Major vulnerability in Coldcard hardware wallet: 594 BTC worth about $38 million was drained in 25 minutes
Something big happened again in the Bitcoin space recently.
In the early hours of July 30 (UTC 01:31–01:56), within about 25 minutes, someone swept 594.48 BTC in one go from roughly 500 separate Bitcoin wallets. At the time, it was worth about $38 million. These wallets share one common feature: the seed phrases were generated almost entirely on Coldcard hardware wallets.
Further analysis shows that the actual affected scope may be larger. Research organizations have reported that more than 1,000 BTC and thousands of addresses were taken.
What exactly is the vulnerability?
The problem lies in Coldcard’s firmware.
In March 2021, when firmware version 4.0.0 was updated, there was a build configuration error: the device was supposed to use a chip hardware true random number generator (True RNG) to generate seeds, but instead it mistakenly fell back to a predictable software-based random number generator.
This causes the generated seed entropy value to drop significantly:
On Mk3 devices, effective entropy dropped from the expected 128 bits to about 40 bits
Newer Mk4, Q, and Mk5 models have entropy values of only about 72 bits as well.
40 bits of entropy means an attacker can offline brute-force and predict the private key. They don’t need to touch your device, don’t need phishing, and don’t need physical access.
Many stolen wallets were single-signature and long-dormant addresses; some of the earliest coins can even be traced back to 2021, closely matching the timeline of this vulnerability.
Did AI play a role in discovering the vulnerability?
Coldcard manufacturer Coinkite (a Canadian company) said in its announcement that its source code has always been open source. They suspect that someone used AI tools to review an older version of the firmware code, which is how this issue—hidden for years—was finally found.
Ironically, just a few weeks ago, Coinkite itself also used “the best AI model” to review the code, yet it didn’t find this serious bug. The attacker used the same tools, and it only helped the bad actor.
Official response and mitigation measures
Coinkite has already released an emergency firmware update and clearly warned:
Updating the firmware cannot fix seeds that were already generated using the old firmware
Affected users must generate brand-new seeds and move funds to a new address
Even if the old seeds are generated on firmware that has been updated, they are still not safe
The affected scope mainly includes:
Mk3 devices (firmware 4.0.1 and later)
Some Mk4, Q, and Mk5 generated seeds before the fix
Other hardware wallet manufacturers such as Block, Trezor, and Ledger have confirmed that their products are not affected by this vulnerability.
What does this incident reveal?
Hardware wallets are not absolutely secure. Even Coldcard, known for security, a build error at the firmware level can instantly turn years of “cold storage” into hot assets.
Open-source code + AI is a double-edged sword. AI accelerates vulnerability discovery, but both sides in the battle can use it.
Dormant-address risk is higher. Many victims’ wallets have been left untouched for a long time, giving attackers enough time to prepare and scan in bulk.
Self-custody still requires multiple layers of protection. Relying on only one hardware wallet + single-signature can still be fragile in extreme cases. Multi-sig, isolated backups, and regular firmware checks are a more reliable approach.
Most funds have currently been concentrated in a single address, and subsequent movements are worth monitoring continuously.
If you have used Coldcard to generate seeds (especially Mk3 after 2021), it is strongly recommended that you immediately cross-check against the official announcement and, if necessary, migrate your funds.
Even if a hardware wallet is secure, it’s still just a tool. Real security always relies on ongoing vigilance regarding details.
(Data compiled from Coinkite’s official announcement, on-chain analysis, and reports from multiple security research organizations.)