COLDCARD and the Predictable Seed: How a Five-Year-Old Defect Led to $130M in Stolen BTC

On July 30, 2026, a wave of mass unauthorized bitcoin withdrawals began from wallets created on COLDCARD hardware devices. By early August, on-chain analysts had confirmed the theft of approximately 1,596 BTC, with the potential total — factoring in a suspected fourth wave — estimated at around 2,055 BTC, roughly $130 million.

This incident stands apart from typical crypto thefts, and understanding why matters more than the sum itself. There was no device hack, no phishing, no key leak. Users' keys were predictable from the moment their wallets were created. Here is how that became possible, and what it changes.

What Happened: Not a Hack, but Predictability

The defining difference between this incident and familiar scenarios: the attacker gained no physical access to the devices, bypassed no PIN, extracted no keys from the secure element, and installed no malware. Not one of the classic hardware wallet compromise vectors was involved.

Instead, this happened: the seed phrases that COLDCARD devices generated over a period of more than five years turned out to be computable. The attack consisted of an offline brute-force search through possible seed candidates, followed by checking the derived addresses against the blockchain. When a candidate's derived address matched a real address holding a balance, the funds were swept out.

This fundamentally changes the incident model. In an ordinary theft, the victim is defined by their behavior: they clicked a phishing link, installed malware, exposed their keys. Here, the victim is defined solely by the date and device on which the seed was generated. A user could have followed every security rule perfectly and still been vulnerable, because the defect sat at the level of randomness generation itself.

The Root Cause: A Generator That Wasn't One

Technically, the cause comes down to a library integration error introduced on March 1, 2021. COLDCARD devices use a hardware random number generator (TRNG) — a dedicated component that produces genuine entropy. Seed generation was supposed to be built on it.

But due to an error during firmware compilation, randomness generation was routed not through the hardware TRNG, but through a general-purpose software generator called Yasmarang. This is not a cryptographic generator. It was initialized from predictable values: the chip identifier and timer states — parameters an attacker can determine or substantially constrain.

The most dangerous aspect of this defect was its complete invisibility. The hardware generator did not fail or throw errors. It simply was not involved in the process where the developers assumed it was. Compilation completed without warnings, the device operated normally, and the seeds looked fine. Neither users nor functional testing could detect the problem — because on the surface, everything worked correctly.

As Match Systems analysts note, this is a textbook example of the most dangerous class of vulnerability in crypto infrastructure: the defect is not in the cryptographic algorithm, but in the source of randomness on which that algorithm is built. A strong algorithm built on predictable entropy provides no protection whatsoever. Verifying the quality of randomness generation after the fact is extremely difficult, which is precisely why such defects can persist for years.

The Scale of the Vulnerability

The confirmed affected scope covers Mk2 and Mk3 devices with seeds generated on firmware dating from March 2021 onward. The Mk4, Mk5, and Q models are affected to a reduced but still significant degree, thanks to a partial reseed mechanism from the secure element.

Estimates of effective strength vary. For the earlier models (Mk2/Mk3), the search space may have been in the low tens of bits or below — in certain configurations the practical brute-force cost approaches zero. For the newer models, the upper estimate reaches around 70 bits, but even that is far below the 128 bits a 12-word seed phrase is designed to provide.

The practical criterion for users is simpler than the version matrix: any seed created on a COLDCARD between March 2021 and the installation of the fixed firmware should be considered compromised — regardless of the firmware version currently on the device.

Why So Many Were Hit at Once

The mass scale of the incident is explained by the transparency of the blockchain — the very property that usually works in investigators' favor. The attacker did not need to check each generated candidate for activity. It was enough to compare a large set of derived addresses against the set of addresses holding a balance.

This makes the attack especially effective against long-established, funded wallets, and explains why many entirely unconnected owners lost funds simultaneously. The only thing they had in common was the device and the period in which their seed was generated.

Who Is Behind It

Attribution has not been established at this point, and precision of language matters here. Differences in transaction construction between withdrawal waves point to several independent operators, not a single 'COLDCARD hacker.' By our assessment, there may be at least fifteen distinguishable actors, some of whom likely joined after the first wave.

The working hypothesis is this: a primary operator discovered the defect and began exploiting it, after which information about the available search space either spread or was independently reproduced from the open-source code within a short time. COLDCARD's firmware source code is public — consistent with the open-source ethos of the bitcoin industry, but in this case it lowered the barrier to entry for subsequent operators.

Movement of Funds and Recovery Prospects

Sobriety is required here, because blockchain transparency is often mistakenly equated with the possibility of recovery.

What works in the investigation's favor: the stolen funds were largely not aggressively laundered. The bulk of the BTC was consolidated across a limited number of addresses under the attackers' control, without multi-layered concealment schemes. The chain from the victim's address through the theft transaction to the consolidation address is directly traceable. Around 600 suspected attacker addresses have been handed to federal investigators and compliance firms.

What limits the prospects — and this must be stated plainly: bitcoin has no issuer freeze mechanism analogous to what Tether applies to USDT. Traceability alone does not convert into recovery. Real points of leverage arise only in two scenarios: an attempt to cash out through an exchange or service with KYC, where a block is possible, or seizure by law enforcement. As long as the funds remain still, neither point is active.

The first laundering episodes have already been recorded — deposits into Wasabi and Tornado Cash in early August, some via cross-chain infrastructure. But this is a negligible share of the total volume. Holding large sums without movement is a rational strategy that can last for years.

As Match Systems frames it: in this incident, the quality of attribution remains high, and the position for monitoring, early alerting of platforms, and preparing law enforcement referrals is favorable. But the probability of actual recovery is determined by the future behavior of the operators and, at this point, cannot be reasonably quantified. Anyone promising victims guaranteed recovery in this situation is misleading them.

Takeaways for the Industry

The COLDCARD incident is not a story about a bad hardware wallet. COLDCARD remains one of the most respected devices in the bitcoin space, and the manufacturer's rapid response — releasing fixes within a day — confirms this. It is a story about the fundamental fragility of randomness generation, and about how a single invisible defect in the build chain can nullify all other security.

Three practical conclusions. First: if you used a COLDCARD to generate a seed after March 2021, migrate to a new seed created on updated firmware — even if a passphrase protected your wallet. A passphrase raises the cost of an attack but does not fix a compromised seed. Second: hardware security does not end at the purchase of a device — firmware and the origin of entropy are critical. Third, and broader: parallel analysis has uncovered similar entropy-handling defects in other codebases. COLDCARD is the most visible, but probably not the only, case of this class.

For the crypto industry, this is a reminder: trust in a device must be verifiable, not assumed.