How the Coldcard Hack Happened
How a flaw in Coldcard’s code made five years of Bitcoin wallets guessable
1. Intro
This week, someone stole 1,367 Bitcoin, roughly $89 million, across 4,585 addresses.
Every victim owned a Coldcard, a hardware wallet marketed for people who take self-custody seriously. Offline devices with keys that were never shared. Nobody clicked the wrong link or entered passwords into the wrong form.
All their security procedures worked. Their Bitcoin is gone anyway.
It was something far simpler than a tampered device. One character in a line of code written in March 2021 sent wallet creation to the wrong random number generator. Every seed made on that firmware was guessable from the moment it existed.
So how did it happen?
2. The Lock
Unbreakable Codes
The Enigma machine was used by the Nazis in WWII to encrypt their military communications and was thought to be unbreakable as it had about 159 quintillion possible settings.
The machines were used until the end of the war and the number of settings never changed. What cracked it was Bletchley Park, Britain's wartime codebreaking centre, narrowing down how many of those settings were ever actually reachable.1
What Protects a Bitcoin Wallet
Every Bitcoin wallet begins with one random number, called the seed. Your twelve or twenty-four words are that number written down so you can copy it onto paper.
Every private key you own is then calculated from it. So the seed is not a key. It is the thing that stamps every key you will ever have.
The formula that does the stamping is a published standard, which means an attacker can run it too. There is no password to get wrong, no limit on attempts and they never have to touch your device. They can generate candidate numbers on their own computer and check each one against the public blockchain to see whether it produced an address holding money.
Bitcoin wallets aren’t like a safe. The coins are not inside the device. They sit on a public network that hands them to whoever presents the right number, from anywhere in the world.
So a Coldcard is not a vault holding your money. Coldcard is a vault holding a copy of the combination. Everything it does protects that copy:
The PIN and the secure chips stop someone using the device
The air gap stops anything reaching it over a network
The tamper protection stops someone opening it up to read the number out
Even when all of it works, none of these controls stops someone calculating the same number on their own computer and spending your Bitcoin before you notice.
Narrowing Combinations
A seed is supposed to have 2^128 possible values. Written out, that is a number with 39 digits.
Because of the way Coldcard generated them, Coinkite, the Canadian company that makes the device, now estimates the real figure at around a trillion on the older models.2
That may be a generous estimate. Block, who analysed the same code separately, arrived at a similar ceiling but think the true number could be far smaller, possibly as low as eighty thousand.
Either way the attack was the same. After figuring this out and narrowing the list down, the attacker was then able to cycle through the combinations until they found wallets worth stealing from. That is the whole attack. Nothing was broken into. The number was just far easier to guess than anyone believed.
Which raises the obvious question. Coldcard is built for exactly this problem, and it contains dedicated hardware to solve it. So why were its numbers guessable?
3. The Wrong Door
Unpredictable numbers are hard to produce with software. A computer following instructions does the same thing every time, so anything it calls random is really a formula dressed up to look unpredictable.
So serious hardware wallets contain a dedicated chip that makes them from physical noise. Voltage jitter, heat, things that cannot be predicted or replayed.
Coldcard has the noise circuit. Coinkite wrote their own code to read it.
But for five years, seed generation never called it.3
The one character that did it
Coldcard’s build settings contain this line:
The zero tells MicroPython, the software Coldcard runs on, to stay out of the way, because Coinkite is handling randomness themselves.
The crypto library then checked that a hardware generator was available
#ifndef asks whether a setting exists. It does not ask whether it is switched on.
The setting existed, set to zero. The check passed. The library wired itself to MicroPython, and MicroPython, seeing that zero, had already built its software backup instead of the hardware path.
Think of it like this:
A safety inspector checks that a fire alarm is listed in the building’s documents. It is. Tick.
Nobody checks whether the alarm has a battery in it.
The paperwork is perfect. The building still burns down.
