Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
Coldcard firmware flaw tied to $70.2M Bitcoin theft of 1,082.65 BTC in 41 minutes on July 30.
An attacker drained 1,196 Bitcoin addresses of 1,082.65 BTC ($70.2M) in 41 minutes on July 30, 2026, exploiting a March 2021 firmware integration error in Coldcard hardware wallets. The flaw routed seed generation to a weak software PRNG instead of the hardware RNG, reducing entropy to ~40 bits (Mk3) or ~72 bits (Mk4/Mk5/Q) versus the required 128 bits. Coinkite released emergency firmware patches on July 31, but users with exposed seeds must generate new ones and move their coins, as patched firmware cannot repair an existing compromised seed.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Coinkite?
Get an email when a new story names Coinkite, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA firmware integration error introduced in March 2021 caused Coldcard hardware wallets to route seed generation through a weak software pseudorandom number generator (PRNG) instead of the dedicated hardware RNG, reducing cryptographic entropy from the required 128 bits down to as low as 40 bits. This drastically lowered the brute-force complexity of attacking wallet seeds, enabling an attacker to compromise 1,196 addresses and drain over $70 million in Bitcoin in just 41 minutes. The flaw went undetected for over five years, illustrating how a single misconfiguration in a cryptographic pipeline can silently undermine all downstream security guarantees. Critically, even after emergency patches were released, any wallet seed generated during the vulnerable firmware period remains permanently compromised — patching the software cannot retroactively strengthen entropy that was never there.
What helps against this
How we list vendors- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Coldcard firmware flaw (PRNG entropy weakness)