594 bitcoin. Approximately 500 wallets. One Thursday in 2026.
The consolidation was surgical: 562 of the 594 bitcoin moved to a single address in the first sweep, while the remainder filtered out of wallets that had sat dormant for years โ some holding coins mined or purchased as far back as 2021. That is not a coincidence. 2021 is the same year Coldcard Mk3 firmware version 4.0.0 shipped the bug that made this theft possible.
This was not a phished seed phrase. It was not a compromised exchange account. It was the most devastating finding in Bitcoin hardware wallet history: a firmware update that quietly swapped a hardware true random number generator โ the TRNG, the chip that gives the device its entire reason to exist โ for a software pseudorandom routine seeded by timer states, call histories, and known device identifiers. Then the market was given five years of silence before the code was called to account.
I do not trust the silence, I audit the code. Halfway through manually auditing CryptoKitties' breeding logic in 2017, I learned something this event confirms: the most dangerous lines in a system are always the ones that look like improvements.
Context: The Air-Gap Promise
Coldcard is not a regular hardware wallet. It is the device Bitcoin maximalists recommend when they want to sound serious: air-gapped operation, no Bluetooth, no camera, a deliberate rejection of the consumer convenience that defines Ledger and Trezor. It sells itself on threat models. The single-sig users who bought Mk3 devices trusted that key generation happened on a Secure Element drawing from a physical TRNG. That is the entire premise of self-custody. That is the proof that precedes value.
Block's Bitcoin engineering and security team published the root-cause report: at v4.0.0, the firmware's build settings replaced the random source with a derivable PRNG. The seed space collapsed from 2^256 to a set an attacker could enumerate once they reconstructed the device's unique identifier and the firmware's call pattern. Every wallet created on that version was permanently compromised โ not because the private key left the device, but because the math that generated it had stopped being random.
The chain of custody is clear: v4.0.0 released in 2021 โ affected Mk3 devices generate weak seeds โ wallets are funded and then go dormant โ an attacker enumerates seeds, filters for balances above 0.15 BTC, sweeps approximately 500 wallets โ Block observes the on-chain anomaly and reverses the attack to its origin. The report dropped within days of the theft. The question nobody asks is how long the attacker knew the answer. Coinkite's passive voice in its advisory โ "the issue affects..." โ reads like a corporate reflex, not a security posture.
Core: Reading the Entropy Failure Without Flinching
This is a "turn off the lights" vulnerability, not a firmware bug. Let me drill into the mathematics.
Let me start with the entropy regression, which is structural, not incidental. A hardware wallet's value proposition is not the Secure Element in isolation; it is the chain of trust from physical randomness to key birth. When v4.0.0 replaced TRNG output with a PRNG derived from timer states, call history, and a unique identifier, it did not reduce entropy by a few bits. It annihilated the distribution. A 256-bit seed is only worth anything if all 2^256 possibilities are reachable with equal probability. The moment the seed becomes a deterministic function of three enumerable variables, the private key lives on a lookup table. The attacker never needed physical access. They only needed the chain.
The latency is the story. Five years of exposure before exploitation is not bad luck; it is an indictment of the industry's monitoring model. The affected wallets did not look abnormal. They were single-sig, in excess of 0.15 BTC, dormant. Every one of those attributes describes a responsible HODLer. And the attacker's selection function describes them too: they swept what was worth the cost of exposure and left the rest. The "wide but shallow" impact model โ roughly 500 wallets hit, thousands potentially crackable โ suggests an enumeration strategy that ranked targets by balance and only pulled the trigger above a profitability threshold.
Then there is the remediation vacuum. Coinkite stated โ correctly โ that no firmware update can repair an already-generated seed. The entropy is burned into the key at birth. The only migration path is generating a fresh seed on an unaffected device and moving all assets. That requirement places an enormous burden on users who cannot even identify whether their device was compromised. Coin age spanning 2021 to 2026 means many victims do not remember which firmware was active when they generated their seed.
