed-recovery proof for a Coldcard Mk3 on firmware 4.1.3, posted 30 July 2026 at 22:37 UTC; reported by Protos and CryptoSlate, 31 July 2026.
Bitcoin Magazine, Juan Galt, “Coinkite Releases Fixed Firmware After Coldcard Bug,” 31 July 2026, quoting NVK.
Ledger, Charles Guillemet, “The Coldcard Incident: How Did This Happen?,” 2 August 2026.
Trezor firmware changelog, core 2.8.7 released 22 January 2025, entropy check workflow.
Galaxy Research wave figures via CoinDesk and Decrypt, 3 August 2026; Bitcoin price $62,670.61, CoinDesk Data, 10:51 ET, 3 August 2026.
Galaxy Research, on-chain sweep reconstruction and wave analysis, 31 July to 3 August 2026, reported by The Block, RT Watson, 31 July 2026, and CoinDesk, Shaurya Malwa, 3 August 2026.
CoinDesk, Krisztian Sandor, “Coldcard’s $38 Million (So Far) Exploit Shakes Faith in Self-Custody, May Push Investors to ETFs,” 31 July 2026.
CoinDesk, “Unlike the FTX Collapse, the $88 Million Coldcard Exploit Has Investors Sending Bitcoin Back to Exchanges,” 2 August 2026, citing CryptoQuant.
Wizardsardine, Kevin Loaec, “Coldcard RNG Vulnerability,” 1 August 2026.
Unchained, client advisory, 30 July 2026. Nunchuk, advisory and update, 31 July 2026.
crypto.news, “Coldcard Exploit Sparks Call for Independent Audits, Kraken CSO,” 3 August 2026; Cointelegraph, “Coldcard’s 5-Year Flaw Reveals Hardware Wallet Testing Gap, Kraken’s Security Chief,” 2 August 2026.
Ledger, Charles Guillemet, “The Coldcard Incident: How Did This Happen?,” 2 August 2026. Trezor, “Entropy Check: How Trezor Verifies Your Wallet Is Truly Random,” trezor.io.
NIST, Special Publication 800-90B, “Recommendation for the Entropy Sources Used for Random Bit Generation,” January 2018; Special Publication 800-22 Rev 1a, April 2010; FIPS 140-3, 22 March 2019.
AnchorWatch, “Frequently Asked Questions,” anchorwatch.com/faqs; Business Wire, Lloyd’s coverholder announcement, 18 November 2024.
Nemec, Sys, Svenda, Klinec and Matyas, “The Return of Coppersmith’s Attack: Practical Factorization of Widely Used RSA Moduli,” ACM CCS 2017, and the ROCA disclosure page, Masaryk University, 16 October 2017.
Government of Estonia and Information System Authority, “Estonia Will Block the Certificates of 760,000 ID Cards,” 2 November 2017; RIA, “ROCA Vulnerability and eID: Lessons Learned,” 2018.
Debian Security Advisory DSA-1571-1, 13 May 2008; Yilek, Rescorla, Shacham, Enright and Savage, “When Private Keys are Public: Results from the 2008 Debian OpenSSL Vulnerability,” ACM Internet Measurement Conference, November 2009.
Tercon Contractors Ltd v British Columbia, 2010 SCC 4; Uber Technologies Inc v Heller, 2020 SCC 16; Ontario Consumer Protection Act, 2002, sections 2, 7, 8 and 9; UK Consumer Rights Act 2015, section 31; Council Directive 93/13/EEC; Australian Consumer Law, section 64.
Baton v Ledger SAS, No. 21-17036 (9th Cir., 1 December 2022); Gevorkyan v Ledger SAS, No. 1:24-cv-01825 (N.D. Ill., 4 April 2025).
Farside Investors, US spot Bitcoin ETF daily flow data, 29 to 31 July 2026.
Disclaimer: This report is published by Scenarica Intelligence for informational purposes only. It does not constitute investment advice, a solicitation to buy or sell any financial instrument, or a recommendation regarding any particular investment strategy. Scenarica Intelligence is not a registered investment adviser or broker-dealer. All scenario probabilities and assessments represent the analytical judgment of Scenarica Intelligence and are subject to change without notice. Past performance of any asset or strategy discussed does not guarantee future results. Readers should conduct their own due diligence and consult with qualified financial advisers before making investment decisions.
Scenarica Premium: The full Scenarica suite includes Geopolitics, Economy, Bitcoin, AI, and Sunday Edition.
Scenarica Intelligence
We don’t predict the future. We price it.