When Randomness Fails: Inside the Coldcard Vulnerability That Drained $70 Million in 41 Minutes

At the heart of every hardware wallet lies a quiet bet. Not about markets, not about regulation, but about a chip's ability to produce a number no one else can guess. On July 30, 2026, that bet came due for nearly twelve hundred Bitcoin holders who had done everything right—stored their keys offline, verified their firmware signatures, and etched their seed phrases into steel plates. They lost $70 million in 41 minutes. The attack was not sophisticated. No zero-day against a secure element. No social engineering of a sleep-deprived founder. The attackers simply noticed that a March 2021 coding error in Coldcard firmware had redirected random number generation to a weak fallback—one that depended on a device serial number and the system clock. For four years, the defect went undetected. For four years, seeds created under that firmware were drawn from a pool of roughly 40 billion possibilities, a space so small that a desktop computer can traverse it like flipping through a phone book. Galaxy Research and Block's investigative team reconstructed the entire chain within days. But the question that lingers is not how the attackers got in. It is why the industry's foundational trust model—the belief that a hardware wallet's private keys can never be exfiltrated—turns out to rest on an unexamined assumption: that random number generators always work as intended. The answer, as with most systemic failures, is a series of small oversights compounding into catastrophe. And the lesson, if we are willing to learn it, extends far beyond Coldcard. Coldcard has long occupied a peculiar place in Bitcoin's cultural imagination. Produced by the Canadian firm Coinkite, it is the wallet favored by the Bitcoin-maximalist crowd—the kind of people who view multi-signature setups with suspicion and Ledger's cloud services with contempt. Its design philosophy is uncompromising: fully offline operation, open-source firmware, no USB unless explicitly enabled, a deliberate absence of wireless connectivity. For years, the brand cultivated an identity of radical self-reliance, the hardware equivalent of "not your keys, not your coins." This identity made the July 2026 disclosure so jarring. On the surface, nothing about the attack violated Coldcard's core design principles. The private keys never left the device. Yet they were compromised anyway, because the keys were predictable from the moment of their creation. The security model's foundational invariance—that private keys never leave protected hardware—holds true only if the keys are, in fact, unpredictable. When randomness quietly fails, the entire architecture collapses, regardless of how carefully the device guards its secrets. It is a moment that recalls an older truth I have carried since my early days translating the Ethereum whitepaper into Portuguese: that the shift from centralized trust to cryptographic truth is only as meaningful as the mathematics underneath it. We built an entire industry on the promise that code can replace faith. But code is written by humans, and humans make errors. The question was never whether those errors would surface. It was only when, and how loudly. What follows is my attempt to reconstruct the anatomy of this failure, to separate signal from noise in the reporting that has emerged, and to ask the uncomfortable question that the industry has been avoiding for years: if a hardware wallet can silently generate weak keys for four years without detection, what else are we not testing? In March 2021, a developer at Coinkite introduced an error. The details are still emerging, but the technical contour is clear. A task that should have invoked the device's hardware random number generator was automatically routed to a backup mechanism. In most systems, a fallback RNG is a safety net—something to keep the device functional if the primary entropy source fails. In this case, the fallback was catastrophically weak. It derived entropy from information an attacker could predict: the device serial number and the current time. Forty billion possibilities. Let us pause on that number. The BIP39 standard that governs Bitcoin seed generation specifies 128 to 256 bits of entropy. In practical terms, that means the seed space is between 2^128 and 2^256—numbers so vast that humanity's combined computing power could not hope to enumerate them. A seed drawn from such a space is effectively unguessable. But 40 billion is approximately 2^32. The difference between 2^128 and 2^32 is a factor of roughly 2^96. This is not a marginal degradation; it is a categorical collapse. I have spent more than two decades observing this industry, and I have audited enough security-critical code to understand that catastrophic failures rarely announce themselves. They hide in plain sight, in functions that look correct, in error-handling paths that nobody exercises, in fallbacks designed for convenience rather than security. During DeFi Summer in 2020, I spent over six hundred hours manually auditing Aave V2's interest rate models, and I identified three critical logic errors that could have led to a $4 million exploit. Those errors were not in the main calculation paths—they were in the boundary conditions, the edge cases, the code that only executes when something unusual happens. The Coldcard vulnerability is a boundary condition at scale. The primary RNG path was presumably working fine. It was the fallback path—the code that executes when the primary source is unavailable