A Bleak Day for Self-Custody — And What You Need to Do Right Now
For years, the Bitcoin community’s answer to every custody question has been the same: get a hardware wallet, generate your seed offline, never expose your keys to an internet-connected device, and you’re safe. We’ve been fortunate to have several vendors create their own signing devices over the years, and open-source projects like SeedSigner to choose from.
There are signing devices for every price point, and the COLDCARD has been a premium option for those willing to spare no expense and wanting a Bitcoin-only experience. COLDCARD made. by Canadian firm Coinkite, has long been considered one of the most security-conscious devices in that category — air-gapped, open source, built for paranoid users who wanted the absolute best.
That reputation took a serious hit on the 31st July 2026, when Coinkite confirmed a vulnerability in COLDCARD’s random number generator that has already been linked to roughly $38 million in stolen Bitcoin, and put years of previously generated seeds at risk regardless of whether the theft has reached them yet.
This is uncomfortable to write and uncomfortable to read, because self-custody is routinely promoted — including by us — as unambiguously the safest way to hold Bitcoin. It still is, on balance. But this event is a reminder that “safe” was never supposed to mean “beyond scrutiny,” and that even the most trusted hardware can fail in ways that only become visible years after the fact.
It’s yet another lesson in don’t trust, verify.
Not that it provides any comfort for those who have lost funds.
I’ve been there personally; I lost funds on an exchange back in 2016. I recently lost a few Satoshis using Nostr Wallet Connect, but these were hot funds; I knew they would be exposed to some sort of risk, but cold funds that’s another story.
I can’t imagine having to sit there thinking
“I did all the right things: I bought the most expensive wallet with all the bells and whistles, I followed the basic instructions, I moved my funds from a third party, and I still got rugged!”
That is one hell of a bitter orange pill to swallow!
How the “Hack” Happened?
According to an analysis published by Block (the fintech company founded by Jack Dorsey), the root issue lives in how certain COLDCARD firmware versions generated entropy — the randomness used to create your 12- or 24-word seed phrase in the first place.
Instead of relying on sufficiently unpredictable, hardware-generated randomness, affected devices used a “predictable periodic down-counter,” incorporating identifiable elements like the device’s serial number and internal clock.
Because these inputs are far more guessable, and patterns occur more easily than more robust hardware randomness, an attacker who could narrow down the possible seed space had a realistic shot at reconstructing a wallet’s private keys without ever touching the physical device.
The exposure isn’t limited to one product line. Coinkite’s own disclosure states that COLDCARD Mk3 devices running firmware version 4.0.1 or later — a firmware line dating back to March 2021 — are affected by the predictable RNG issue.
Separately, Mk4 and Mk5 devices running firmware before version 5.6.0, and the newer COLDCARD Q running firmware before version 1.5.0Q, generated seeds with only around 72 bits of entropy instead of the expected 128 bits.
Coinkite describes this second issue as less severe, but still explicitly calls it “serious” — 72 bits is a meaningfully smaller search space than 128 bits, and shrinking randomness is exactly the kind of flaw that turns “theoretically possible” into “practically exploitable” as computing power and technique improve. Coinkite’s other products — TAPSIGNER, OPENDIME, and SATSCARD — use different codebases and are not affected.
The actual theft played out fast.
An unidentified attacker drained approximately 594 BTC from nearly 500 separate single-signature wallets in about 25 minutes on a single Friday.
Roughly 562 of those BTC were then consolidated into a single address, where they have sat untouched since. The speed and scale suggest this wasn’t a single opportunistic guess — it looks like an attacker who had already done the work of narrowing down the vulnerable seed space across many wallets and executed a coordinated sweep the moment they were ready.
Critically, Block’s researchers were careful to note the limits of what they could confirm:
Exploiting this doesn’t mean every seed generated on vulnerable firmware is immediately recoverable by any remote attacker. The practical cost of the attack depends on factors like the availability of unique device ID information, boot timing, how many prior RNG calls occurred, and the computational cost of derivation.
No end-to-end brute-force benchmark has been publicly claimed.
In other words: not every affected wallet has necessarily been compromised yet, but the theoretical vulnerability is confirmed, real funds have already been stolen, and there’s no way to know in advance whether your specific wallet is next.
No Update Fix For A Seed Phase
The most unsettling detail in Coinkite’s own disclosure is this: updating your device’s firmware today does not fix a seed that was already generated under vulnerable conditions.
The flaw lives in how the original entropy was created, not in the current firmware running on your device. If your seed was generated years ago on affected firmware, it carries that weakness with it forever — the only fix is to move to a freshly generated seed on updated, non-vulnerable hardware.
Time is Ticking
The key to this whole debacle is that the attack surface actually isn’t large from a computing perspective. In modern cryptography, $2^{32}$ operations is tiny, and several specific factors allow attackers to collapse the search space even further.
1. The Math Problem: $2^{32}$ is Extremely Small
In cryptography, “astronomically large” search spaces look like 2256 (the total number of possible Bitcoin keys) or 2128 (a typical 12-word seed).
However, as Block’s analysis outlines, due to the 32-bit reseed cap on current devices (Mk4/Q/Mk5):
- There are only 232 (4.29 billion) possible RNG streams.
- On average, an attacker only needs to check 231 (2.14 billion) candidates before hitting a match.
Hardware Speed:
A single modern consumer GPU can compute tens or hundreds of millions of cryptographic operations per second. And given the easily accessible GPU resources we have via Cloud services and LLM companies, an attacker can access a cluster of GPU devices and scan all 4.29 billion possibilities in a matter of hours.
Who would have thought, with all the quantum computer brute-forcing drama, it would be a classic computer that would do so much damage.
