The numbers landed like a gut punch: 500 addresses. Twenty-five minutes. 594 BTC, roughly $38 million at current prices. The attackers didn't brute-force anything. They didn't exploit a chain-level vulnerability or corrupt a consensus rule. They read public source code, pre-computed the private keys, and emptied the wallets in the time it takes to run a short errand. The most damning detail? The root cause was a compile-time check that used #ifdef instead of #if โ a one-word difference in macro evaluation logic. Five years of open-source auditability. Thousands of eyes on the code. And nobody caught the single line that mattered most.
Coldcard is not a consumer gadget. It's the hardware wallet of choice for Bitcoin's most security-conscious class: Core developers, high-net-worth self-custody advocates, and the kind of operators who will explain at length why a hardware wallet is "the last line of defense" for private keys. The pitch was consistent across a decade of product iterations: open-source firmware, deterministic builds, no closed security chips, no trust required. Transparency was the product. The code sat in public repositories for years, examined by community auditors, security researchers, and โ as we now know โ at least one adversary who figured out how to weaponize it.
That trust model just absorbed a direct hit.
The attack, first reported by Protos and confirmed across multiple independent sources, exploits a fundamental flaw in the firmware's random number generation path. Coldcard devices run on STM32 microcontrollers, which include a hardware True Random Number Generator. The firmware is designed to draw entropy from that TRNG. But a compile-time check meant to verify the RNG was enabled was written incorrectly. Instead of testing whether the RNG configuration value was non-zero (#if), the code tested only whether the macro was defined at all (#ifdef). When MICROPY_HW_ENABLE_RNG was set to 0 โ explicitly disabled โ the check still passed. The firmware silently fell back to MicroPython's built-in Yasmarang pseudo-random number generator.
Yasmarang is not a cryptographically secure PRNG. It's a lightweight algorithm with a minuscule internal state, designed for embedded tinkering, not key generation. To make matters dramatically worse, it was seeded with something desperately predictable: the timing of button presses on the device itself. That's not entropy. That's a timestamp wearing a disguise.
Here's where the story gets truly ugly. This wasn't a lucky collision or a one-off exploit. The attacker pre-computed private keys for a targeted set of addresses and executed a batch sweep at industrial scale. Twenty-five minutes for 500 wallets means fully automated extraction โ the kind of operation that requires advance knowledge of which addresses were vulnerable.
The affected address profile is even more telling. The compromised outputs were generated between 2021 and 2026, spanning multiple Coldcard hardware revisions. These were long-dormant cold-storage wallets โ the "set it and forget it" HODLer cohort that believed their funds were immune to network-level attacks because the private keys never touched a hot device.
The model range reveals the true scope of the failure. Coinkite initially acknowledged only the Mk3. Block's Max Guise โ a third-party researcher โ dug deeper and found the same defect across Mk2 through Mk5. Bitcoin Core developer Gregory Sanders independently reproduced the attack and confirmed the broader blast radius. Let the sequence sink in: the manufacturer underestimated its own exposure. External researchers identified the real damage envelope. The people who built the device didn't fully understand its failure modes โ but the attacker did.
In my years tracing on-chain theft โ from post-mortem analyses of DeFi exploits to the Terra collapse outflow patterns โ I've rarely seen this combination of trivial root cause, massive impact, and extended silent exploitation window. The vulnerability was embedded in the firmware's interaction with MicroPython's compatibility layer, a dependency so foundational that it carried the bug forward into every subsequent release. The 2021-2026 window isn't a coincidence; it's a signature of systemic neglect in the security review pipeline.
Now let me puncture the noise. The "AI did it" narrative is a distraction.
Coinkite floated the theory that the attacker may have used AI. DeLorme claimed he used Claude Opus 5 to identify the vulnerability after the fact. Neither claim has independent verification. What we know with high confidence is that the code was public for years, the bug was trivially discoverable, and the combined forces of the open-source community failed to find it. The barrier to discovery was low. The barrier to adoption of the finding was even lower. Nobody checked.
The uncomfortable truth: open source gave the attacker the blueprints. "Open-source auditable" โ a phrase printed on marketing pages and repeated in reviews โ translated into a false sense of security. Transparency is the only security when someone is actually checking. Not scanning the diff. Not reviewing the pull requests. Actually tracing the entropy flow from hardware to seed to key generation. Code doesn't care about your feelings. It doesn't care that you bought a Coldcard because it was "the most secure option." A misplaced #ifdef just does what it's told.
And here's the angle nobody is discussing: the affected addresses look batch-generated. Long-dormant single-signature outputs, systematically produced, sleeping for years. That profile doesn't match individual retail hobbyists alone. It resembles institutional storage, mining treasury operations, or custody-adjacent cold holdings. If I'm reading the cluster patterns correctly, this theft might not be 500 individual victims. It could be a concentrated group of whales. That would explain why the attacker hasn't moved the full amount: 562 BTC is still sitting in the attacker-controlled address. They're not dumping onto an open market and crashing their own payout. They're extracting slowly, methodically, waiting for the heat to dissipate. Follow the smart money, not the hype โ and the smart money just got a brutal lesson in hardware trust.
The market impact is a rounding error. 594 BTC against Bitcoin's daily volume is noise. But the structural damage to the self-custody trust model is enormous, and it won't show up in a price chart. The next signal I'm watching: whether Ledger, Trezor, and every other hardware wallet vendor start auditing their own MicroPython and STM32 RNG paths with the urgency this event demands. If I were a compliance officer at any of these firms, I'd already have the firmware diff open and a forensic auditor on the phone. The same dependency exists everywhere.
Coldcard users need a migration plan, not a Twitter thread. The rest of us need to remember that 562 BTC is still out there, in a monitored address, waiting for its moment. When the attacker eventually moves it, the chain will tell us everything.
Code doesn't care about your feelings. But the on-chain evidence always tells the truth. I'm listening.