or fails silently—that contained the flaw. And because the fallback was designed to be invisible, designed to "just work" without user intervention, it operated for four years without raising any alarms. This raises a question that should trouble every hardware wallet vendor: how do you test the code path that only executes when something goes wrong? The answer, in most cases, is that you do not. Security testing focuses on normal operation. Fault injection, when it occurs at all, is typically applied to hardware—glitching clocks, manipulating voltages—rather than to the software logic that determines which entropy source is used. The industry's assumption is that entropy generation is handled by trusted hardware. The reality is that entropy fails silently, and in ways that are invisible to standard testing. The NIST SP 800-90B statistical tests can detect bias in an RNG output stream, but they cannot detect a fallback that produces outputs passing basic statistical checks while deriving entropy from a device serial number. A sequence derived from a serial number and a clock looks random enough to a casual observer. It is only catastrophic to someone who understands how it was generated. With the seed space reduced to a size a computer can brute-force in hours, the attack became algorithmic. Build a database of all possible seeds derived from the weak RNG. Convert each seed into its corresponding Bitcoin addresses. Scan the public blockchain for any address holding a balance. When a match is found, broadcast a transaction that transfers the funds to an attacker-controlled wallet. This is what the security community calls address sweeping, and its elegance lies in its efficiency. The attacker was not targeting individuals. They were not exploiting a particular user's carelessness. They were measuring the universe of possible victims from the mathematics of the vulnerability and then executing a batch operation against the public ledger. Bitcoin's transparency—the very feature that makes it a revolutionary form of digital money—became the attack surface. Every UTXO is publicly visible. Every address with a balance is a potential target. The attacker did not need to compromise any device, did not need physical access, did not need to phish anyone. They simply enumerated the corrupt key space and let the blockchain tell them which keys held value. The low technical barrier is worth emphasizing. Anyone with moderate programming skills, access to a GPU cluster or cloud computing resources, and an understanding of BIP39 derivation could have executed this attack. The vulnerability was sitting there for four years, waiting for someone to notice. In a different timeline, a security researcher would have discovered it through responsible disclosure, and the damage would have been contained. Instead, someone with less noble intentions found it first. When Galaxy Research and Block's team reconstructed the attack timeline, they found that funds were drained from 1,196 wallets in about 41 minutes. This is both remarkable and terrifying. The sweeping was not continuous—they observed three intermediate blocks with no activity, suggesting the attacker deliberately paced their broadcasts rather than streaming them continuously. Why pace the operation? The most likely explanation is evasion. A continuous stream of transactions draining thousands of wallets would trigger exchange monitoring systems, could be flagged by chain analytics services, and might prompt exchanges to freeze withdrawals. By spacing out the transactions, the attacker reduced the risk of detection and bought time to complete the operation before anyone could intervene. The pacing also suggests a human hand, or at least a sophisticated automation layer with intentional design choices. It implies the attacker understood how blockchain monitoring works and adjusted their behavior accordingly. This is not a script-kiddie operation. This is someone who studied the ecosystem's defense mechanisms and built an attack that could slip through them. Another revealing detail: the attacker used a paid account with a prominent blockchain data service to look up transaction sources. This signals something important—that chain analysis tools have become standard equipment for both defenders and attackers. The same infrastructure that helps security companies trace stolen funds also helps criminals optimize their operations. This is not a new dynamic, but it is one that the Coldcard incident makes painfully concrete. If the arithmetic of the attack is sobering, the timeline of detection is damning. The coding error was introduced in March 2021. The attack occurred in July 2026. That is over four years of exposure, four years of seeds generated from a compromised RNG source, four years of users believing their keys were cryptographically sound when they were, in fact, predictable. Why was it not caught? Coinkite maintains a public firmware repository. The community is passionate and technically literate. Security researchers have examined Coldcard hardware for years. Yet the bug persisted for over four years. This is not an indictment of Coinkite alone. It is a structural observation about how security-critical code is tested in this industry. Hardware wallets occupy a unique position in software engineering: their security claims are absolute, yet their test suites are not. Most firmware testing focuses on functional correctness—does the device sign this transaction correctly? Does the user interface behave as expected? RNG testing, when it occurs at all, is