Coldcard’s Five-Year Entropy Bug: What a $116 Million Bitcoin Theft Says About Self-Custody

Five Years of Predictable Keys

The security of a Bitcoin wallet rests on one assumption: that the number used to generate your private key was genuinely random. In March 2021, a build configuration change in Coldcard’s firmware quietly broke that assumption. It stayed broken until July 2026.

The mechanism is almost mundane. Coldcard devices carry a dedicated hardware random number generator on their STM32 microcontroller. The configuration change switched it off in production builds. Rather than failing loudly, the firmware’s ngu.random call fell through to MicroPython’s Yasmarang generator, a deterministic algorithm seeded from the microcontroller’s identifier and system timing values. Neither input is secret. Neither is unpredictable.

Block’s engineering team, which published the technical analysis, stated it plainly: the firmware “contains an RNG integration error that causes ngu.random to use MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware RNG.” Coinkite’s own estimate puts effective entropy at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q, against the 128 bits a 12-word BIP-39 seed is designed to carry — brute-forceable with modest computing resources and no physical access to the device at all.

Forty-One Minutes

Someone eventually worked this out. On July 30, 2026, an automated tool began sweeping affected wallets. In a single 41-minute burst it emptied 1,196 addresses of roughly 1,083 BTC, about $70.2 million. Every transaction carried an identical hardcoded fee of 30 satoshis per virtual byte and left no change output — the signature of a script working through a precomputed list, not a person picking targets.

The sweeps continued in waves. Galaxy Research’s running tally has reached roughly 1,816 BTC, close to $116 million, drained from more than 5,200 addresses. Coinkite shipped emergency firmware on July 31: 4.2.0 for Mk2 and Mk3, 5.6.0 for Mk4 and Mk5, and 1.5.0Q for the Q.

Patching Your Device Does Not Save Your Coins

This is the part that matters most, and the part most coverage buries. Installing the patch corrects how your device generates future keys. It does nothing for a seed that already exists. If your seed was created on a Coldcard between March 2021 and the patch, that seed is weak whether or not you update. The only remedy is to generate a fresh seed on patched firmware and move your coins to it.

The affected firmware:

• Mk2 and Mk3: versions 4.0.1 through 4.1.9
• Mk4 and Mk5: anything before 5.6.0 standard, or 6.6.0X Edge
• Q: anything before 1.5.0Q standard, or 6.6.0QX Edge

One group escapes. Users who generated their seed from at least 50 independent dice rolls supplied their own entropy and never depended on the broken generator at all. The obsessive option, mocked for years as security theater, is the one that held.

Where the Damage Compounds

In markets with functioning banks and deposit insurance, a drained wallet is a catastrophe for the holder. In the places where Bitcoin found its most practical use, it is something worse.

Across much of Latin America, sub-Saharan Africa, and South Asia, crypto is not a speculative side position. It is a hedge against a currency shedding a third of its value in a year, a remittance rail that undercuts the fees charged by incumbents, and a store of savings for people whose banking system either will not have them or cannot be trusted to hold their money. The pitch that brought them in was specific: take your funds off the exchanges, put them on a dedicated device, be your own bank.

Coldcard is the device most often recommended to people who took that advice seriously. It is air-gapped, open-source, Bitcoin-only, with a reputation built on exactly the rigor this bug embarrasses. When the recommended answer fails at its foundation for five years, the cost is not only the coins taken. It is every user who now concludes that self-custody is a specialists’ game and retreats to a custodian, or out of the asset entirely.

What This Actually Teaches

The lesson is not that hardware wallets are a bad idea. A custodial exchange would have exposed the same users to a longer list of failure modes, and the dice-roll survivors show the model works when its assumptions hold.

The lesson is about silent failure. A random number generator that quietly falls back produces output that looks entirely correct: well-formed keys, working addresses, transactions that confirm. Nothing appeared wrong for five years because nothing about weak randomness is visible from the outside. Open source did not catch it. Neither did audits, nor a user base unusually willing to read the code.

If you hold Bitcoin on a Coldcard, check your firmware version tonight, and if that seed was generated after March 2021, treat it as compromised and move the funds. If you build anything that depends on entropy, the takeaway is narrower and harsher: an RNG that fails open is more dangerous than one that fails shut, and the only real defense is a test that asserts the source you think you are drawing from is the source you are actually getting.