Coldcard firmware flaw weakens seed entropy, 594 BTC drained from wallets

2 min

A Coldcard firmware flaw weakened seed-generation entropy on specific older devices, exposing some Bitcoin wallets to compromise and correlating with a reported sweep of about 594 BTC from roughly 500 single-signature wallets on July 30–31, 2026.

Scope of the Vulnerability

Validated notes attribute the issue to a seed-generation weakness where the hardware RNG was replaced by a predictable software source. Entropy dropped from 128 bits to 72 bits.

Affected versions: Coldcard Mk3 firmware 4.0.1 through 5.0.3, Mk4 and Mk5 before 5.6.0, and Q before 1.5.0Q.

Seeds generated with a BIP-39 passphrase or with at least 50 dice rolls are not considered at risk under the incident notes.

Why Entropy Matters

Seed security depends on unpredictability. Weak randomness narrows the search space, enabling feasible key derivation even without user error. A seed-generation flaw undermines the wallet at its base layer.

Risk Differences Among Users

Risk depends on device model and firmware that created the seed, and on whether extra entropy or a BIP-39 passphrase was used. Fixed versions include 5.6.0 for Mk4 and Mk5 and 1.5.0Q for Q devices.

Single-Sig Exposure

Attackers targeted single-signature wallets because one compromised seed is sufficient to move funds. Multisig can reduce impact because additional keys are required, though it does not eliminate all risks.

Hardware Wallet Trust Model

Security requires trust in firmware, supply chain, seed generation, backups, signing UX, and update hygiene. Updates must be sourced and verified through official channels. Users should review security advisories and avoid inputting seeds into unvetted tools.

Market and User Takeaways

Determine if the seed was generated on affected firmware and whether a passphrase or sufficient dice entropy was used.
Users with exposure should consult official guidance and avoid third-party “vulnerability checkers.”
Broader lesson: robust custody relies on strong seed generation, secure backups, protected signing, and failure planning.

Sources: Coldcard security materials and public reporting on the July 2026 wallet sweep. For details, see the official Blog.