A five-year-old firmware bug has cost Bitcoin’s most diligent holders more than $100m — without a single device being touched. The lesson is not that self-custody is broken, but that the trust assumptions of each setup needs to be verified rather than trusted.

• Why it matters — More than 5,200 addresses have been drained of roughly 1,800 BTC (on the order of $114m) across four waves of sweeps, and the victims were precisely the long-term, cold-storage holders hardware wallets exist to protect. Their coins had sat untouched for an average of more than three years.
• How it happened — A March 2021 Coldcard firmware change quietly routed seed generation through a weak software randomiser instead of the device’s hardware chip, collapsing the keyspace from an unguessable 2^128 possibilities to as few as 40 bits. Attackers reproduced candidate seeds offline, checked the public blockchain for balances, and swept.

 

The pitch for a hardware wallet has always been reassuringly physical. Keep your keys on a small air-gapped device, never let it touch the internet, and the only way a thief gets your bitcoin is by getting your device. Coldcard, made by Coinkite, a Canadian firm, built one of the industry’s best reputations on exactly this promise: Bitcoin-only, source available, beloved of the security-obsessed. Which is why the events of late July were so jarring. Thieves have now drained roughly 1,800 BTC from more than 5,200 addresses whose owners did everything the orthodoxy prescribes. They never clicked a phishing link. They never exposed a key. Their devices never left the safe.

The flaw was not in Bitcoin, nor in the devices’ hardware, nor in anyone’s operational discipline. It was a single firmware change, committed in March 2021, that quietly rerouted seed generation away from the device’s dedicated hardware random-number generator and through a weak software substitute. Randomness is the bedrock of key security: a standard 12-word seed is meant to be drawn from a space of 2^128 possibilities, a number so vast that guessing is hopeless. The buggy firmware collapsed that space to roughly 40 bits of effective entropy on older Mk2 and Mk3 devices, and about 72 bits on the later Mk4, Mk5 and Q models. Forty bits is around a trillion possibilities. To a laptop, that is a weekend’s work.

Whoever found the flaw first did not need to touch a single device. They generated candidate seeds offline, derived the corresponding addresses, checked the public blockchain for balances, and swept. The first wave, on July 30th, took some 1,083 BTC from 1,196 addresses in 41 minutes. Three further waves followed within days, mapped in near-real time by Galaxy Research, whose analysts counted 1,367 BTC across 4,585 addresses by the weekend and flagged a fourth wave — another 449 BTC from around 700 addresses — still running on August 3rd. The stolen coins had sat untouched for an average of more than three years. These were not traders. They were precisely the long-term, cold-storage holders the product was designed for.

 

The audit that wasn’t

Two details make the episode more uncomfortable than the average exploit post-mortem. The first is duration. The bug shipped in firmware version 4.0.0 and sat in a source-available codebase, in public view, for over five years. Source-available software’s great boast is that many eyes make bugs shallow; here the eyes were evidently elsewhere. (Coinkite has noted that AI-assisted code review may have played a role in the flaw’s eventual discovery — and that its own earlier AI review missed it. Both facts will feature in security-conference talks for years.) The second is the failure mode. Most hardware-wallet incidents involve supply-chain tampering, physical extraction or user error. This one undermined the device’s most fundamental claim: that the keys it generates cannot be guessed.

The code was the fortress. The flaw was in the ceremony that forged the keys to it.

Coinkite’s response has been swift, if sobering. It confirmed the flaw, shipped emergency firmware for every affected model, halted shipments and destroyed remaining stock carrying the bad code. Its founder took public responsibility. But the fix comes with an asterisk large enough to warrant its own advisory: updating firmware does nothing for a seed already generated on a vulnerable version. The randomness was weak at birth; no patch can retrofit it. Affected users must generate a fresh seed on fixed firmware and migrate their coins — carefully, and quickly, since the attacker (or attackers; Galaxy will not say whether the waves share an operator) is plainly still working through the vulnerable keyspace. In a grimly novel twist, the fourth wave’s sweep transactions were broadcast with replace-by-fee enabled, meaning alert victims could, in principle, outbid the thief for their own coins while the transactions sat unconfirmed. Bitcoin’s fee market as hostage negotiation.

There are mitigating clauses. Wallets set up with substantial user-supplied entropy — at least 50 dice rolls — or protected by a strong, unique BIP-39 passphrase are far less exposed, because the attacker’s search space balloons back to something intractable. Multisignature arrangements were untouched by the first three waves. Coinkite’s other products (Tapsigner, Opendime, Satscard) use different code and are unaffected. Block, Trezor and Ledger have all confirmed their devices do not share the flaw. This was one vendor’s build error, not a category-wide collapse.

 

Verify your entropy

The tempting headline — self-custody is dead — gets the lesson exactly backwards. Bitcoin’s cryptography performed as designed. The network was never at risk. The same public ledger that let the attacker check balances also let researchers map every sweep within hours, share victim patterns and hand some 600 suspected attacker addresses to investigators. Try getting that visibility from a failed custodian; creditors of several defunct exchanges are still waiting.

What the episode does demolish is the idea of self-custody as a purchase rather than a practice. A hardware wallet is not a talisman. It is one layer in a stack whose weakest element — here, a single line of seed-generation code — defines the whole. The rational response is layered defence: passphrases or dice-roll entropy at setup, so that no vendor’s randomness is a single point of failure; multisig across different devices and ideally different manufacturers for meaningful holdings; and treating firmware provenance and seed generation as the critical security moments they are, rather than setup chores to be rushed through.

For Coldcard users, the immediate to-do list is unambiguous: establish which firmware generated your seed, and if it falls in the vulnerable window — or if you are unsure — update, generate a new seed and migrate. For everyone else, the homework is only slightly less urgent: this is an excellent week to re-examine assumptions about your own wallet setup.

 

The Apollo Crypto View

Every cycle produces an incident that gets misread as an indictment of the asset class when it is really an indictment of complacency. Mt Gox was not a failure of Bitcoin but of custody; FTX was not a failure of crypto but of governance; Coldcard is not a failure of self-custody but of the fiction that security can be bought once and forgotten. The holders hit hardest were, painfully, among the most careful in the ecosystem — which is the point. Diligence applied to a flawed assumption compounds the flaw. The durable takeaway for allocators and individuals alike is that key management is a living process: verified entropy, layered signers, periodic review. Self-custody remains the correct long-term architecture for a bearer asset precisely because its failures are visible, attributable and fixable. This one was all three.