On July 30, someone emptied 1,196 Bitcoin addresses in 41 minutes. No phishing emails went out. No devices were stolen. Nobody clicked a bad link.
The coins moved because the private keys protecting them were never truly random in the first place.
If you generated a seed on a Coldcard hardware wallet, skip ahead to the remediation section. The short version: installing the new firmware does not fix an existing seed. You need a new one.
What Happened on July 30
Galaxy Research mapped the sweep and connected it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet built by Canadian company Coinkite. The haul was 1,082.65 BTC, worth roughly $70.2 million at the time.
The loss figures in circulation don't agree, and that's worth being straight about. Chainalysis has tied more than $38 million in stolen Bitcoin to keys believed to have come from vulnerable devices. Galaxy's larger number covers a wider set of addresses it considers affected. Both are estimates from on-chain analysis, and the gap between them reflects genuine uncertainty rather than one firm being wrong.
One more caveat that most coverage has glossed over: no public report has yet reconstructed a victim's seed and matched it to a drained address. The connection between the bug and the theft is strong and circumstantial. It has not been demonstrated end to end.
Galaxy itself flagged the limits of what its analysis proves. The transaction pattern identifies the operator behind the sweep, not the theft — because on the blockchain, a stolen sweep looks identical to an owner consolidating their own coins.
The Random Number Bug, in Plain Terms
Randomness is the entire security model
A Bitcoin seed is a very large number, and its safety rests on one thing: nobody can guess it. Not "hard to guess." Guessing it should take longer than the universe has been around.
Picture a vault with an excellent door. Thick steel, good hinges, serious lock. Now imagine the combination is derived from the serial number stamped on the outside. The door is still excellent. It just doesn't matter anymore.
What the firmware actually did
In 2021, Coinkite moved Coldcard's elliptic-curve math to libsecp256k1, the same library Bitcoin Core uses. The cryptographic decision was sound. The integration wasn't.
During that migration, seed generation shifted to a code path that quietly resolved to MicroPython's software fallback instead of Coldcard's own hardware random number generator. Coinkite's post-mortem is unusually honest about the result: most of the device's randomness came from a PRNG the developer didn't realize was even in the codebase, while the hardware TRNG code he had carefully written ended up being used only by chance, for less important tasks.
That fallback drew its starting values from device and timing state — things like a chip identifier and a clock register. Predictable inputs produce predictable output.
The mistake was almost invisible
The build had a guard designed to catch exactly this. It failed on a technicality. The check tested whether a configuration macro was defined, not whether it was switched on. The macro was defined as zero, so the safety error never fired and the build completed cleanly.
Both random number implementations shared the same function signature. Nothing looked broken. Code review confirmed the correct hardware code was present in the binary — it just never checked which version the seed generation path actually reached.
How much protection was left
A 12-word BIP-39 seed is meant to carry 128 bits of security. Coinkite's preliminary estimate puts the real figure at roughly 40 bits on the Mk3, and about 72 bits on the Mk4, Mk5 and Q, where extra entropy from the secure elements got mixed in.
Those numbers are exponential, not linear. Forty bits doesn't mean "somewhat weaker." It means the search space collapsed from astronomically impossible to something a determined attacker with real computing resources can work through.
Which Devices Are Affected
Here's the part that trips people up: exposure depends on the firmware that was running when you created the seed, not the version installed on the device today.
- Mk3: versions 4.0.1 through 4.1.9, corrected in 4.2.0
- Mk4 and Mk5: anything before 5.6.0
- Q: anything before 1.5.0Q
- Edge builds: before 6.6.0X for Mk4 and Mk5, before 6.6.0QX for Q
- Mk2: Coinkite doesn't name it. Block's analysis places Mk2 and Mk3 versions 4.0.0 through 4.1.9 on the vulnerable path.
TAPSIGNER, OPENDIME and SATSCARD are unaffected. They run on different codebases entirely.
What to Do If You Own One
Say it plainly, because this is the step people get wrong: updating the firmware does not repair a seed that affected firmware generated. The old seed stays weak forever. You need a new one and you need to move your coins to it.
Coinkite's recommended sequence:
- Install the fixed firmware for your specific model and release track — before generating anything.
- Generate a completely new seed on the updated device.
- Back it up, then verify the wallet fingerprint and a receive address.
- Send a small test transaction first.
- Keep the old backup until the migration is confirmed complete.
A few situations change the picture:
- Dice rolls. A seed created with at least 50 fair, independent, private dice rolls isn't considered at risk from this bug alone.
- Multisig. It helps only if the quorum isn't built entirely from affected devices.
- Passphrases. A strong BIP-39 passphrase creates a separate wallet that the seed words can't reach by themselves. Coinkite still recommends replacing the seed.
- Release tracks. Standard and Edge are separate. A higher version number on the wrong track is not a fix.
Coinkite has published a dedicated migration advisory with the full procedure.
The Uncomfortable Part
A hardware wallet makes two promises. Your keys stay on an isolated device that remote attackers can't reach. And those keys came from real randomness, so nobody can reproduce them without ever touching the hardware.
The first promise held completely. The second broke silently, five years ago, at the moment of wallet creation — and no one noticed until money started moving.
Coldcard's source code has been public the whole time. Coinkite says it ran one of the best available AI models across its own firmware only weeks before the theft, and the review surfaced nothing serious. Its working assumption is that someone else's AI review found the bug first.
This also isn't a one-off. In early July, Coinspect's Ill Bloom research documented a separate weak-randomness flaw in older software wallets, tied to more than $5 million drained across several chains.
Dice rolls and passphrases have always looked like paranoia — the extra ten minutes that careful people spend and everyone else skips. For a lot of Coldcard owners this week, that extra ten minutes was the only thing standing between them and losing everything.