Twenty-five minutes. Five hundred wallets. Nearly 600 Bitcoin. The first reports of the Coldcard attack felt like a script from a heist movie, an attacker moving with surgical speed through supposedly unhackable cold storage. Then the technical details landed, and the movie became something more boring and more terrifying. The root cause was not a zero-day in elliptic curve math. It was not a physical bypass of the secure element. It was a preprocessor directive.
Coinkite's firmware was supposed to pull entropy from the STM32's hardware random number generator. Somewhere in the build, a compile-time check used #ifdef when it should have used #if. The macro MICROPY_HW_ENABLE_RNG was defined as zero, but the check still passed. The firmware kept running. The wallet kept generating keys. The keys were not random. They were waiting.
Coldcard has built its reputation on being the paranoid Bitcoin maximalist's wallet of choice. Open source firmware. Air-gapped signing. No touchscreen? No problem. The entire value proposition is that the code can be audited by anyone. That is exactly the problem.
The attack surfaced through a combination of journalistic reporting, vendor disclosure, and independent security analysis. Coinkite first confirmed that Mk3 seed generation could be non-random. Then Max Guise from Block, an entirely separate Bitcoin ecosystem player, found that the flaw extended across Mk2 through Mk5. Bitcoin Core developer Gregory Sanders reproduced the attack by manipulating the number of times the settings button was pressed. Affected addresses had UTXOs created between 2021 and 2026. Most were dormant. This was not a hit on active traders. It was a harvest of sleeping coins.
Let me be clear about my own lens. I spent 2017 parsing Ethereum's blockchain before the news cycle caught up. Chasing alpha through the 2017 hallucination taught me to look for the hidden assumption beneath every shiny narrative. And I spent 2022 tracing the rebasing mechanism that destroyed Terra. Surviving the Terra algorithmic trap taught me that persuasion can outrun mechanics for a long time, but never forever. This event has the same shape: a broken assumption hiding inside a trusted machine.
Here is the failure chain as I reconstruct it. The Coldcard uses an STM32 microcontroller, which includes a hardware true random number generator. That TRNG should be the source of seed entropy for the Bitcoin wallet mnemonic generation. Before using it, the firmware has a compile-time check to ensure the RNG is enabled. The check should evaluate whether the macro's value is non-zero. Instead, the code asks whether the macro is defined at all. In C preprocessing, #ifdef does not care about the value. If MICROPY_HW_ENABLE_RNG is set to 0, the #ifdef branch still evaluates as true. The feature check passes. The RNG is disabled. The firmware runs onward into the night.
Now the second part: what does the system do when hardware entropy is unavailable? It falls back to MicroPython's built-in Yasmarang pseudo-random number generator. Yasmarang is not a cryptographically secure PRNG. It is fast, small, and deterministic. Its entropy depends on the seed. In the Coldcard context, that seed was shaped by things an attacker might predict or observe, button press timings, settings state, a counter that a researcher could reproduce. Gregory Sanders proved this by reproducing the attack. Once you know the seed space, you do not need to steal the hardware. You enumerate the keys from your laptop.
The smart contract never lies, but the firmware that signs for it can. Entropy in the blockchain is real. The only question is whether your wallet has any.
This is why the 25-minute number matters. The attacker did not crack each device individually. They built a list of addresses generated from low-entropy seeds, scanned the chain for those addresses, found 500 with balances, and ran an automated script. That is not a human being typing quickly. That is a batch operation.
It also means the attacker may have had this list before the vulnerability was public. The 562 Bitcoin that still sits in the attacker-controlled address is not evidence of mercy. It is evidence of patience, or of a launderer still deciding how to move 36 million dollars without tripping every chain surveillance tool.
Now the fashionable part of this story: AI. Coinkite floated the possibility that the attacker used artificial intelligence to find the flaw. There is no hard evidence for that. DeLorme, who seems to have joined the investigation after the fact, claimed Claude Opus 5 found the vulnerability after cloning the repository. That claim has not been independently verified.
But even if true, the AI element is a distraction. The bug is embarrassingly simple. It is visible in source code that has been public for years. A determined human with a compiler and a grep tool could find it. A model might find it faster. The real headline is not "AI stole Bitcoin." The real headline is that the source code was the attacker's instruction manual.
Here is the contrarian angle that most commentary is missing: the open-source security model did not fail despite Coldcard's transparency. It failed because of it. For years, the industry told itself that public source code means community audit. But a community is not a security team. A GitHub repo is not a penetration test.
This bug survived in a wallet that is beloved by the most technical Bitcoiners on the planet. If the crowd could not catch it, the crowd was never the safeguard. Open source is a necessary condition for verifiable security, but it is not sufficient. It is transparency, not proof. And in this specific case, transparency gave the attacker a precise map. I am not arguing for closed source. I am arguing that we have to stop treating "open" as if it were the same as "verified."