rarely integrated into the continuous integration pipeline. The deeper issue is that the industry lacks independent verification mechanisms for the security claims that matter most. When a wallet vendor says "your keys never leave the device," there is no standard way for users to verify that claim. When a vendor says "we use a hardware RNG," there is no standard way to confirm that the RNG output is being used correctly in all code paths, including fallbacks. During my time building the Verifiable Humanity initiative with zero-knowledge proofs, I learned that verification is not an afterthought—it is the discipline that transforms trust from a leap of faith into a mathematical guarantee. The Coldcard incident exposes the absence of that discipline in the hardware wallet sector. We verify transaction signatures, we verify firmware hashes, we verify addresses. But we do not verify the randomness that underlies the entire key generation process. This is not a problem that can be solved by a single firmware update. Coinkite responded to the incident by releasing updated firmware that blocks the weak RNG path. The response was fast—within days of the public disclosure, a fix was available. But here is the problem: the fix only prevents new seeds from being affected. The seeds already created under the buggy firmware remain weak forever. And there is no way for users to check whether their seed is affected. Think about the implications of that statement. If you are a Coldcard user who created a wallet between March 2021 and July 2026, you have no way to know whether your seed was drawn from the strong RNG or the weak fallback. The device will not tell you. The firmware update will not tell you. There is no home test—nothing you can run on your own machine to check whether your seed falls within the vulnerable 40-billion space. The uncertainty is arguably worse than the vulnerability itself. Users who may be affected face a grim operational task: generate a new seed, transfer their assets, rotate any accounts that derived addresses from the old seed, and then hope they did not miss something. This is not a fix; it is a triage protocol. I have written before that transparency is not the oxygen of trust. Trust is not sustained by the quantity of information disclosed, but by the pattern of behavior that disclosure represents. In this case, Coinkite's initial announcement contained a significant gap: it did not initially disclose all affected models. The Mk2 was mentioned by Block researchers before Coinkite formally addressed it. This is the kind of omission that creates lasting reputational damage, because it raises the question: what else has not been disclosed? Users who suspect they might be affected face a grim operational task: generate a new seed, transfer their assets, rotate any accounts that derived addresses from the old seed, and then hope they did not miss something. That's not a fix—it's a triage protocol. Here is a detail that deserves more attention than it has received. BIP39 passphrases—those optional additional words that add a layer of computational protection on top of the seed—would mitigate this attack. Even if an attacker knows your seed, a strong passphrase renders the funds inaccessible. The attacker would need to crack the passphrase through brute force, and if the passphrase has sufficient entropy, that is computationally infeasible. But the report notes that many mobile wallet applications lack support for BIP39 passphrases, forcing users to choose between high-security passphrases and mobile convenience. This is a systemic gap in the ecosystem's security tooling. The uncomfortable conclusion is that the ecosystem's most effective mitigation against RNG failure is a feature that remains a second-class citizen in user-facing wallets. If we are serious about defense-in-depth, passphrase support should be as universal as QR code scanning. It should be a default, not an advanced setting buried in a configuration menu. The community has spent years debating the relative merits of hardware wallets versus software wallets, single-signature versus multi-signature, cold storage versus warm storage. But the BIP39 passphrase—one of the few security features that adds a meaningful layer of protection without requiring additional hardware—has been consistently under-prioritized. The Coldcard incident is a wake-up call about misplaced priorities. CZ's public warning—"even hardware wallets can have vulnerabilities"—was met with predictable debate. Some called him overly dramatic. Some pointed out that he was speaking from a position of compromised authority, having admitted earlier misjudgments about the industry. But his remark is structurally accurate, and I would extend it: the vulnerability category revealed by this incident is not specific to Coldcard. Any hardware wallet that relies on a single RNG source, that does not have redundant entropy mixing from multiple independent sources, and that has not been audited specifically for RNG failure modes is theoretically vulnerable. The specific implementation details may differ, but the underlying exposure is the same. The competitive implications are significant. Coldcard's reputation as the "security absolutist's choice" has suffered a blow. But competitors should be careful about crowing. Ledger and Trezor have their own architectural complexities—including, in Ledger's case, components that have drawn criticism from the Bitcoin community for being closed-source and for having recovery service infrastructure that some users view with