Coldcard Exploit: Bitcoin Seed Flaw Drained ~$70M, Risk for Users

A Coldcard exploit targeted weak wallet seeds generated by certain Coldcard hardware wallets on July 30, draining bitcoin from hundreds of addresses. Coinkite (Coldcard maker) says affected Mk3 devices generated seeds with only ~40 bits of effective entropy instead of the intended 128 bits, due to a 2021 firmware/library migration that accidentally routed seed randomness to a weaker software fallback. The result: attacker-guessable seed combinations that still look “normal.” Chain/forensics analysis cited in the report estimates up to ~1,083 BTC (nearly $70M) linked to activity across roughly 41 minutes, following a tightly coordinated burst of about 25 minutes. Victim addresses were largely long-term holders, and theft mechanics showed rapid draining with elevated fixed transaction fees and no change outputs—consistent with automation using prepared keys rather than phishing or malware. Coinkite’s response: users must install fixed firmware and create entirely new seeds before moving funds. Simply updating firmware does not “repair” seeds already generated under the vulnerable randomness. The company lists fixed releases (e.g., Mk3 4.2.0+, Mk4/Mk5 5.6.0+, Q 1.5.0Q+). Risk mitigations mentioned: users who added enough independent dice rolls (at least 50 rolls) and/or used a strong BIP-39 passphrase or multisignature setup were more protected. Coinkite CEO Rodolfo Novak apologized and said attackers may have used AI to inspect code faster, though no proof of discovery method was provided. Competitors (Ledger, Trezor) say they were not affected. For traders, the key takeaway is that the Coldcard exploit is a custody/security event with potential liquidation or exchange transfers from impacted holders, but it does not imply a Bitcoin protocol-level failure.