Coldcard Firmware Vulnerability: RNG seed flaw triggers ~$112M BTC theft

The Coldcard firmware vulnerability has escalated self-custody worries after investigators linked attacks to a seed-phrase RNG flaw. The later report says the first wave started on July 30, 2026, draining ~1,083 BTC from 1,000+ addresses in 41 minutes, followed by additional theft waves. This was not a Bitcoin blockchain break. Instead, the Coldcard firmware vulnerability is tied to random number generation used to create mnemonic seed phrases. If seed generation becomes predictable, attackers can narrow seed possibilities, potentially derive private keys, and empty affected wallets. Losses reportedly kept growing into mid-August, with total theft figures cited around $112M (on the order of hundreds of millions), spanning thousands of addresses. The root cause traces to a Coinkite firmware update released in 2021, with earlier reports noting an entropy regression. Crucially, upgrading firmware may not protect funds secured with previously generated seeds. Coinkite guidance emphasizes updating to firmware 4.2.0+ and regenerating seed phrases, with users potentially needing to move funds. The company also suggested stronger BIP-39 passphrases as an extra layer and said it has begun destroying remaining vulnerable inventory. For traders, the market takeaway is risk management: incidents targeting address-level holdings can quickly change sentiment. Expect renewed interest in operational hygiene and potentially multi-signature setups to reduce single-device compromise risk.