Coldcard’s RNG flaw is still draining wallets, and an AI audit just found 85 more critical bugs across Bitcoin

A five-year firmware error turned Coldcard into the largest known Bitcoin seed-theft, while AI-assisted analysis of the broader ecosystem is surfacing how systematically the industry has underestimated the same class of vulnerability.

On July 30, 2026, a coordinated sweep removed more than 1,082 Bitcoin from 1,196 hardware wallets in approximately 41 minutes. No device was stolen. No PIN was guessed. The Bitcoin protocol was untouched. The attackers worked from a laptop and an offline seed-reconstruction tool, because a firmware error introduced five years earlier had made the seeds of certain Coldcard models predictable enough to reconstruct without handling the hardware. By August 3, Galaxy Research had confirmed 1,596 BTC stolen from about 7,300 addresses, with a suspected fourth wave potentially pushing losses to approximately 2,055 BTC, close to $130 million. As investigators distributed flagged addresses to law enforcement and exchanges, a parallel wave of AI-powered security analysis swept other Bitcoin wallet codebases and surfaced entropy handling failures that conventional review had missed, suggesting Coldcard is the most visible instance of a far wider problem.

What went wrong inside the firmware

The vulnerability traces to a single macro-check error introduced during a March 2021 Coldcard firmware migration. Coinkite, the Canadian hardware wallet manufacturer, was integrating a new cryptographic library called libngu as part of a broader codebase update. During that integration, an incorrect conditional check caused wallet seed generation to bind to a software pseudo-random number generator called Yasmarang, built into the MicroPython embedded Python runtime, instead of the STM32 hardware true random number generator the device contains.

The production board configuration for every affected Coldcard model sets the macro MICROPY_HW_ENABLE_RNG to zero, because Coldcard provides its own separate hardware RNG wrapper. Libngu checks for this macro using a #ifndef conditional, which tests only whether the macro is defined in the build environment, not whether its value is nonzero. Because the macro was defined with a value of zero instead of absent entirely, libngu treated the hardware source as available and silently bound the seed-generation function to MicroPython’s deterministic Yasmarang generator. That generator produces output seeded from the microcontroller’s unique identifier and timer registers at boot, neither of which provides cryptographic randomness.

The hardware RNG continued running in other firmware functions throughout the entire affected period. Internal code reviews at Coinkite could confirm the generator was present, accessible, and called in the firmware without detecting that wallet seed creation had quietly redirected to the weaker source. Coinkite said in its technical postmortem that it had no knowledge the MicroPython fallback existed in that code path until the post-incident investigation, a detail that underscores how a single incorrect boolean check can survive years of review precisely because the intended component is visible and functional everywhere else.

Block’s Bitcoin engineering and security team independently identified the same error. The team traced the #ifndef macro check, confirmed the Yasmarang binding, and published a technical disclosure stating that the affected firmware called the deterministic fallback instead of the STM32 hardware source during seed creation. Block said it had not completed full empirical testing of exploitability but decided early disclosure was appropriate because active theft reports had already emerged.

The impact on entropy differed by device. Seeds generated on Mk2 and Mk3 devices running affected firmware versions from 4.0.0 through 4.1.9 contain roughly 40 bits of effective entropy, with no cryptographically generated input added to the random number generator output at all. Mk4, Mk5, and Q devices receive a small contribution from a secure element at boot, but libngu hashes and truncates that input to four bytes before using it to reseed only a single 32-bit word of the Yasmarang state. The result is approximately 72 bits of effective entropy rather than the intended 128, an exposure roughly 72 quadrillion times weaker than the intended design.

How attackers reconstructed wallets without physical access

A seed phrase is computationally infeasible to guess when it draws from 128 bits of uniform randomness. A seed drawing from 40 bits of entropy occupies roughly one trillion possible values. An attacker who can constrain the Yasmarang seed further, using publicly available information about the MCU unique identifier and typical boot timing for a given device model, reduces that space to something modern hardware can traverse.

Bitcoin addresses derived from any seed are publicly visible on the blockchain. An attacker who understands the Coldcard firmware flaw can enumerate the Yasmarang output sequences possible for a target device family, derive the Bitcoin addresses that each candidate seed would produce, and compare every derived address against the full public blockchain. Any match reveals a wallet whose private keys the attacker can recreate offline and use to authorize a transfer without touching the original hardware, knowing the device PIN, or interacting with the Bitcoin network in any way that would look unusual until the moment the transfer itself is broadcast.

The attack requires no cooperation from the victim, no network access to the victim’s device, and no vulnerability in the Bitcoin protocol. It is a consequence of the seed being drawn from a statistically small number of possible values instead of the 2^128 possibilities the device is designed to provide.

Block noted in its disclosure that practical exploitation cost depends on available MCU identifier information, boot timing, and prior RNG call history, and that no end-to-end brute-force benchmark has been published for any affected model.

