Five-Year-Old Coldcard Firmware Bug Drains $116 Million from Bitcoin Wallets

A five-year-old vulnerability in Coldcard's firmware drained $116 million from Bitcoin wallets. The bug, which was introduced in March 2021, allowed an attacker to guess weak seeds and drain funds from over 5,200 addresses across four attack waves.

The vulnerability was caused by a single line of code that routed seed generation to a deterministic software pseudorandom number generator instead of the device's hardware random number generator. This reduced effective entropy from 128 bits to approximately 40 bits on Mk3 devices and 72 bits on Mk4, Mk5, and Q models.

The attacker began sweeping wallets on July 30, 2026, draining 1,082 BTC from 1,196 addresses in 41 minutes during the first wave. Galaxy Research estimated that total confirmed losses could reach $130 million if a suspected fourth wave is verified.

Coldcard released emergency firmware on July 31 to address the issue, but updating does not repair seeds already generated on vulnerable firmware. This means every affected user must generate a new seed and manually migrate funds to survive.