On July 31, 2026, attackers drained 594 BTC — about $38 million — from roughly 500 Coldcard hardware wallets in 25 minutes. They never touched a single device. A firmware bug introduced in March 2021 had quietly replaced true hardware randomness with predictable software-based key generation, and five years later someone noticed. This guide explains the concept at the center of that failure — entropy — and gives you a practical framework for making sure your own bitcoin seed doesn't share the weakness. (Full incident coverage is in our news report; this is the how-it-works and what-to-do companion.)
What entropy is — and why 128 bits is the whole ballgame
A Bitcoin private key is just a very large random number. Its security rests entirely on unpredictability: a standard 12-word seed phrase encodes 128 bits of entropy, meaning an attacker must search on the order of 2128 possibilities — a number so large that all the computers on Earth working together could not meaningfully dent it. Nobody 'cracks' a properly generated seed. Every real-world seed theft exploits a shortcut: malware, phishing, a photographed backup, or — as in the Coldcard case — a generation process that was never as random as advertised.
The Coldcard flaw cut effective entropy from 128 bits to roughly 72 bits, per NewsBTC's reporting on the incident. That sounds like a modest haircut; it is not. Each lost bit halves the search space, so 56 lost bits shrink it by a factor of about 72 quadrillion. A 72-bit search is expensive but tractable for a motivated, well-resourced attacker — especially when thousands of target wallets share the same weakness and the reward is measured in the tens of millions of dollars.
| Entropy | Search space | Practical meaning |
|---|---|---|
| 128 bits (BIP-39 standard, 12 words) | ~3.4 × 1038 | Unbreakable by brute force with any foreseeable technology |
| ~72 bits (flawed Coldcard fallback) | ~4.7 × 1021 | Costly but feasible for well-resourced attackers; broken in bulk in 2026 |
| ≤40 bits (human-chosen "brainwallets") | ~1012 | Swept by hobbyist hardware within minutes of funding |
How a hardware wallet is supposed to generate your seed
Quality hardware wallets derive your seed by mixing multiple independent randomness sources: a dedicated hardware true random number generator (TRNG) that samples physical noise, entropy from a secure element chip, and sometimes user-supplied input such as dice rolls. The sources are combined so that even if one fails or is backdoored, the result stays unpredictable. What failed at Coldcard was the plumbing around this design: per the joint analysis by Coinkite and Block's engineers, a broken check in firmware 4.0.0 caused affected devices to skip the hardware TRNG entirely and fall back to software-based generation seeded by non-secret chip data — values an attacker could enumerate. The architecture was sound; a regression silently disabled it, and nothing alerted the user.
That last part is the real lesson. A user holding a compromised Coldcard did everything right — bought a reputable device, generated the seed offline, kept the backup secure — and was still exploitable, because seed quality is invisible. You cannot look at 12 words and see whether they came from physical noise or from a predictable counter. Trust must therefore attach to process, not appearance.
How the attackers worked — with no physical access
Weak entropy converts wallet theft into a search problem. The attackers enumerated the reduced seed space, derived addresses for each candidate seed, and checked them against the blockchain — where every funded address is public. A match means the attacker holds your private key. In Friday's sweep, per CoinDesk, they filtered for single-signature wallets holding more than 0.15 BTC, executed about 500 transactions in 25 minutes, and consolidated 562 BTC into one address. Most victim wallets were dormant: dormancy doesn't protect you when the key itself is guessable, and analysts at Galaxy Research and Block count 1,082.65 BTC lost across the flaw's full window. One more twist, per Cybernews: researchers suspect AI-assisted code auditing may be how the bug was found after five quiet years. Adversarial review of wallet firmware is now automated — for attackers and defenders alike.
Seven rules for trustworthy seed generation
- 1. Update firmware before you generate, and re-check advisories after. Coldcard users generating a fresh seed today on patched firmware (Mk3: v4.2.0+; Mk4/Mk5: v5.6.0+; Q: v1.5.0Q+) are using the fixed path. A seed is only as good as the firmware that minted it.
- 2. Add your own entropy when the device supports it. Dice-roll seed generation (99 casino-die rolls ≈ 256 bits) means your seed stays strong even if the device RNG is broken — this single practice would have fully protected against the Coldcard flaw.
