Nobody Hacked the Coldcard
On July 30, between 01:10 and 01:51 UTC, someone took 1,083 bitcoin from 1,196 wallets in 41 minutes. The wallets were Coldcards — hardware wallets, marketed as the coldest, safest storage in bitcoin. The attacker never touched a single device. The victims’ wallets could have been powered off in safes on three continents. It wouldn’t have mattered. (CoinDesk)
Three waves in, Galaxy Research puts the total at 1,367 bitcoin — nearly $89 million — from 4,585 addresses. The first wave averaged a full coin per victim; the latest, a tenth. The profitable end of that key space is picked over, but the draining hasn’t stopped.
Here’s the mechanism, because it’s the whole story. A Coldcard is supposed to draw each wallet’s seed from a dedicated hardware randomness generator. A March 2021 firmware build contained a setting that told it to skip that generator. The check in the supporting library tested whether the setting existed — not whether it was switched on. Key generation fell through to a software substitute, seeded from the chip’s serial number and its clock registers.
Serial numbers are fixed factory metadata. Clock values you can measure on a device of your own. The keyspace collapsed from “unguessable before the heat death of the universe” to, on the Mk4, Q, and Mk5, roughly four billion possibilities. On the Mk2 and Mk3, fully determined. Four billion is a big number to a person and a lunch break to a computer.
So the attacker generated candidate seeds on their own hardware, derived the addresses each one produces, and checked them against the public blockchain, which anyone can download. Every step ran on the attacker’s machine. The drained wallets spanned three address formats — nobody targets a specific victim across three formats at once. That’s systematic enumeration: a counting problem with the blockchain as the answer key.
Now the part that should make you uncomfortable. There is no test you can run against your own wallet to learn whether your seed sits inside the vulnerable range. Coinkite says the Mk3 is affected and newer models are fine; Block’s report puts the Mk2, Mk4, Q, and Mk5 in scope. The vendor and the researchers disagree about which devices are broken, and the owner cannot check either way. If you generated a seed on the affected firmware, the only move is to assume the worst and move your coins — which, given the last few paragraphs, you now have to think about differently.
The objections, because there are good ones.
First: “One vendor’s bug. Hardware wallets are still the safest way to self-custody.” True — and I’m not arguing for exchanges; custodians lost billions last cycle. But the answer to bad randomness isn’t “give your keys to a company.” It’s that offline was never the same thing as random. The air gap protected the key from being stolen. Nothing protected the dice from being loaded.
Second: “This class of bug is ancient and rare.” It is ancient — that’s the point. Debian’s OpenSSL shipped predictable keys in 2008 because a comment stripped entropy from the pool. Android’s SecureRandom did it again in 2013. Now a hardware wallet did it in 2021 and sat on it for five years before someone ran the numbers. Entropy is the hardest thing to get right in all of security, it fails the same way every time, and it fails silently. No crash, no error. Just keys that look random and aren’t.
Third: “$89 million is a rounding error in a market this size.” Sure. But watch the mechanism, not the number. This is the first time a “cold” wallet class got drained at scale with zero contact with the devices. The box was never the attack surface — the keyspace was. The next entropy bug won’t be in Coldcard, and nobody gets to find out by reading a headline.
The safe was fine. The lock was fine. The combination was the serial number. Cold storage kept the key inside the box — but the secret was never in the box. It was in the dice, and the dice had been loaded since March 2021. If you’re holding a hardware wallet, the question isn’t whether the silicon is secure. It’s whether the randomness that made your key is still a secret. The box won’t tell you. Nobody can — until the money moves.
Sources: CoinDesk — How bitcoin cold wallets lost $70M in an attack that never touched the devices, CoinDesk — Attack spreads to 4,500 addresses as losses near $89M, Techmeme roundup, Slashdot