A code change from March 2021 quietly broke random number generation on Coldcard hardware wallets, leaving an estimated 1,367.05 BTC across 4,585 addresses exposed to potential theft. The flaw, disclosed by CryptoSlate and analyzed by Block and Coinkite, affects multiple Coldcard models and firmware versions. Galaxy Research published the loss estimate on August 2, as users rushed to move funds.
How the bug happened
On March 1, 2021, a change to Coldcard's seed generation code switched to a new library. The setting MICROPY_HW_ENABLE_RNG was set to zero, causing the device to fall back on the deterministic Yasmarang random number generator instead of the hardware RNG. The result: seeds with far less entropy than expected.
Affected firmware versions include Coldcard Mk2 and Mk3 from 4.0.0 or 4.0.1 up to 4.1.9; Mk4 and Mk5 before standard 5.6.0 or Edge 6.6.0X; and Q before standard 1.5.0Q or Edge 6.6.0QX. The effective search space for Mk2 and Mk3 seeds was roughly 40 bits — trivially brute-forceable. For Mk4, Mk5, and Q, it was about 72 bits, with at most 2^32 securely distinguishable streams under fixed conditions.
What's at risk
Galaxy Research's estimate of 1,367.05 BTC is based on addresses generated during the vulnerable period. That's a lot of money, and the timing isn't great for Coldcard's reputation. An unverified first-person account reported 18.25245043 BTC leaving wallets on July 29 — possibly an early victim or a precautionary move. After the disclosure, a defensive migration of 77,402 BTC from older UTXO bands took place, suggesting many users acted quickly.
What users should do
Updating to the latest firmware protects future seed generation, but it doesn't fix existing seeds. Those remain weak. Users must create a new seed using trustworthy entropy — ideally from a source they control — and move their funds to the new wallet. Coldcard has published instructions for the migration.
The unresolved question: how many of those 4,585 addresses still hold funds, and how many attackers already know the trick? The 18 BTC outflow on July 29 suggests someone may have been testing the waters.
