Coldcard Mk3 firmware RNG flaw: 1,367 BTC stolen

Galaxy Research says a Coldcard Mk3 firmware RNG flaw (notably firmware 4.0.1+) let attackers predict wallet seeds and drain funds without physical access. Total theft rose to 1,367.05 BTC (about $88.6M) across 4,585 affected addresses, executed in three coordinated waves—more than double earlier estimates (~594 BTC). Timing appears central. On July 30, 2026, the largest wave stole 1,082.65 BTC in 41 minutes. Galaxy reports the first two waves shared the same transaction “fingerprints,” including a hardcoded 30 sat/vB fee and consistent batching patterns, while the third wave differed, suggesting a change in tactics or toolset. The root cause is weak, predictable randomness introduced in March 2021. Block’s Bitcoin Engineering team previously identified the issue in vulnerable firmware builds (4.0.0–4.2.0), and Coinkite issued an advisory ~30 hours after the first sweeps began. Coldcard Mk4, Q, and Mk5 are not believed to share the same flaw. Traders should note the affected Coldcard Mk3 firmware flaw involves seed generation risk: Galaxy urges users to migrate to a freshly generated wallet on newer, unaffected hardware rather than simply transferring within the same compromised seed. Attackers also used premium fees (30–75x the median fee) to secure fast confirmations. BTC’s price impact looked limited in the reports, with BTC hovering near $63,000 at the time.