NextFin News - A seed-generation flaw in Coldcard hardware wallets let attackers drain more than 1,000 bitcoin, worth about $70 million, from 1,196 wallets in a 41-minute span on July 30, without ever touching the devices. That is the part that changes the story. The theft did not come from a stolen unit, a phishing link or a live signing compromise. It came from the math that created the wallet in the first place, which means the failure sat upstream of custody, not inside it.
Coinkite, Coldcard’s maker, said users who generated a seed on a Mk3 running firmware 4.0.1 through 4.1.9 are at risk, and that seeds generated on Mk4, Q and Mk5 before the fixed releases are also affected, with about 72 bits of entropy instead of the intended 128 bits. The company also said fixed firmware is available for every affected model and that updating does not repair an existing seed. That is the central operational detail: if the seed was created on the vulnerable path, the wallet’s past cannot be patched away with a later download.
Galaxy Research mapped the full event at 1,082.65 BTC across six blocks between 01:10 and 01:51 UTC, with three empty intervening blocks. The later tally roughly doubled the first public estimate of about 594 BTC, which shows how fast a technical wallet issue can expand once the on-chain picture is fully reconstructed. The proceeds sit in four addresses and have not moved. In practical terms, the device stayed cold while the seed space became predictable enough for an offline attack.
The broader lesson is uncomfortable for self-custody. A hardware wallet can be air-gapped, PIN-protected and physically untouched, yet still fail if the seed it generated was too predictable. The attack path ran through firmware and entropy, not through the device shell. The signer did its job. The problem was that the wallet had already been born with weaker randomness than users believed.
How The Attack Worked Without Touching The Wallet
The key distinction is between the device and the seed. Cold storage protects the private key after it exists, but the private key begins with a seed phrase. If seed generation is strong, brute-force reconstruction is infeasible. If seed generation is weak, the wallet can remain physically isolated while still becoming mathematically enumerable.
Coinkite’s advisory is explicit about the affected range. It says the issue is present on Mk3 firmware versions 4.0.1 through 4.1.9 inclusive. It also says the impact on Mk4, Mk5 and Q is less severe but still serious, with about 72 bits of entropy rather than 128 bits. The company further says that if a user added at least 50 independent, private dice rolls, the dice input itself contributed at least 128 bits of entropy, reducing or eliminating risk from the device RNG issue alone. That detail matters because it shows the flaw did not affect every path equally. It also shows why a wallet owner cannot assume the label on the device tells the full security story.
“Coinkite is warning all users who generated a seed using a Mk3 on version 4.0.1 (March 2021) thru 4.1.9 (inclusive) that their funds may be at risk.”
That warning turns the theft from a one-off into an exposure window. A flaw introduced in March 2021 can linger in every seed generated on affected firmware until the wallet is migrated. Updating the firmware helps future seeds, but it does not rewrite the past. That is why the incident scales beyond the stolen coins: the danger may persist wherever users kept the original seed and never rebuilt it.
The on-chain pattern reinforces that point. Galaxy Research found 1,082.65 BTC swept between 01:10 and 01:51 UTC on July 30 across six blocks, with three blocks in between containing nothing. The theft was therefore coordinated and batch-based, not random or opportunistic. That is what an offline reconstruction attack looks like once the attacker has enough search-space reduction. The device was not the target; the predictability of the seed was.
This is also why the incident matters for institutional and retail custody alike. The usual mental model says hardware wallets fail when someone gets physical access, malware or a social-engineering trick. Here the compromise sat one layer earlier, in the seed-generation path. That means the weakest link was not the device in transit or the signing workflow. It was the entropy source that made the wallet unique in the first place. If that source is flawed, the rest of the custody stack inherits the weakness.
Why This Is A Structural Wallet-Security Problem
This is a structural problem, not a cyclical one. The flaw was embedded in a firmware path and remained relevant until fixed releases were available. That means the exposure does not fade on its own with time or market conditions. Wallets created under the bad path remain vulnerable until their owners identify them, verify their seed provenance and migrate funds. In other words, the risk persists as long as the seed persists.
That is different from a short-lived market shock or a temporary operational breach. A cyclical event usually depends on liquidity, timing or a one-time lapse. A structural event changes the security baseline. This one did both in a narrow sense: it created a near-term theft and a longer-term trust problem. Once a hardware wallet’s seed generation can be called into question, users have to audit the whole custody chain, not just the device body.
There is a second-order consequence that matters more than the initial drain. If users begin to view hardware wallets as only as safe as the firmware build that generated the seed, then the value of the device shifts from “secure by default” to “secure only if provenance is known.” That forces more verification, more migration and more demand for transparent entropy claims. It also puts pressure on wallet makers to show that a device can prove how randomness was generated rather than merely assert it.
That is the market’s real repricing. The first-order effect is the theft of about 1,082.65 BTC. The second-order effect is a hit to the assumption that offline storage is inherently safer than software custody. In practice, the incident says the opposite: if the seed path is weak, a wallet can be cold in form and exposed in substance.
The strongest counter-thesis is that this is still a contained implementation bug. Coinkite has already shipped fixed firmware for affected models, and it says users who generated new seeds on the corrected releases are not automatically exposed. On that reading, hardware wallets still work, the model survives and only users on old firmware need to migrate. That is a serious argument. It is also incomplete. The whole point of cold storage is that users do not have to be cryptography experts to trust the device. A multi-year entropy failure breaks that promise even if the fix is available.
The falsifying signal for the structural view would be clear evidence that the affected seed space was not practically enumerable in the wallets that were drained, or that the incident was confined to a tiny, idiosyncratic subset with no broader custody implications. If that evidence does not appear, the safer conclusion is that the flaw changed the security baseline for any seed generated on the vulnerable path.
What Holders, Custodians, And The Market Need To Watch Next
In the short term, the beneficiaries are users and firms that can verify seed provenance and move quickly to patched firmware. The exposed groups are owners of affected Coldcard-generated seeds, especially those who never added enough private dice rolls to restore full entropy and never regenerated the wallet. Custodians that rely on cold storage without strong inventory and migration controls are also exposed, because the issue is not about a single signing event but about the origin of the key itself.
In the medium term, the custody market may reward products that can prove stronger entropy generation, clearer firmware controls and more explicit migration guidance. The problem is not unique to one brand. Any wallet that depends on a device-generated seed now faces a higher burden of proof. The question users will ask is no longer whether the device is offline. It is whether the seed path is auditable.
In the long term, the incident points to a more demanding definition of self-custody. Offline signing is necessary, but it is not sufficient. If the wallet’s birth process can be weakened by a build error, then the industry has to treat seed generation as the core security event, not a background setup step. That is a structural change in how custody is evaluated.
Three scenarios now frame the outlook. In the base case, the event becomes a major warning shot, affected users migrate funds and wallet makers tighten firmware disclosure and recovery guidance. In the upside case for trust, the disclosure process proves that open analysis and quick patching can contain the damage and keep hardware custody broadly credible. In the downside case, more affected wallets are identified or additional wallet families disclose similar entropy problems, which would widen the trust hit and keep the issue in focus longer.
The next signals to watch are simple: whether any additional Coldcard-generated wallets are swept, whether Coinkite or independent researchers publish more detailed entropy analysis, and whether other wallet vendors disclose comparable seed-generation weaknesses. The single falsifying signal for the structural read would be a credible demonstration that the compromised seeds were not computationally enumerable in practice. Until then, the lesson is stark: the device never had to be touched because the weakness was already in the math.
Cold storage did not fail at the door. It failed at the moment the seed was born.
Explore more exclusive insights at nextfin.ai.
