A flaw in Coldcard hardware wallets let attackers steal more than 1,596 Bitcoin worth over $100 million (USD). The bug exposes how fragile the process of generating a private key can be, even inside devices built specifically to protect it.
What actually happened
Coinkite, the company behind Coldcard, disclosed an entropy-generation flaw on 31 July 2026, according to Cointelegraph. Researchers at Galaxy Digital say attackers used the flaw in coordinated attacks to steal more than 1,596 Bitcoin, worth at least $100 million (USD). Coinkite has released firmware fixes and told affected users to migrate their funds to newly generated wallets. Core Lightning developer Dustin Dettmer suggests the bug traces back to 2021 firmware changes that disabled the hardware random number generator, forcing wallets to fall back on MicroPython's weaker Yasmarang pseudo-random number generator. Coinkite has not confirmed that exact sequence, but a company spokesperson told Cointelegraph that certain firmware versions had a fallback path in seed generation that could produce weak entropy on the device itself. Devices using manually generated entropy, such as dice rolls, were not affected.
How we got here
Every Bitcoin wallet begins with a seed phrase generated from a pool of random data. Entropy measures how unpredictable that data is. If entropy weakens, attackers can narrow the possible private keys and eventually reproduce them. The flaw sat undetected for more than five years, according to Foundation chief executive Zach Herbert. Weak random number generation is not new. Bitcoin security expert Jameson Lopp has documented similar flaws in past wallets and libraries, including Blockchain.com's Android wallet and Trust Wallet. Ledger, Trezor and Foundation each use different entropy strategies, from certified secure hardware to combining multiple independent sources, but none guarantees a single point of failure cannot occur.
Why this matters for you
For Coldcard users, the priority is following Coinkite's migration guidance for wallets created on affected firmware. For the wider industry, the incident pushes manufacturers toward stronger, verifiable entropy standards, as proposed by Kraken chief security officer Nick Percoco. Builders may face pressure to publish reproducible firmware or invite third-party audits, following Foundation's open-source model. For everyday holders, it highlights a broader tradeoff in self-custody: hardware wallets concentrate risk in a single seed-generation event, while alternative models such as MPC-based wallets, including bonuz, fractionalize private keys across a network and let users log in through social login rather than storing a seed phrase at all.
The bigger question
If randomness can fail silently inside devices built specifically to generate it, how much verification is enough before trusting any wallet with life-changing sums? Should the industry require third-party certification of every firmware version, or does security depend on users understanding the process themselves? The Coldcard incident does not answer this. It simply shows how rarely anyone asks it.
What to watch
Coinkite says it will publish a full technical postmortem of the flaw soon, though no exact date has been given. Coldcard users with wallets created on affected firmware should watch for direct migration guidance from Coinkite. Nick Percoco's proposed industry assurance standard, covering entropy validation and firmware certification, remains a discussion point rather than a formal rule. Expect further scrutiny of entropy practices across Ledger, Trezor and Foundation in the coming months.