Four attack waves and a $130 million toll

Galaxy Research has tracked four suspected waves of theft activity since July 30, combining on-chain data, victim reports, and coordination with law enforcement, exchanges, and blockchain analytics companies.

The first wave struck July 30 and removed 1,082.65 BTC from 1,196 addresses over approximately 41 minutes. Two subsequent waves targeted additional wallets exhibiting the same address profile. Galaxy confirmed those three waves, along with 14 smaller linked incidents, as responsible for the theft of 1,596 BTC from about 7,300 addresses. Galaxy head of research Alex Thorn identified a suspected fourth wave on August 3 after observing transaction patterns matching the earlier attacks, with his running estimate settling at 448.7 BTC moved from 709 additional addresses. The sweep rate during the most active period reached 13.8 wallet drains per Bitcoin block, compared with a baseline of 0.3 per block during a pre-incident control window, a pace roughly 45 times above normal. Galaxy’s confirmed estimate and fourth-wave analysis placed possible total losses at approximately 2,055 BTC.

The firm has stressed that its figures come from on-chain analysis and verified victim reports, not Coinkite’s own device records, and that blockchain data alone cannot determine whether a single actor carried out every wave. The firm identified at least 15 distinct attackers across all observed waves.

The largest single theft involved 1,159 BTC removed across seven addresses in one coordinated sweep. As of August 5, all of those funds remained unmoved and had not entered mixers or cash-out services. A separate, smaller attacker had begun attempting to launder stolen funds, routing 64 BTC toward a mixer, with approximately 10 BTC mixed during the first pass and the remainder split into outputs of roughly 7 BTC each for further rounds.

Chainalysis found that Canadian Bitcoin holders account for about 25% of attributable losses. Galaxy has distributed roughly 600 flagged attacker and victim addresses to U.S. federal law enforcement and exchanges to support monitoring. Around 90% of stolen Bitcoin has not moved, giving compliance teams time to flag destinations before funds reach cash-out services, though Galaxy has warned that new attackers may still be targeting unpatched wallets.

Why the flaw survived five years of review

The macro-check error remained undetected for more than five years because of how hardware wallet firmware is typically reviewed.

Standard security assessments verify that the correct entropy source is present in the codebase, accessible from the right modules, and referenced in the seed-generation logic. Auditors confirm presence at the source level without tracing every conditional compilation path to its binary outcome to verify which function the code actually calls at runtime. In the Coldcard case, the STM32 hardware RNG was present, accessible, and actively called in multiple other firmware functions. The only code path where it was silently replaced was wallet seed creation, and the replacement was invisible to source-level review because the incorrect #ifndef check behaved unexpectedly at compilation.

Kraken chief security officer Nick Percoco argued after the incident that this pattern exposes a structural gap in hardware wallet certification. Existing frameworks, including Common Criteria evaluations, CSPN reviews, and vendor-commissioned audits, check physical security, secure element integrity, protocol implementation, and cryptographic library correctness. None of those frameworks systematically verify that production firmware at the moment of wallet creation actually calls the approved source of entropy rather than a fallback.

“Production firmware should undergo independent testing to confirm that the approved source of randomness is the one actually used,” Percoco said.

He cited NIST SP 800-90B, the United States standard for true random number generator testing and validation, and Germany’s BSI AIS-31 as existing frameworks that model what end-to-end entropy verification looks like in other regulated domains. He compared the hardware wallet certification gap with PIN entry device standards, where independent laboratory testing is mandatory before products can ship, and with U.S. government cryptographic module approvals, where entropy source validation is part of the FIPS 140 process. No equivalent independent check currently covers hardware wallet seed generation.

AI-driven audits surface a wider pattern

The Coldcard disclosure prompted security researchers to apply automated analysis methods to Bitcoin wallet firmware, embedded cryptographic libraries, and shared software components used across multiple wallet implementations. The goal was to determine whether the same class of error, specifically entropy source misdirection that survives source-level review because it only manifests at compilation or runtime, existed elsewhere in the Bitcoin custody ecosystem.

AI-assisted static analysis addresses this problem differently from manual review. A model trained on cryptographic vulnerability patterns can simulate compilation conditionals, trace every call binding that reaches a seed-generation or key-derivation function, and flag any path where the intended entropy source is overridden, replaced, or weakened under a specific build configuration. A human reviewer reading source code sees an entropy source called; an automated tool traces what that call actually resolves to in the compiled binary under each possible macro or configuration state.

Applied systematically across Bitcoin wallet firmware and shared cryptographic libraries in the weeks following the Coldcard disclosure, this approach identified 85 critical-severity findings across multiple wallet implementations and supporting libraries. The issues include incorrect fallback bindings similar to the Coldcard macro-check error, insufficient reseed entropy that leaves a weak software generator state only partially overwritten by hardware input, and conditional compilation paths that produce substantially weaker randomness under specific device configurations while passing standard source-level code review.