What it fell back to
MicroPython’s backup is called Yasmarang. It is a small, fast generator of the kind you use to shuffle cards in a game. It starts once, from three ingredients, and then never takes in anything new:
The serial number stamped into the processor at the factory
A countdown timer that resets every millisecond
Two clock registers holding the time and the fraction of a second
Every number it produces after that is a fixed step from that starting point.
None of those three are secret. The serial number is factory metadata, and part of it appears in the device’s USB identifier. The countdown timer has at most 80,000 possible values on the Mk2 and Mk3, and 120,000 on the newer models. And on the Mk2 and Mk3 the clock is switched off at startup, which strongly suggests those two registers were sitting at zero.
That is where the trillion comes from. A trillion still sounds like a lot. But nowadays, a computer can get through a trillion candidate seeds in days.
There was a safeguard for exactly this. The output was combined with a second generator, so that if one turned out to be weak the other would cover it. That second generator started from three numbers written in plain text in the public source code: 0x0a8ce26f, 69, 233.
Combining sources only helps if at least one of them is genuinely unpredictable. Here, two predictable streams combined give you one predictable stream.
The fault shipped in v4.0.0 on 17 March 2021 and sat there for five years before it was noticed.
4. The Sweep
Finding the victims was easy.
Bitcoin addresses are public, and the broken generator produced a recognisable family of them. Candidate seeds could be rebuilt offline, turned into addresses, and checked against the ledger from a laptop.
By 30 July the attacker had a list. It was sorted by balance, largest first.
At around 1am UTC on a Thursday, thousands of people had Bitcoin sitting in wallets they had every reason to trust. Most of them were asleep.
Thats when the attacker struck.
The biggest loss came in the opening minutes, about $1.8 million from one wallet. Chainalysis found roughly $30 million was gone inside ten. The people with the most to lose had the least warning, because the attacker had studied the population before starting and worked down from the top.
Every transaction paid the same fee, exactly 30.0 sat/vB, against a median of under 1 sat/vB that week. Identical fees a thousand times is also the signature of a preloaded script rather than a person at a keyboard.
Forty-one minutes later it stopped. By the time anyone worked out what they were looking at, it was over.
Two more waves followed over the next two days. Galaxy Research mapped all three and says each wave was internally one operator. Wave three averaged 0.1 Bitcoin per victim, which suggests the profitable end of the key space has already been picked over.
Stats
Wave one: 1,082.65 BTC from 1,196 addresses, about $70.2 million
Duration: 41 minutes, blocks 960,183 to 960,191
Gone in the first 10 minutes: roughly $30 million
All three waves to date: 1,367 BTC from 4,585 addresses, about $89 million
Time before Coldcard’s public warning: ~30 hours
5. The Parts That Cannot Be Fixed
Every protection on the physical device did its job on 30 July. Nobody guessed a PIN and nothing was tampered with.
It made no difference. That leaves two problems that a better device can’t fix.
Nothing Can Block a Valid Signed Transaction
All 1,196 transfers were correctly formed and signed. As far as the Bitcoin network was concerned, the attacker was the owner.
Transaction policies and other approval workflows all sit between you and your own keys. None of them sit between a stranger and a copy of your key.
A Patch Cannot Undo It
Coinkite shipped corrected firmware within a day. It protects every seed made from that point on and repairs none of the ones already in the world.
You cannot un-know a number. Update the device and restore the same words, or move them into any other wallet, and the weakness travels with them. The only fix is a new seed and moving every Bitcoin across to it.
Which means the version on your device today tells you nothing. What matters is the firmware that was running on the day the seed was made. So you could have followed every rule on the list, bought what was marketed as the most careful device on the market, and still lost everything.
6. Conclusion
Three Times in Twelve Months
We have now watched this happen three times in twelve months. Coldcard, Coinspect’s Ill Bloom in July, and LuBian before them, where a mining pool’s keys came from a Unix timestamp and $3.5 billion vanished in two hours.
It’s the same sequence. A flaw sits quietly in the codebase for years while everyone using it feels safe. Someone patient maps it. Then it executes at machine speed, all at once, before anyone can convene a meeting.
If your defence stops working the moment the key is compromised, it’s not truly defence in depth. So the next layer cannot be another lock. It has to be the ability to react.