suspicion. Trezor has had its own physical attack demonstrations. No hardware wallet vendor is immune to the class of vulnerability revealed by this incident. The MPC wallet sector is likely to gain from this event. Multi-party computation splits the key across multiple devices and eliminates the single-point-of-RNG-failure problem—at least in theory. But MPC wallets come with their own trade-offs in complexity, operational discipline, and trust assumptions about the MPC protocol itself. There is no free lunch in security, and anyone who claims otherwise is selling something. The incident also has regulatory dimensions that are easy to overlook. Block has submitted its findings to law enforcement authorities, and the chain analysis work conducted by Galaxy and Block represents a mature form of cooperation between private sector researchers and public sector enforcement. This is a trend that will continue, and it raises important questions about privacy and the future of pseudonymity. The attack itself relied on the public nature of the Bitcoin ledger. The response to the attack also relies on the public nature of the Bitcoin ledger. The same transparency that enables criminals to identify targets also enables defenders to trace the flow of stolen funds. This is not a contradiction; it is a feature of public blockchains that cuts both ways. But there is a deeper structural observation: if Chainalysis, Elliptic, and similar firms continue to build the infrastructure for tracing funds, and if law enforcement increasingly relies on that infrastructure, the regulatory pressure on privacy-preserving technologies will intensify. We saw this with Tornado Cash. We will see it again, and the Coldcard incident provides new ammunition for those who believe blockchain surveillance is a public good. The counterintuitive angle, and the one I want to press here, is that the most dangerous consequence of this event might not be the $70 million drained. It is the likely overreaction. If the takeaway becomes "hardware wallets are unsafe, move back to exchanges," we have traded a rare but manageable risk for a persistent and structural one. Centralized exchanges are custodians—they control your keys, and they have shown a consistent pattern of hacks, freezes, and regulatory seizures. The frequency and scale of exchange failures historically dwarfs any single hardware wallet vulnerability. The people who lost money in this attack probably were not negligent. They did everything right, and they still lost. The lesson is not "don't trust hardware wallets"; it is "any single point of failure is too many." This is also the moment for the Bitcoin community to test its own dogmatism. There is a certain strand of Bitcoin maximalism that treats hardware wallets as sacred objects, that equates self-custody with virtue and any form of third-party involvement with betrayal. The Coldcard incident reveals that this absolutism was never grounded in technical reality. Hardware wallets are devices made by humans, with firmware written by humans, tested by humans, and humans make errors. The device is not the fortress; the system of practices around the device is the fortress. When I wrote "Code as Law, but People as Gods" in 2022, during the aftermath of the Terra and FTX collapses, I argued that resilient systems are built on modest assumptions about the people who operate them. The same logic applies to key management. If your security model assumes a perfect device, you will be disappointed. If it assumes imperfect devices, imperfect users, and imperfect operational environments, you can build something that survives those imperfections. The proper response to this event is not to abandon self-custody. It is to practice defense-in-depth: use a hardware wallet from a vendor that demonstrates RNG redundancy; add a BIP39 passphrase; use multi-signature setups for significant holdings; and diversify storage across devices and methodologies. The industry should also support the development of independent RNG verification tools, so that users have the ability to test their seeds against known weakness patterns. There is another danger that deserves attention. The 2026 market has been punctuated by a record number of hacks and exploits, and security fatigue is setting in. We are becoming desensitized to headlines about drained wallets and shattered trust. That desensitization is itself a vulnerability—it leads us to stop updating firmware, stop rotating seeds, stop questioning assumptions. The people who lost money in this attack probably were not negligent. They did everything right, and they still lost. The lesson is not "don't trust hardware wallets"—it's "any single point of failure is too many." The Coldcard incident marks the end of an era in which "hardware wallet" was synonymous with "absolute security." The next era will demand something more honest: layered security, redundancy in randomness, and an industry that designs for failure rather than assuming it away. Code is law, but ethics is soul—and the ethical obligation here extends beyond Coinkite to every vendor, every developer, every user. We are all responsible for building systems that acknowledge their fallibility and engineer around it. The $70 million is gone, but the lesson is still ours to claim: no device is a fortress, and the only durable security is honest engineering. The question that remains for every Bitcoin holder is whether they will wait for the next vulnerability announcement before they reconsider their own assumptions about what "secure" really means.