In my own audit practice, I have learned to check not just what code says but what the build system actually does. A source line can be correct in theory and absent in practice. The Coldcard bug is a textbook example of that gap. It is also a textbook example of why the community audit model needs reinforcement, not applause. Filtering signal from the ICO noise taught me to ignore token narratives and watch transaction flows. This story is not about a token. It is about a trust flow, and that flow has been broken.
The one bright spot in this mess is that independent researchers moved faster than the vendor. Block's Max Guise found a wider blast radius than Coinkite's initial statement. Gregory Sanders reproduced the attack and confirmed the danger. This is how security actually happens: not through applause for open source, but through adversarial, independent, sometimes uncomfortable verification.
The lesson from Terra was that code can be audited and still be dangerous. The lesson here is that code can be open and still be broken. The only difference is who finds the break first.
Let me separate market fact from fear. 594 Bitcoin is roughly 0.0003% of the circulating supply. The 562 Bitcoin still parked is about 36 million dollars. Relative to the daily volume of the Bitcoin market, that is noise. Uniswap taught me liquidity is truth: there is simply not enough stolen coin in this incident to move the global order book.
What this event will move is trust. The hardware wallet as final fortress narrative has taken a structural hit. If Coldcard, the most aggressively security-focused brand in the niche, could ship a worthless RNG check for five years, buyers will ask what Ledger, Trezor, and everyone else missed. Fiat illusions break under pressure. So do hardware wallet brands.
Coinkite's initial response said only Mk3 was affected. Block's analysis said Mk2 through Mk5. That discrepancy is not a footnote. It means the manufacturer did not fully understand the security state of its own products. That knowledge gap will be more damaging than the 594 BTC. Users will forgive a bug. They will not forgive a vendor who tells them to check one product line while the fire is already spreading through the entire house.
The blast radius probably extends further than the reported 500 addresses. Block found that newer devices carried the same flaw in smaller but real numbers. If the Yasmarang seed space is as small as the reproduction suggests, then any Coldcard address created under affected firmware could be inside the attacker's enumeration range. Five hundred wallets may simply be the first batch that returned a positive balance.
That is the nightmare hidden inside this story. The attacker had a precomputed list. The attacker had automation. The attacker had time. And the attacker, apparently, had no need to touch a single physical device.
For the rest of the industry, the assignment is obvious. Every hardware wallet vendor should audit its own RNG fallback path tonight, not next quarter. A device that claims to be cold storage cannot silently downgrade from hardware TRNG to a deterministic PRNG and still call itself secure. The compile-time check in Coldcard was a failure of verification. But the broader failure is systemic: too many manufacturers treat RNG as a solved problem.
The regulatory pieces are also beginning to move. Hardware wallets are usually not VASPs, so the classic crypto licensing frameworks do not apply. But consumer protection law is a different animal. In Canada, where Coinkite operates, and in the United States, where many victims sit, product liability claims flow from the gap between marketing promises and actual behavior. If a vendor advertises uncompromising security and ships a compiler macro bug, that gap is exactly what plaintiff attorneys look for.
There is also a supply-chain angle. This attack involved an STM32 chip from STMicroelectronics, a MicroPython dependency, and a firmware team that missed the defect for years. If regulators want a reason to impose mandatory independent audits on open-source hardware, this is it. The cost of compliance may drive some small manufacturers out of the market. That is a real trade-off, but pretending the market can self-regulate after a five-year undetected vulnerability is fantasy.
What about the AI narrative? Coinkite said even the best AI models could not find this a few weeks ago. Then someone claimed Claude found it after the disclosure. Both statements can be true if the model needed the right prompt, the right context, or the right person to guide it. The real danger is not that an AI independently woke up and decided to attack Bitcoin. The real danger is that AI lowers the cost of turning public source code into an exploit list. A human researcher with time can find this bug. An AI-assisted researcher can find it faster, and then scale the attack across thousands of addresses before anyone notices.
The next phase is predictable. Other hardware wallet vendors will quietly audit their firmware RNG paths. Class-action lawyers will test whether "secure wallet" is a promise. Regulators may start asking whether open-source hardware needs supply-chain certification. And the 562 Bitcoin will sit like a timer, waiting for a mixer, a bridge, or a moment of panic.
The real question is not whether Coldcard survives. The real question is whether this industry finally learns that security is not a narrative. It is a practice of verification. I have been curating chaos for clarity for a decade, and I have never seen a clearer example of the gap between claims and code.
The next exploit may not be a macro check. It could already be waiting in your firmware, hidden behind a line that no one bothered to question. The only defense is not open source. It is independent, aggressive, and continuous verification.