A Coldcard Firmware Bug and the $88.6 Million Bitcoin Theft: What Actually Went Wrong
A random number flaw in Coldcard's firmware sat undetected for five years, then helped drain $88.6 million in bitcoin. Here is what actually failed.
On July 30, 2026, an automated operation drained 1,083 bitcoin, worth about $70.2 million at the time, from more than a thousand wallets in just 41 minutes. Two more waves followed over the next two days, pushing the total to 1,367 bitcoin, roughly $88.6 million, taken from 4,585 addresses. Almost all of the wallets involved were Coldcard devices, a well-known line of hardware wallets: physical devices that store the private keys controlling bitcoin offline, away from a phone or computer that could be hacked. The cause was a firmware bug in Coldcard’s random number generator, the component responsible for producing the unpredictable numbers a wallet needs to create a genuinely private key. For close to five years, under specific conditions, that component silently produced numbers that were not random at all. Coinkite, the company behind Coldcard, shipped a fix within a day of the theft going public. The fix does not undo what already happened, and understanding why is the part most coverage of this story left out.
What actually broke
Firmware bugs that go unnoticed for years usually hide in plain sight, the way DecodeStack has seen with software supply chain attacks, where the danger sits inside code everyone already trusts rather than in some obvious intrusion. Coldcard’s bug lived inside a single configuration check.
Coldcard’s firmware is built on MicroPython, a lightweight version of the Python programming language made for small, low-power devices. Coinkite configured that firmware to rely on its own hardware-based randomness source, a chip-level generator that produces numbers from physical electrical noise too chaotic to predict, instead of MicroPython’s built-in one. To make that happen, a setting called MICROPY_HW_ENABLE_RNG is supposed to be switched off, telling the firmware to skip MicroPython’s own generator entirely.
That is where the bug sat. According to the technical writeup from Block Engineering, the security research team that found the flaw and coordinated its disclosure with Coinkite, the code checking that setting only tested whether the setting existed at all, not whether it was actually turned on. Because the setting was present, just switched off, the check passed, and the firmware quietly fell back to MicroPython’s own generator instead of the dedicated hardware one Coldcard was built around.
That fallback generator, called Yasmarang, was never built for security. It is a fast, simple algorithm meant for ordinary programming tasks, and its output looks random to a casual glance but can be reconstructed by anyone who knows how it starts. Coldcard’s implementation combined two Yasmarang instances seeded from a small set of fixed, publicly known constants along with the device’s own chip identifier and internal clock timing, none of which is secret information an attacker would need to guess.
How weak is “weak”
The practical damage comes down to entropy, the term cryptographers use for how many possible outcomes a random process can produce. A properly random 128-bit key has roughly as many possible values as there are atoms in a large boulder, far more combinations than any realistic amount of computing power could work through. That is the level of unpredictability Coldcard’s key generation was designed to guarantee.
With the bug active, that number collapsed. Coinkite’s own technical analysis put the effective entropy at around 2^40 on the older Mk2 and Mk3 devices, and around 2^72 on the newer Mk4, Mk5, and Q models. In plain terms, 2^40 possibilities is a range a modern computer cluster can work through in hours. 2^72 is far larger and out of reach for casual attackers, but not for a well-resourced one with purpose-built hardware and enough motivation. Both figures are a steep drop from the roughly 2^128 the wallet was supposed to deliver, and that gap, between “impossible to guess” and “guessable with enough computing power,” is exactly what turned an obscure firmware bug into a working theft.
The three-wave theft
The bug alone would not have mattered without someone finding and using it. BleepingComputer’s reporting on the theft credits the on-chain research group Galaxy Research with spotting the pattern that tied the weakened randomness to a wave of drained wallets. Galaxy Research tracks cryptocurrency movements for a living; it is not credited with finding the underlying firmware bug itself, a distinction that belongs to Block Engineering.
The first wave hit on July 30, 2026: 1,083 bitcoin, about $70.2 million at the time, pulled from 1,196 addresses in just 41 minutes, roughly 30 hours before the RNG bug became public knowledge. Two further waves followed on August 1, bringing the running total to 1,367 bitcoin and 4,585 addresses, worth about $88.6 million combined.
Every transaction in the operation paid an identical fixed fee and sent no leftover funds back to a fresh address, unlike how a person moving their own money typically would (the fee, 30 satoshis per virtual byte, is a standard Bitcoin fee unit). That consistency across thousands of separate withdrawals points to automated tooling working through a list of vulnerable addresses systematically, not a person clicking through wallets one at a time. The tally did not stop there: further waves after August 1 pushed the running total past $100 million, a reminder that any figure attached to an active, automated theft is a snapshot, not a final count.
Coinkite’s response: not denied
Coinkite did not dispute the bug. CEO Rodolfo Novak posted a public apology on X, describing himself as heartbroken over the losses and stating that the firmware bug was Coinkite’s own responsibility, not the result of user error or an outside attack on Coldcard’s supply chain.
