© 2026 AnChain.AI. All Rights Reserved | Privacy Policy
TL;DR
Hours ago, a firmware integration error caused certain Coldcard hardware wallets to generate Bitcoin secrets using a predictable software pseudorandom number generator instead of the intended hardware random-number generator. During the initial attack wave, approximately 594 BTC—worth about $38 million—was swept from roughly 500 single-signature wallets in just 25 minutes. Most of the funds were then consolidated into a second address holding approximately 562 BTC.
This was not a break of Bitcoin, SHA-256, or elliptic-curve cryptography. The failure occurred earlier: the wallets’ private keys were generated from insufficient entropy. Block’s researchers concluded that attackers who sufficiently constrained the device identifier, timing state, and RNG-call history could reproduce candidate keys offline. (Block Engineering Blog)
The 594 BTC figure represents the first publicly mapped wave. Subsequent investigators identified additional suspected theft waves, so the final loss remains under investigation. (CoinDesk)
Between approximately **01:31 and 01:56 UTC on July 31, 2026—late July 30 in U.S. Eastern time—**an attacker swept 1,324 Bitcoin UTXOs through roughly 500 transactions.
The affected wallets shared several characteristics:
This pattern strongly suggests advance preparation. The attacker likely identified recoverable private keys offline, catalogued funded addresses and then broadcast the sweep transactions in coordinated batches. The precise attacker workflow and attribution remain unconfirmed.
Coldcard is a Bitcoin-only hardware wallet manufactured by Canadian company Coinkite. Introduced in 2017, it is designed to keep private keys offline and supports air-gapped transaction signing through PSBT files, QR codes, MicroSD cards and other isolated workflows.
Coldcard became popular among security-conscious Bitcoin holders because of its Bitcoin-only design, verifiable firmware, secure elements and support for independently generated dice entropy. (COLDCARD)
However, an air gap protects a key from being remotely extracted. It cannot protect a key that was predictable when it was originally created.
Coldcard contained a dedicated STM32 hardware random-number generator. The problem was not missing hardware; it was how the firmware selected the RNG implementation.
The production configuration defined the following macro as zero:
#define MICROPY_HW_ENABLE_RNG (0)
/* Vulnerable check: tests whether the macro exists,
not whether it is enabled. */
#ifndef MICROPY_HW_ENABLE_RNG
#error "hardware RNG required"
#endif
#if MICROPY_HW_ENABLE_RNG
return stm32_hardware_rng();
#else
return yasmarang_prng();
#endif
Because MICROPY_HW_ENABLE_RNG was defined—even though its value was zero—the #ifndef safety check passed. MicroPython then evaluated the value, found it disabled and compiled its Yasmarang software fallback.
The correct validation should have checked the value, such as:
#if !MICROPY_HW_ENABLE_RNG
#error "hardware RNG required"
#endif
The fallback generator was initialized using values derived from the microcontroller identifier, SysTick timer and real-time clock registers. These values may vary, but they are not cryptographic secrets. Once the relevant values and prior RNG-call count are known or sufficiently constrained, the generated sequence becomes deterministic. (Block Engineering Blog)
Coldcard subsequently hashed the generated bytes with double SHA-256. That made the output look uniformly random, but hashing cannot create entropy.
If the original generator can produce only 2³² plausible inputs, hashing still produces no more than 2³² candidate outputs:
|SHA256d(S)| ≤ |S|
Block found that Mk2 and Mk3 v4 firmware added no cryptographically generated secret entropy to this path. Later Mk4, Q and Mk5 implementations added secure-element data, but only four bytes were passed into the reseed operation—creating at most 2³² securely distinguished streams for a fixed fallback state and call history. Practical recovery cost still depends on timing, device metadata and derivation assumptions. (Block Engineering Blog)
An attacker could therefore:
The blockchain itself becomes the validation oracle.
AnChain.AI has been tracing the stolen funds and monitoring the associated Bitcoin activity. The initial flow contains two important addresses. (X post)
Initial collection address
bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0
Approximately 594 BTC was received from hundreds of affected addresses during the initial sweep.
Crypto Tracing on AnChain.AI platform for free: ciso.anchainai.com/s/5IXsMuElhoQ
Primary consolidation address
bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r
Approximately 562 BTC was subsequently transferred from the collection flow into this address. (Bitcointalk)
These figures must not be added together. The 562 BTC represents a downstream transfer of the previously stolen 594 BTC, not a separate loss.
From a forensic perspective, the pattern is significant:
Victim UTXOs → coordinated sweep transactions → collection address → consolidation address
The common timing, transaction structure and downstream consolidation support an inference of coordinated control. They do not, by themselves, identify the human attacker.
Install the fixed release for the relevant model. Coinkite currently lists version 4.2.0 or later for Mk2/Mk3, 5.6.0 or later for standard Mk4/Mk5 and 1.5.0Q or later for the standard Q release.
A firmware update protects future seed generation. It does not repair a seed generated by affected firmware. (COINKITE Blog)
Create a completely new seed using patched firmware or another independently reviewed device. Verify the backup and destination address, send a small test transaction and then transfer the remaining funds.
Do not restore the old seed into another wallet. The weakness follows the seed, not the physical Coldcard. (COINKITE Blog)
For substantial holdings, use defense in depth:
Coinkite states that at least 50 fair, independent and private dice rolls supplied sufficient independent entropy against this specific RNG failure. Users who are uncertain about their original setup should migrate. (COINKITE Blog)
AnChain.AI’s CISO platform can help investigators, victims, law firms and forensic accountants:
AnChain.AI is actively monitoring the Coldcard incident. Blockchain tracing cannot reverse a Bitcoin transaction, but rapid monitoring can identify liquidation points and provide evidence for exchanges, counsel, insurers and law-enforcement agencies. (LinkedIn)
The Coldcard incident demonstrates a fundamental rule of cryptography:
A private key is only as secure as the entropy used to generate it.
Air gaps, secure elements and SHA-256 cannot compensate for predictable randomness. Strong cryptography applied to weak entropy produces a key that looks secure—but may still be recoverable.
🚨 Concerned your Bitcoin wallet or seed may be exposed?
👉 Contact AnChain.AI’s crypto investigation team: https://www.anchain.ai/investigation
© 2026 AnChain.AI. All Rights Reserved | Privacy Policy