Coldcard Drain Hits $88 Million: A 40-Bit Seed Bug Still Feeding the Attacker

The total keeps rising as later sweeps broaden the impact

The first major visible hit was a fast 1,082.65 BTC worth about $70.2 million swept in 41 minutes. A later onchain review suggested the losses were still growing, with reporting placing the total near $88.6 million / 1,367.05 BTC. That does not mean every later estimate is final, but it does show this is not yet a closed incident.

Galaxy Research also flagged a third wave of sweeps tied to weak Coldcard keys, with the attacker moving toward smaller balances. That matters because the problem is not just one large drain. As long as vulnerable seeds remain in use, new outflows can keep appearing.

Coinkite says updating the firmware does not change or repair an existing seed, and affected users are being told to move their coins as soon as possible. For the market, that keeps the incident as a trust overhang around self-custody credibility, not just a one-day headline.

Why the Coldcard failure matters more than a single hack

The core failure was simple: the wallet stopped producing true randomness. A March 2021 firmware integration error routed seed generation to a software pseudorandom fallback instead of the device's hardware RNG. In plain English, the code path meant to use hardware randomness quietly fell back to a backup generator that should not have been used for production keys.

From 128 bits to a guessable space

Users buying a 12-word Coldcard seed generally expect 128 bits of security. On Mk3, the flaw collapsed that to roughly 40 bits of effective entropy. That is not a small slip. It turns an otherwise impractical key space into one that can be narrowed, regenerated, and checked offline against public blockchain data.

Block found that the fallback path was initialized from the chip's unique ID and timer registers, with no fresh entropy after initialization. Once those inputs can be reasonably estimated, the problem stops being a remote breach and becomes an offline search problem: generate candidate seeds, derive addresses, and see which ones match what already sits on-chain.

Coinkite has said the attacker used AI to find a flaw that its own AI review had missed weeks earlier. That is notable, but it should be treated as an allegation about how the bug was discovered, not as a proven fact.

Later models are better, but not immune. Coinkite estimates roughly 72 bits of entropy on Mk4, Q, and Mk5. That is stronger than Mk3, but still far below the 128-bit baseline many users expect.

The important point for users is straightforward: patched firmware stops future weak seeds, but it does not fix keys already created on the vulnerable path.

The bigger market risk is trust, not just lost coins

The near-term question is not whether Coldcard failed. It is whether that failure spills into the broader hardware-wallet category. The containment argument is real: Block, Trezor, and Ledger have confirmed their products are unaffected. But sentiment can still weaken if users start questioning the broader claim that hardware wallets are the safest BTC custody layer.

The risk is concentrated, but easy to overgeneralize. The most exposed group is MK3 Coldcard devices that created seeds without dice-roll entropy or an extra passphrase. Engineers can draw that boundary precisely. Markets may not.

What to watch next

For now, this looks like an active negative catalyst for Coldcard sentiment and for any market exposure tied to hardware wallets as a self-custody layer. The incident becomes easier to fully price only if the sweep activity slows and fewer vulnerable wallets are affected over time.