In this article
- TL;DR
- First, what a seed phrase actually is
- Entropy, in plain terms
- True randomness versus a formula pretending to be random
- The exact Coldcard entropy bug
- Who got swept, and who did not
- What is confirmed and what is not
- The part that should worry every open-source project
- What to do right now
- Swiss holders, a note on tax
- The self-custody argument this reopened
- Where the CLARITY Act fits, and where it does not
- Bottom line
- Related reading
Your hardware wallet is only as strong as the randomness inside it. Coldcard just proved it.
On 30 July 2026, around 594 BTC left roughly 500 Bitcoin addresses in about 25 minutes. Worth near 38 million dollars. The wallets shared one trait: seeds generated on an older Coldcard.
These were not careless people. Many held coins untouched since 2021, on the hardware wallet the security-obsessed corner of Bitcoin recommends. They did offline key generation, the thing everyone tells you to do. And they still got swept.
This is a deep-dive on what broke, in plain terms, even if you have never generated a seed phrase. I will separate what is confirmed from what is still disputed, because both matter and the crowd keeps blurring them.
TL;DR
A software change shipped in Coldcard firmware 4.0.0 (March 2021) made the device skip its true hardware random number generator and fall back to a predictable software one, seeded by data that is not secret. Seeds that were supposed to carry 128 bits of randomness carried roughly 40 bits on Mk3 and about 72 bits on Mk4, Mk5, and Q. Forty bits is guessable. An attacker regenerated affected seeds and swept about 594 BTC from ~500 single-signature wallets in one coordinated burst. Anyone who added a BIP-39 passphrase or ~50-plus private dice rolls was protected. Coinkite confirms the entropy flaw and has patched it, but has not officially confirmed it caused this exact theft. If you generated a seed on affected firmware, migrate now.
First, what a seed phrase actually is
Skip this if you already know. If you do not, the rest will not land without it.
When you set up a Bitcoin wallet, the device generates a secret number. A very large random number. It then encodes that number as 12 or 24 ordinary English words, the "seed phrase." Those words are not a backup of your Bitcoin. They are your Bitcoin. Whoever holds them controls every coin the wallet has ever received. No reset, no support line, no reversal.
The whole security model rests on one assumption: that the secret number is genuinely random, so nobody else can ever produce the same one. That assumption is what Coldcard broke.
Entropy, in plain terms
Entropy is a fancy word for "how much real randomness is in that secret number," measured in bits.
Each bit doubles the number of possible seeds. So the math runs away fast:
| Entropy | Possible seeds | Can it be guessed |
|---|---|---|
| 128 bits | 2^128 (~3.4 × 10^38) | No. More combinations than atoms in the visible universe |
| 72 bits | 2^72 (~4.7 × 10^21) | Only by a well-funded attacker with a serious cluster |
| 40 bits | 2^40 (~1.1 × 10^12) | Yes. One GPU in days, a small farm in minutes |
A correct 12-word seed carries 128 bits. Every computer on Earth working together could not grind through 2^128 before the sun burns out. That is the number that makes self-custody safe.
Drop it to 40 bits and the same wall becomes a speed bump. 1.1 trillion guesses sounds huge to a human. To a graphics card checking billions of candidates, it is an afternoon. That is the entire story in one sentence: "impossible to guess" quietly became "cheap to guess."
True randomness versus a formula pretending to be random
Hardware wallets are supposed to use a TRNG, a true random number generator. It is a physical circuit that harvests randomness from electrical noise, genuinely unpredictable, the good stuff.
The fallback when a TRNG is missing or misused is a PRNG, a pseudo-random number generator. A PRNG is just a formula. Feed it a starting value (the "seed" of the generator) and it spits out numbers that look random but are fully determined by that starting value. Same input, same output, every time.
Here is the trap. If the PRNG's starting value is something an attacker can learn or guess, the attacker can run the same formula and reproduce your "random" number exactly. Coldcard's fallback was seeded by chip data that is not secret. So the randomness was theater. The attacker did not have to guess 2^128 seeds. They had to guess a much smaller set, then regenerate the outputs.
The exact Coldcard entropy bug
The flaw entered in firmware 4.0.0, March 2021, and sat in the open-source code for over five years. A firmware defect quietly weakening security for years is not new. The CVE-2023-50428 wallet flaw is another case where a design assumption held until someone weaponized it.
Coinkite's advisory describes the mechanism around its dice feature: "COLDCARD hashed the device-generated seed together with every dice roll entered through Add Dice Rolls." The device-generated half of that mix is the part that failed. Instead of drawing from the hardware TRNG, affected firmware fell back to predictable software randomness seeded by non-secret chip data. Block's engineers, analyzing it independently, tied the weakness to values as guessable as serial numbers. One developer reported that he could reconstruct his own seed by counting his button presses during setup. Life savings protected by keypress timing, not by a hardware randomness chip.
The damage by model, per the advisory:
- Mk3, firmware 4.0.1 to 4.1.9: the worst hit. Independent analysis pegs effective entropy near 40 bits.