The contamination surface is wider than the headline. The same faulty generation path affected paper wallet private keys, seed split masks like Seed XOR, and device clone keys. Anyone who used the vulnerable firmware to generate derived secrets caught the same disease. Worse, exporting a weak seed to another wallet does not fix it: the seed carried its weakness with it, across vendor boundaries. This is a key-generation infrastructure crisis, not a single device recall.
The differential impact across models matters. Mk4, Q, and Mk5 were described as "not as seriously affected but still seriously affected." Partial entropy degradation, rather than full annihilation, suggests that newer hardware architectures with independent TRNG hardware were only partially overridden, while the Mk3's derivation was fully captured. The distinction is thin comfort: a partially reduced seed space is still a vulnerable one, and the absence of published entropy measurements for each model makes the claimed boundary impossible to verify. Based on my audit experience, a vendor cannot assert "less affected" without publishing the exact derivation graphs. The onus is on Coinkite to show the math.
This is where my 2020 DeFi Summer work returns: when I built a Python framework to model oracle price manipulation in Compound liquidity pools, the lesson was the same โ complexity concentrates risk where no one is looking. The industry has spent years auditing smart contract logic. It has spent almost no time performing continuous chain-level audits of key generation quality. Block's team found this vulnerability by combining Bitcoin transaction surveillance with hardware knowledge: they saw the consolidation anomaly and worked backward. That reverse path is the only reason the public knows the cause. Truth is an oracle, not a price feed. The on-chain data exposed what the vendor's silence concealed.
Contrarian: The Thief Was a Farmer
The popular framing is that this was a theft. I propose something more uncomfortable: the attacker likely discovered the weakness years before the public event and treated it as a yield-bearing asset. The 0.15 BTC minimum is the tell. It implies a cost model โ transaction fees, operational security, exposure risk โ and a target return. A thief who found the vulnerability in 2025 would sweep everything. A farmer who found it in 2022 would compile a watchlist, watch balances appreciate through the cycle, and harvest at the optimal moment. There is a dark symmetry here: the HODLer's virtue โ not touching the coins โ is exactly what made the harvest possible.
The consequence of that interpretation is the uncomfortable part: 594 BTC is not the blast radius. It is the attacker's chosen profit-taking level. Below the threshold, thousands of additional wallets generated by the same vulnerable firmware remain untouched but permanently crackable. The current figure is a sample, not a census. And if Block identified the root cause only after the theft, the attacker may still hold the same capability โ the exploit did not die; only the first harvest became visible.
The second structural critique targets the market's reflex rather than Coinkite alone. Hardware wallets have been treated as "audit once, trust forever" devices. The Coldcard event proves the firmware supply chain is a single point of failure that can contract and fire years later. Fragility hides in the single point of failure. The absence of a third-party audit on key generation quality is not an oversight; it is the default. We do not demand cryptographic proofs of entropy at manufacturing time or at firmware update time. We demand screenshots of bank-grade certification and call it security theater.
And the mitigation irony: BIP-39 passphrase is a genuine patch, but only for users who enabled it. It adds entropy outside the vulnerable derivation. But it does not make the seed any less deterministic; it only raises the enumeration cost above the attacker's threshold. The question is not whether passphrases work. The question is whether any affected user can reliably know they are affected. That answer requires the device model, the exact firmware version at seed creation, and honest purchase records. Most victims cannot reconstruct that set. That is the real failure: the burden of proof landed on the people least equipped to carry it.
Takeaway
This event is not an argument against self-custody; it is an argument for redesigning how self-custody is verified. Key generation should be continuously auditable on-chain โ that entropy was not random is visible in the output, given the right mathematics. The age of "trust the box" is over. Migration will accelerate toward multi-signature structures, MPC, and verification workflows that do not depend on a single vendor's firmware staying honest. Proof precedes value; provenance is the only art. Bitcoin was not broken here. The mythology that hardware is safe by packaging took a five-year bullet. The code was always law; it took a patient farmer with a good calculator to remind us that audits are the only conscience.