Coinkite backed the apology with concrete action. The company published an official firmware advisory naming every affected version, destroyed its stock of unshipped devices still carrying the vulnerable firmware, and released an emergency patch on July 31, 2026, less than 24 hours after the theft’s first wave.
That response was fast and specific about what went wrong, without the vague “sophisticated attack” framing companies often reach for after a security failure. It does not undo the theft. It does mean Coldcard owners got a clear, credible account of what happened and what to do about it, rather than a delayed statement and weeks of silence.
The fix everyone’s headline gets wrong
Here is the detail that separates a useful headline from a misleading one: updating Coldcard’s firmware does not protect bitcoin that already sits on a seed generated before the update. A seed, short for seed phrase, is the list of words a wallet uses to reconstruct every private key it controls. If that seed was generated while the RNG bug was active, the seed itself is weak, and no firmware update after the fact changes the words that were already produced.
The patch closes the hole going forward. Anyone who generates a brand-new seed on updated firmware gets the full protection the device was always meant to provide. But a wallet that keeps using its old seed, patched firmware or not, remains exposed to anyone who has worked out how to reproduce that weakened randomness.
Two groups of Coldcard owners were never at meaningful risk in the first place. Anyone who added at least 50 independent dice rolls to their seed generation, a supported feature letting a physical die contribute extra randomness on top of the device’s own generator, ended up with a seed no software bug could weaken. The same protection applies to anyone using a strong, unique BIP-39 passphrase, an optional extra word or phrase layered on top of a seed that effectively creates a separate wallet an attacker cannot derive from the seed alone. Everyone else generated a seed that depended entirely on the device doing its job correctly, and for about five years, under the right conditions, it did not.
What Coldcard owners should actually do right now
Coinkite’s recommended action is direct: update the firmware first, but treat that update as step one, not the whole fix.
- Update to a patched firmware version immediately: 4.2.0 for Mk3, 5.6.0 (or 6.6.0X on Edge firmware) for Mk4 and Mk5, and 1.5.0Q (or 6.6.0QX on Edge) for the Coldcard Q.
- Check whether an existing seed relied purely on the device’s own randomness. If it was not generated with at least 50 independent dice rolls or a strong passphrase, treat it as potentially exposed.
- Generate a new seed on the updated firmware and move funds to it, rather than assuming the update alone made an old seed safe.
- Move funds deliberately, verifying every receiving address on the device’s own screen, since the risk here is a weak seed rather than a live intrusion targeting one specific account.
None of this calls for panic. It calls for treating a software patch and a compromised seed as two separate problems, because a patch fixes the code, and only a new seed fixes a key that was already weakened. It is the same instinct behind zero-trust security design: do not assume a single fix, however good, covers everything downstream of it.
The takeaway
The Coldcard incident will likely be remembered as a bitcoin theft worth well over $100 million once the running tally settles. That figure matters less than what stays true regardless of the final count: a random number generator failure is not undone by a software update alone, because the numbers it already produced are still out there, embedded in seeds that do not change just because the code that generated them did. Any hardware wallet, from any manufacturer, could hide the same category of bug in a single line of configuration logic. The lesson is not to distrust hardware wallets. It is to know that when one of them patches a randomness bug, the patch protects what comes next, not what already exists.
Frequently asked questions
What is the Coldcard RNG flaw?
The Coldcard RNG flaw is a firmware bug in Coldcard hardware wallets where a misconfigured check let the device silently fall back to a predictable software-based number generator, Yasmarang, instead of its dedicated hardware randomness source. It weakened key generation on affected devices for roughly five years before its coordinated discovery in 2026.
Which Coldcard devices were affected by the RNG flaw?
Coldcard Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, Mk4 and Mk5 devices on firmware before 5.6.0 (or 6.6.0X on Edge builds), and Coldcard Q devices before 1.5.0Q (or 6.6.0QX on Edge builds) were all affected. Coinkite’s July 31, 2026 patch fixed the underlying issue across all three device lines.
Does updating Coldcard’s firmware fix a seed generated before the patch?
No. Updating Coldcard’s firmware stops new seeds from being generated with weak randomness, but it does not change a seed phrase that was already created on vulnerable firmware. Anyone relying solely on the device’s built-in generator before the patch needs to generate a new seed and move funds to it, not just update.
Who discovered the Coldcard RNG bug?
Block Engineering, a security research team, found the RNG flaw and coordinated its disclosure directly with Coinkite before the fix shipped. Separately, on-chain analysts at Galaxy Research identified the link between the weakened randomness and the wave of drained Coldcard wallets, a distinct role from finding the bug itself.
Is a Coldcard seed safe if it used dice rolls or a passphrase?
Yes. A Coldcard seed generated with at least 50 independent physical dice rolls added to the process, or protected by a strong, unique BIP-39 passphrase, was never dependent on the flawed hardware randomness alone and was not weakened by this bug. Owners without either safeguard should treat pre-patch seeds as potentially exposed.
