Starting on July 30, 2026, the wallets of users of the Coldcard hardware wallet began being drained. The attackers took advantage of a bug in the cold wallet’s key generation code, which allowed them to reconstruct private keys and steal an estimated $130+ million in Bitcoin.
Inside the Attack
The root cause of the Coldcard incident was a bug in how the hardware wallet handled key generation. The devices had a built-in hardware-based true random number generator (TRNG), which was capable of producing cryptographically secure, truly random numbers.
However, a bug introduced into the Coldcard Mk2 and Mk3 firmware versions 4.0.1 through 4.1.9 in March 2021 (and all previous firmware versions of its other product lines) caused the devices to skip this hardware-based generator when creating private keys. The hardware wallet’s random number generation code (RNG) transitioned to Bitcoin Core’s libsecp256k1 via libNgU, a MicroPython library. The issue was that the code silently fell back to MicroPython's pseudo-random number generator (PRNG), because calls to ngu.random.bytes resolved to it rather than the Coldcard’s built-in TRNG.
This was problematic because the PRNG used was seeded with the device UID and the hardware timer value at power-on. These inputs can be guessed by an attacker, and the limited scope of potential seed values means that the private keys produced by the RNG are far less random than desired. In total, there were about 40 bits of entropy or a trillion potential combinations for the Coldcard Mk2 and Mk3, which could be tested in about thirteen days when trying a million keys per second. The Mk4, Mk5, and Q versions had a slightly different implementation, resulting in an entropy of 72 bits.
The Coldcard attackers took advantage of this fact, working through the various input values and generating the associated private and public keys. When they found one that matched an existing address on the Bitcoin blockchain, they had the private key required to transfer the funds that it held to an attacker-controlled account. The attack was performed in multiple waves, resulting in ~7300 addresses affected with total losses exceeding $130 million.
Coinkite, the maker of Coldcard, only maintains customer records for 120 days, rendering them unable to notify most affected users that bought a device within the past five years. The company recommended upgrading to patched firmware and regenerating any impacted private keys.
Lessons Learned from the Attack
The Coldcard incident was notable because it primarily impacted crypto-savvy and security-conscious users. By using hardware wallets, Coldcard owners were following best practice for self-custody. However, this incident has caused many to migrate back to exchanges, which are currently seen as the safer option.
This incident was made possible by a bug that was introduced into the devices’ firmware five years ago. However, the choice to fail silently to a less secure state caused it to be overlooked until an attacker found and exploited it.
Ensuring the security of private keys for self custody can be tricky, since small mistakes can have outsized impacts. Halborn's Key Custody Management offers a holistic, expert review of custody systems to help identify and fix these types of bugs. To learn more about securing your critical software and systems against attack, reach out to Halborn.