- Mk4 and Mk5, seeds before standard 5.6.0 (or Edge 6.6.0X): about 72 bits instead of 128.
- Q, seeds before 1.5.0Q (or Edge 6.6.0QX): about 72 bits.
A crucial detail most people miss: a weak seed stays weak forever. Restore it onto a Trezor, a Ledger, a Sparrow hot wallet, anything, and it is still the same guessable number. Trezor confirmed its own devices were never affected while making exactly this point to its users. The weakness lives in the seed, not the box you plug it into later.
Who got swept, and who did not
The on-chain fingerprint is brutally clean. AnchorWatch CEO Rob Hamilton identified 1,324 UTXOs swept across the affected addresses and noted "at first glance, it appears there was faulty entropy in wallet generation somewhere along the path." Around 562 BTC was consolidated into a single address. Kevin Loaec of Wizardsardine was among the first to raise the alarm publicly. Security engineer Clay Garrett later flagged 695 earlier transactions matching the same pattern, so the true scope may still be growing. Some community analysts estimate an additional several hundred BTC was drained the same way earlier without anyone connecting the dots, which would push the total past 1,000 BTC. Treat that larger figure as unconfirmed until a formal forensic review lands.
Every drained address was single-signature. No multisig. No Taproot. Mostly legacy addresses, mostly dormant since 2021. These were long-term holders who set up once, walked away, and never revisited their setup.
Two groups came through untouched:
Passphrase users, if the passphrase was strong. Read the updated advisory carefully here, because it walked back its own first wording. A strong, unique BIP-39 passphrase "adds an independent barrier," but "a short, common, patterned, quoted, or reused passphrase may be guessable and should not be assumed to provide minimal risk." The passphrase, sometimes called the 25th word, is an extra secret you supply that the device never stores and never generates. It derives a completely different wallet, so an attacker who reconstructs your weak seed lands on an empty decoy. It survives the entropy failure because the broken component never touched it. Weak passphrase, weak protection. Coinkite still says migrate even if yours was strong.
Dice users. Coldcard lets you add your own randomness by rolling physical dice. Each six-sided roll contributes about 2.58 bits. Coinkite says users who entered "50 to 98 independent, private rolls" got at least 128 bits from the dice alone, which swamped the weak device randomness and rescued the seed. That is the difference between an afternoon of grinding and the heat death of the sun.
If you know your PIN but never set a passphrase, you are the exposed group. Most Mk3 owners are in exactly that spot.
What is confirmed and what is not
This part gets misreported, so read it slowly.
Confirmed: the entropy flaw is real, it is in the firmware ranges above, and Coinkite has shipped fixed firmware. The passphrase and dice protections are real.
Not confirmed: that this specific 594 BTC theft was caused by the entropy flaw. NVK, Coinkite's founder, publicly rejected the idea of a device-wide cryptographic breach and described the sweep as hitting compromised or weak seeds across keys from different wallets. Coinkite's advisory is explicitly precautionary. A separate vector is also live: fake Sparrow Wallet apps were reportedly circulating on the Apple App Store in the prior weeks, and that has not been ruled out.
As of 1 August 2026, the entropy bug and the theft point at the same victims through the same on-chain signature, but Coinkite has not published the forensic post-mortem that would prove causation. The action you take does not depend on that proof. A passphrase-free seed off affected firmware is worth moving either way.
The part that should worry every open-source project
Coinkite believes it has to assume "someone used AI to review previous versions of our firmware" to find the flaw. Their own AI-assisted review of the same code, weeks earlier, found nothing.
Sit with that. Open-source firmware is a genuine strength, more eyes, no hidden backdoors. But it also means any attacker with a capable model and patience can replay years of commit history hunting for a subtle randomness mistake, faster than a human team ever could. "Open source plus periodic review" was the assumed safety floor for a lot of Bitcoin tooling. This is the first high-value case where an attacker's audit apparently beat the defender's on identical code.
What to do right now
If you have ever generated a seed on affected firmware, work through this in order.
- Update the Coldcard firmware first. Mk3 to version 4.2.0 or later, Mk4/Mk5 to standard 5.6.0 (or Edge 6.6.0X), Q to 1.5.0Q (or Edge 6.6.0QX). A corrected Mk3 can generate a safe replacement seed on its own, so you do not need to buy a newer device. Updating never repairs the old seed, it only fixes new generation.
- Add a strong, unique BIP-39 passphrase and move funds to that wallet immediately. This buys you safety while you prepare a clean migration. The passphrase is not your PIN. The PIN unlocks the device. The passphrase derives a different wallet the attacker cannot reach.
- Generate a brand-new seed on updated firmware and migrate to it. Even with a passphrase, do this as soon as practical. Record and verify the backup before depositing, following the step-by-step wallet recovery guide if you need the exact restore flow.
- If you migrate with dice, use at least 99 independent private rolls. That gives you full 256-bit entropy from your own hand, not the device.
- Never reuse the old seed anywhere. It is permanently burned. Restoring it on a different brand does not fix it.