Coordinated vendor disclosure processes are underway for affected implementations, and the full set of findings is being released on timelines aligned with remediation schedules. Not all 85 findings have been made public as of August 7, 2026. The scale and distribution of the findings extend the concern Percoco raised about Coldcard into a much broader context. If a single incorrect boolean check in one vendor’s library could redirect entropy without detection for five years, the AI audit is providing an early answer to how common that class of oversight may be across the broader ecosystem.

Coinkite’s response and what remains unresolved

Coinkite disclosed the vulnerability publicly after its internal investigation and after Block’s independent disclosure confirmed the findings. The company released corrected firmware for every affected model: version 4.2.0 for Mk2 and Mk3, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for the Q model, and Edge versions 6.6.0X and 6.6.0QX for Mk4 and Q respectively on the Edge release track.

Coinkite halted all outbound shipments after confirming the vulnerability and said it destroyed every device containing affected firmware that remained in its facilities. The company advised affected users to retain their old hardware rather than discarding it, because original devices may become relevant if stolen funds are eventually recovered through legal proceedings. Coinkite’s legal team is coordinating with law enforcement agencies across multiple jurisdictions.

The most critical limitation of the firmware update is that it does not repair any seed generated under affected firmware. The vulnerability is in the seed-creation process, not in the device’s ongoing operation. A new seed generated on corrected firmware is safe. An old seed generated under affected firmware is permanently weakened regardless of what firmware version the device subsequently runs. Migrating to corrected firmware without also generating a new seed leaves the underlying wallet exposed to the same offline brute-force attack.

Coinkite’s advisory notes one exception: users who added at least 50 fair, independent, private dice rolls when originally generating their seed may have supplemented the weak firmware entropy enough that their specific seed is not at risk from this flaw. A strong, unique BIP-39 passphrase reduces immediate exposure but does not repair the underlying seed. Seeds exported from a Coldcard to any other wallet remain affected regardless of where they are stored.

The custody debate the hack reignited

The Coldcard incident has reopened a recurring argument about self-custody versus managed exchange storage. The 2022 FTX collapse moved a substantial share of Bitcoin from exchange accounts into hardware wallets, with self-custody positioned as the default defense against counterparty risk. The Coldcard flaw is now running the same flow in the opposite direction.

OKX chief compliance officer Jonathan Brockmeier said the exchange has seen record inflows since the Coldcard attacks began. He described the shift as “the flip side of FTX.” OKX reported preventing $26.3 million in scam-related losses in the first half of 2026 and protecting more than $1.1 billion in customer assets during the same period, citing AI-driven monitoring of blockchain activity and account behavior as core components of its security architecture.

K33 Research reported that nearly 890,000 BTC moved on-chain in the seven days following the initial attacks, the highest seven-day active supply figure recorded in 2026. Bitcoin’s 30-day high-to-low trading range during the same period was the narrowest since 2023, with realized volatility falling below that of the Nasdaq 100, meaning the Coldcard-driven spike in on-chain activity occurred against a backdrop of unusually calm price action. K33 head of research Vetle Lunde attributed the spike to Coldcard-related address migrations and noted that similar surges in on-chain activity have historically appeared near market turning points.

Ripple CTO Emeritus David Schwartz compared Coldcard losses with the 2011 MF Global collapse and pointed to a structural difference: regulated financial institutions offer insurance and bankruptcy recovery mechanisms, while Coldcard users whose Bitcoin was drained through reconstructed seeds have no comparable safety net. Recovery depends on whether law enforcement can trace and reclaim the Bitcoin through coordinated exchange and legal action.

What to watch

– New attack waves. Galaxy has warned that additional attackers may still target unpatched wallets. Sweep rates above 1.0 wallet drain per Bitcoin block should be treated as a signal of active exploitation.

– Mixing and laundering acceleration. A separate attacker had begun mixing 64 BTC as of August 5. Movement from the larger 1,159 BTC cluster toward mixers or cross-chain services will narrow the investigative window significantly.

– Fourth-wave confirmation. Galaxy has not yet confirmed 448.7 BTC in a suspected fourth wave. Victim reports validating those losses would push the confirmed total to approximately 2,055 BTC and expand regulatory coordination.

– Hardware wallet certification reform. Percoco’s call for mandatory independent entropy testing now has a documented failure to anchor it. Watch for proposals from NIST, BSI, or hardware wallet industry bodies to incorporate end-to-end RNG validation into certification.

– Coordinated AI audit disclosures. Vendors are remediating the 85 critical findings on rolling timelines. Each public disclosure will clarify which wallet implementations beyond Coldcard carry entropy handling weaknesses.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. All information is provided as general context and should not be relied upon as the basis for any investment or custody decision. Cryptocurrency assets carry significant risk, including total loss of principal. Readers should verify all information independently and consult qualified professional advisors before taking action based on the contents of this article. August 7, 2026.