2. Eliminating Variables on Older Devices (Mk2 / Mk3 v4)
On older models (v4 firmware), there was no secure-element reseed at all, meaning the RNG state depended entirely on device-specific variables. Attackers narrow that down using:
- Fixed Device UIDs: The microcontroller’s Unique ID (UID) is a factory-set serial number. If an attacker knows or can constrain the UID (e.g., from public USB serial metadata, device logs, or prior transactions), the entire UID portion of the state drops to 0 unknown bits.
- Tiny Timer Ranges: The processor’s millisecond timer (
SysTick) only has 80,000 possible values during boot execution. That is an upper bound of just 2 16.3 possibilities—a trivial calculation that takes less than a millisecond on a smartphone. - Correlated Clocks: The Real-Time Clock (RTC) registers (
RTC->TRandRTC->SSR) track time-of-day and subseconds. Because execution happens sequentially at boot, subseconds and timers are heavily correlated rather than independent random numbers.
3. Exploiting Operational Patterns
Instead of testing randomly across all possible inputs, attackers optimise their search:
- Targeting High-Value xpubs: Attackers scrape known extended public keys (
xpubs) or leaked backup files from the web or public block explorers. - Profiling Hardware: By running test benchmarks on physical COLDCARDs under controlled laboratory conditions, attackers measure the exact distribution of boot times and
SysTickcounter ranges. This allows them to prioritise the top 1% most likely boot-timer states first. - Optimised Pipelines: Using custom CUDA/OpenCL code on graphics processing units, they run the Yasmarang PRNG directly into secp256k1 key derivation routines without standard overhead.
The effective “surface” is already constrained by the firmware bug down to 232 candidates or fewer—placing the entire key recovery well within the reach of automated offline scripts.
Don’t Panic — But Act
If you own a COLDCARD, or any hardware wallet, the instinct to panic is understandable, but panic leads to mistakes — rushed transactions, unverified addresses, and desperate use of unsafe tools. Bitcoin isn’t going anywhere in the next hour.
Take a breath, follow a clear process, and move deliberately.
Move to an exchange temporarily if you don’t mind KYC.
If you need somewhere to park funds immediately while you sort out a proper self-custody solution, a reputable, established exchange is a legitimate short-term parking spot. This isn’t a long-term recommendation, and it comes with the usual custodial risk, but a well-known exchange is a safer immediate landing zone than leaving funds on a wallet you now know may be compromised.
While I don’t recommend doing this, if it’s your only choice, or if you wait around to be drained, I would say the exchange is the lesser evil.
If you want to rule out third parties, your steps are:
Move to a hot wallet temporarily.
If you’d rather avoid KYC, a well-reviewed mobile or desktop hot wallet can serve as a short-term holding pattern while you generate a new seed properly. Hot wallets carry their own risks — malware, phishing, device compromise — but for a brief window while you set up a clean cold storage solution, the risk profile is manageable, especially for amounts you can afford to have exposed briefly.
Generate a brand-new seed phrase on a different, unaffected device.
This is the actual fix, not a band-aid. Coinkite’s own guidance is to generate a new seed on updated firmware (or an entirely different device) and verify the new receiving address, then send a small test transaction before moving your full balance. Do not reuse the old seed in any form, and do not simply “re-derive” from the same entropy source that may have been compromised.
If your COLDCARD key is part of a multisig setup, replace that individual key.
You don’t necessarily need to unwind the entire multisig — generate a new key on trusted hardware, add it as a replacement signer, and remove the potentially compromised key from the quorum with yourself or a custody partner. This is one of the underappreciated benefits of multisig: a single compromised key doesn’t mean total loss, provided you act to swap it out.
Add a passphrase, and move funds to that passphrase-protected wallet.
A BIP39 passphrase effectively creates a new, hidden wallet derived from your seed plus an additional word or phrase only you know. Even if an attacker somehow reconstructs your base seed, funds sitting behind a strong, unique passphrase are protected by an additional secret that was never stored on the device’s RNG-generated seed.
This is a meaningful extra layer, not just an inconvenience.
Generate your own entropy rather than trusting the device blindly.
This is the deeper lesson of this whole episode.
As the piece “Do You Trust Your Seed? Don’t Generate It Yourself” argues, relying entirely on any single device’s internal randomness means trusting that device’s engineering completely — and this incident shows that trust can be misplaced even from a well-regarded manufacturer.
Rolling dice, drawing cards, or combining multiple independent entropy sources and mixing them with your hardware wallet’s output means no single point of failure — including a flawed RNG — can fully determine your keys.
The Long-Term Lesson: Multi-Vendor Multisig
The single biggest structural takeaway from this event is that single-signature, single-vendor custody has a single point of failure — and that point of failure can be a bug nobody outside the manufacturer knew existed for years.
The more resilient long-term setup is a multisig wallet using devices from different vendors: a COLDCARD alongside a Trezor and a hardware wallet from a third, unrelated manufacturer, for example, arranged in a 2-of-3 or 3-of-5 quorum. If one manufacturer’s firmware, supply chain, or RNG implementation is ever compromised, your funds remain safe because an attacker would need to compromise multiple independent codebases and manufacturers simultaneously — a dramatically higher bar than exploiting one flaw in one product line.
This event doesn’t invalidate self-custody.
It validates the case for defence in depth within self-custody: strong entropy practices, passphrases, and multi-vendor multisig, rather than blind faith in any single device. Self-custody was never supposed to mean unconditional trust in one company’s engineering — it was supposed to mean you, not a third party, control the final decision about how your keys are secured.
This is a hard day for COLDCARD specifically, but it’s also exactly the kind of event that should push the ecosystem toward more resilient practices rather than away from self-custody altogether.