- 3. Prefer multisig for significant holdings. Friday's sweep hit single-signature wallets. A 2-of-3 multisig across devices from different vendors survives the total compromise of any one vendor's RNG.
- 4. Use a BIP-39 passphrase. A strong passphrase acts as a 25th word the attacker must also guess; guessable seed + strong passphrase still defeats a bulk sweep.
- 5. Treat your xpub as sensitive. Attackers matched guessed seeds against visible addresses and exported public keys. Don't paste xpubs into random tools or watch-only services you don't control.
- 6. Rotate seeds after any vendor advisory that touches key generation. Patching firmware does not fix an already-weak seed. If your seed was generated in a vulnerability window, move funds to a fresh seed on fixed firmware — Coinkite's own instruction to affected users.
- 7. Subscribe to your vendor's security channel. The gap between advisory and exploit can be hours. Every affected Coldcard user who moved funds before Friday lost nothing.
Does this mean self-custody is broken?
No — but the honest version of that answer has two halves. The case against panic: the flaw was a specific implementation regression, not a weakness in Bitcoin, BIP-39, or hardware wallets as a category; multisig users and dice-roll users were unaffected; and the fix already ships. The case for humility: CoinDesk reported the exploit 'shakes faith in self-custody and may push investors to ETFs,' and that reaction isn't irrational for holders who can't evaluate firmware supply chains. Self-custody transfers custody risk from an institution to your own operational security. For some holders that trade is the entire point of Bitcoin; for others, regulated ETF custody with its own (different, institutional) risks is the rational choice. The mistake is pretending either option is risk-free.
FAQ
How do I know if my Coldcard is affected?
The confirmed exploit scope is Mk2/Mk3 devices whose seed was generated on firmware v4.0.0 through v5.0.3 (March 2021 onward). Coinkite advises Mk4, Mk5 and Q users to update as a precaution. If your seed was generated in the vulnerable window, generate a new seed on patched firmware and move funds now.
Are my coins safe if my wallet has been dormant for years?
Dormancy is not protection — most wallets swept on Friday were long dormant. If the key is guessable, the coins are claimable by whoever guesses first.
Is a 24-word seed safer than 12 words?
24 words encode 256 bits versus 128 — both are unbreakable when generated correctly, and both are equally broken when the generator is predictable. Generation quality matters more than word count.
Would a passphrase have saved affected users?
Largely yes for bulk sweeps: the attacker would need to brute-force the passphrase per candidate seed, destroying the economics of a mass attack. It is not a substitute for a properly random seed, but it is powerful insurance.
Should I just hold a spot Bitcoin ETF instead?
ETFs outsource custody to institutions — removing your operational risk but adding counterparty, regulatory and access risks, and giving up the censorship-resistance properties many holders value. It is a legitimate choice, not a strictly safer one.
A 15-minute audit you can run this weekend
Turn the rules into action with a short, concrete pass over your setup. First, inventory: list every device and note the firmware version each seed was generated on — not the version currently installed, which is what most people check and which doesn't matter for this class of flaw. Second, classify: any seed generated on a vulnerable firmware path goes in the 'rotate now' column regardless of balance; everything else gets a scheduled firmware update. Third, harden: for your largest balance, decide this weekend between adding a passphrase, migrating to 2-of-3 multisig, or regenerating with dice rolls — any one of the three materially changes your exposure to the next silent RNG failure, and the next one is a matter of when, not if, somewhere in the industry. Fourth, verify recovery: confirm you can actually restore from your backup words on a second device before moving significant funds to a new seed. A migration executed in a panic, without a tested backup, has destroyed more bitcoin than several famous hacks combined.
Bottom line: entropy failures are rare, silent, and catastrophic — and they are survivable with layered defenses. Dice rolls, multisig, passphrases, and prompt advisory response each independently blunt this class of attack. The holders who lost nothing on Friday weren't lucky; they were layered.
Disclaimer: This article is for informational and educational purposes only and does not constitute investment, financial, legal, or security advice. Cryptocurrency investments are volatile and carry a high risk of loss. Always do your own research and consult a qualified professional before making investment or custody decisions.