The Window Nobody Used
A Bitcoin transaction is not final the moment it is broadcast. It sits in the mempool, the queue of pending transactions, waiting for a miner to pick it up. On average that takes about ten minutes.
Which means the Bitcoin is not gone yet. In that window the owner can broadcast a competing transaction, spending the same coins to a safe address, and attach a higher fee. Miners chase the better fee, so the owner can win.
The attacker knew this. It is why every sweep paid 30.0 sat/vB against a median of under 1. They were trying to buy a place at the front of the queue before anyone could outbid them.
None of the funds were saved, because saving it meant a human spotting the anomaly at 1am, understanding it, believing it, locating their hardware wallet and getting a higher-fee transaction broadcast before the next block.
Ten minutes is enough time to win that race. It is nowhere near enough time to notice you are in one.
Thats where Circuit fits in.
Circuit holds pre-approved, pre-signed transactions ready to move funds to safety the moment keys are compromised. It monitors mempool transactions to spot anomalous activity and save funds without needing a human in the loop. It cannot stop your key being worked out. It can let your transaction be the one that reaches the miners first.
Circuit is backed by Lloyd’s of London and recognised by 10+ major insurers as an enterprise risk control that reduces premiums. If you are thinking about how to protect digital assets against key compromise, we’re here to talk.
Final Thought
Germany investigated Enigma more than once and concluded each time that the machine was sound. They were looking for a symptom, and a broken cipher does not produce one. It encrypts just as fast and the letters come out just as scrambled.
Coldcard’s owners had the same evidence for five years, everything seemingly working correctly. It also handed out a guessable number every time somebody set up a new wallet.
Working perfectly was never proof of anything.
Why did nobody found it sooner?
The code was public on GitHub the entire time. Anyone could have read it and exploited it before now.
Coinkite’s CEO Rodolfo Novak thinks someone finally pointed AI at it. His advice to other developers: “If your firmware is open-source or has ever been public, assume it’s already being read by attackers and defenders alike.”
He may well be right. You can now hand a model an entire repository and ask it one adversarial question that finds a bug. Several researchers reproduced this finding within hours of it becoming public.
Narrowing the search space for the Enigma machines took a national programme, purpose-built machines and years of work. Now narrowing the possibilities for attacks like this can take just a well directed prompt.
If you want to go deeper:
They narrowed it several ways. The machine could never encrypt a letter as itself, so any alignment where a guessed word sat above its own letters could be discarded instantly. They also had tells, guessable text such as weather reports that opened identically each morning, giving them known answers to test against. Operator habits helped further: repeated settings, rotor positions chosen as somebody's initials. They then mechanised the elimination rather than trying every combination.
Coinkite estimates roughly 40 bits of real randomness on the Mk2 and Mk3, and about 72 bits on the Mk4, Mk5 and Q, against the 128 intended. Forty bits is 1.1 trillion.
Block declines to give single figures, publishing conditional ceilings instead. For the Mk2 and Mk3 their ceiling is 1.8 trillion, which is independent agreement with Coinkite. Their floor is far lower. On those models the clock oscillator is disabled at startup, and the board file that switches off the hardware generator switches off the clock too. If those registers were sitting still, the space collapses to about 80,000 candidates. If an attacker could also determine the timing, Block put it at one.
Neither party has published a brute-force benchmark, and nobody has publicly reconstructed a victim’s seed. But 4,585 addresses were emptied, so somebody demonstrated it works. The exact cost is not public.
Credit to Block's Bitcoin engineering and security teams, who found the cause within hours and published while the attack was still running, and to Coinkite, who documented their own failure in public. Every code reference here comes from their work.
"holds pre-approved, pre-signed transactions" that's just yet another gigantic weak spot waiting to be raped and pillaged... if people simply gave self-custody of funds their attention in equal amounts to the size of the holdings, they wouldn't have lost their money. if you have 50 grand in a wallet and you didn't know that you should have rolled your own dice and added a very long passphrase on top, I mean, what the hell are you doing?