Coldcard's firmware has carried an entropy bug since at least 2021, and it's now been linked to the loss of more than $100 million worth of bitcoin. The flaw made private keys guessable when users generated them on single-seed wallets without an extra passphrase, dice rolls, or custom entropy. The fallout is already shifting how the self-custody crowd protects its coins.
The bug that wouldn't die
The weakness sat undiscovered for years inside Coldcard's code. For users who relied on a single seed and didn't add their own randomness, the private keys became predictable. Hackers could work backward from the weak entropy and drain wallets.
That's not a theoretical risk. Real coins left single-seed Coldcard wallets, mostly from people who kept everything in one place. The bug's long shelf life makes it worse—it wasn't a quick patch; it was a slow leak that went unnoticed.
What happened after the news broke
The response was fast. Nick Neuman, CEO of Casa, said 233,000 bitcoins moved to safety in reaction to the Coldcard hack. That's a lot of coins changing hands in a hurry. It also triggered a viral trend in multisig wallets—users suddenly wanted more than one signer between their funds and the door.
Multi-vendor multisig wallets, where no single hardware maker controls the whole setup, are now the standard experts are pointing to. The idea is to spread trust across different manufacturers so one buggy device can't bring down an entire stash.
Coldcard isn't alone
This isn't the first wallet to stumble on randomness. Trust Wallet has had similar entropy bugs. And malicious mobile wallets have stolen user funds by keeping a copy of the private keys they were supposed to protect—the iOS Sparrow Wallet was a fake that did exactly that.
The pattern is consistent: when a wallet's key generation gets loose, the user pays the price. Coldcard just became the biggest cautionary tale.
The hard truth about self-custody
Most lost bitcoin in self-custody cases doesn't come from hacks. It comes from user mistakes—bad backups, forgotten passwords, or simple carelessness. The Coldcard incident is a reminder that self-custody is an advanced practice, not a beginner's hobby.
Experts now suggest treating every hardware wallet as a single point of failure. That means multi-vendor multisig, not just a second device from the same company. It's more friction, but after a $100M lesson, it's the price of doing it right.
The shift to multisig isn't a trend anymore—it's the baseline. For anyone still on a single-seed Coldcard wallet, the move isn't optional.