- Ignore anyone who DMs you offering help. Fake support and fake "wallet recovery" accounts swarm every incident like this. No legitimate company will DM you first or ask for your seed, passphrase, or dice rolls. Ever. The chapter on spotting scams hacks and common mistakes covers the playbook these accounts run.
For the mechanics of choosing a device and testing recovery before you deposit, see Wallets Staying Secure and the cold storage setup guide. For why brute force is normally hopeless, and why weak entropy is the exception that makes it trivial, see brute forcing BIP-39 seeds.
Swiss holders, a note on tax
Moving your coins from the old seed to a fresh one is not a sale. It is not a taxable disposal. Switzerland does not tax private capital gains on Bitcoin, and your stack is declared at its 31 December value for Vermögenssteuer regardless of which seed holds it. So there is no tax reason to hesitate on a migration, only the operational care of doing it right. If you are unsure how the move interacts with your cantonal filing, ask your Steuerverwaltung or a Swiss-licensed advisor before year-end. Background in declaring Bitcoin on your Swiss taxes.
The self-custody argument this reopened
The incident became ammunition within hours. Guy Swann called it "the worst hit in bitcoin history to the most knowledgeable and 'properly secured' bitcoiners." That sting is real, because the victims followed the standard playbook.
The custodial camp pounced. Lorenzo Valente of ARK Invest argued holders "have traded counterparty risk for software risk, hardware risk, supply-chain risk, phishing risk, backup risk," and suggested people are "better off today holding funds across several publicly-traded exchanges or ETFs." David Lawrence of Amicus went further: "This is hugely damaging to the people who believe that 8 billion people will hold their Bitcoin in cold storage in the future. That dream is over. Done." Casa CEO Nick Neuman conceded the usability problem plainly: "You just can't ask people to roll dice to be secure with your self custody. It's a non-starter for 99% of people."
They are half right. Pure single-signature self-custody does carry real, non-obvious risks, and this proved it. But the fix was in reach of every victim and cost nothing: a passphrase, or dice, or multisig where a single vendor's bug cannot drain you alone. None of the swept wallets used multisig. That is not a coincidence, it is the whole argument for it. The answer to "one device failed" is not "hand your keys to an exchange," it is "stop relying on one device." That is Bitcoin self-custody done right, and the real tradeoff against custodial products is laid out in self-custody versus ETFs.
Where the CLARITY Act fits, and where it does not
The timing put a policy spotlight on the story. The CLARITY Act (H.R. 3633, the Digital Asset Market Clarity Act of 2025) is the US market-structure bill that splits oversight between the SEC and CFTC and protects the legal right of individuals to self-custody their own digital assets and transact peer-to-peer. As of mid-2026 it is pending Senate floor action.
Coldcard is exactly the kind of self-hosted wallet that language is written to protect. But be precise about what the bill does not do. CLARITY does not set entropy standards, mandate firmware audits, or regulate the technical quality of any hardware wallet. It secures your right to hold your own keys. It says nothing about whether the randomness inside your device is any good. A firmware bug of this kind sits entirely outside its scope.
So the two intersect only in the debate they feed: how much of self-custody's risk should be left to open-source scrutiny and user diligence, and how much, if any, belongs in law. The hack did not stem from the bill, and the bill would not have prevented it. Anyone pairing them as cause and effect is selling a narrative.
Bottom line
Bitcoin did not break. BIP-39 did not break. A single vendor's firmware silently starved its own randomness for five years, and the holders who trusted it most paid for it.
The cryptography was never the weak point. 128 bits is a wall no one climbs. The failure was a device quietly handing out 40-bit numbers while displaying the same confident setup screen. The people who added one independent secret the device could not generate, a passphrase or their own dice, walked away whole.
If your seed came off an affected Coldcard, the move is not to panic and not to run to a custodian. Update, add a passphrase, migrate to a fresh seed, and never reuse the old one. Self-custody survives this. Naive self-custody does not.
News and analysis, not financial, investment, legal, or tax advice. Figures, quotes, and firmware versions are drawn from Coinkite's official advisory and named primary sources as of 1 August 2026, and the causal link between the entropy flaw and the 594 BTC theft was not officially confirmed at the time of writing. Firmware details and the forensic picture may change. Verify your device's status against Coinkite's live advisory before acting, and consult a Swiss-licensed advisor or FINMA-supervised custodian before moving material capital.
Sources:
- Coinkite COLDCARD Mk3 seed generation advisory
- TFTC: Coinkite issues Mk3 warning after 594 BTC swept
- CoinDesk: Coldcard exploit reignites the self-custody debate
- CoinDesk: 594 BTC drained in 25-minute sweep
- CryptoBriefing: Coinkite reports $38M drained via key generation flaw
- H.R. 3633, Digital Asset Market Clarity Act of 2025 (congress.gov)
Related reading
- Brute forcing Bitcoin BIP-39 seed phrases
- Bitcoin cold storage setup for 2026
- Step-by-step Bitcoin wallet recovery
- Bitcoin self-custody explained
New to Bitcoin? Start with Chapter 1. It takes 8 minutes.
Want the full picture? Read all chapters free or order the physical book.
