The Coldcard Exploit, Explained: Is Your Bitcoin Safe?

Last updated: 9:45am ET, July 31, 2026. This is a developing situation. We are updating this post as facts are confirmed.

What happened

Yesterday, roughly 594 bitcoin, about $38 million, was stolen from roughly 500 wallets in 25 minutes. Block's security team has since identified earlier transactions bearing the same fingerprint that may carry the total past 1,000 bitcoin, though that figure remains unconfirmed. Every coin taken sat behind a private key that had been generated on a Coldcard hardware wallet.

Nobody broke into these devices. Nobody was phished, and no one typed a seed phrase into a fake website. The owners of these wallets made the leap to self-custody that every best-practice guide recommends, and their funds were exposed anyway, because of how the keys were made in the first place.

How the keys were made

A hardware wallet has one job that matters more than every other feature it ships with. When you set it up, it has to generate a genuinely random number, because your seed phrase, and every key derived from it, is built on that number. Coldcard devices contain a dedicated hardware random number generator for exactly this purpose. According to the technical analysis published by Block's bitcoin engineering and security teams, the firmware never actually used it. A configuration error, sitting in public code since March 2021, silently routed key generation through a simple software generator seeded from the chip's serial number and its internal clock, two ingredients an attacker can guess, profile, or reconstruct. On the newer models the secure chip's contribution was real but cut down to 32 bits before it was used. The keys that came out of this process looked random. They were not.

If you take one sentence from this post, take this one: the random number was not as random as everyone believed, and there was no way to see that from the outside.

Which devices are affected, and what to do about it

This moved fast and a lot of yesterday's coverage is still circulating with the wrong scope, so it is worth being precise.

Coinkite, the company behind Coldcard, published an advisory Thursday evening stating that seeds generated on an Mk3 running firmware 4.0.1 or later are at risk, and that the Mk4, Q and Mk5 are "not affected based on our early analysis." Several hours later, Block's team published its full root-cause analysis, having shared its findings with Coinkite first, concluding that every current model is affected at differing levels of difficulty. Overnight, Coinkite updated its advisory. The company now says the newer models are affected as well, and it has shipped new firmware that fixes how keys are generated from here on. The two sources now agree on the shape of the problem. The remaining disagreement is about how much security existing keys actually carry.

The design target for a bitcoin key is 128 bits of security, a number so large that no computer will ever grind through it. Coinkite's estimate for keys made on the newer models is about 72 bits, far short of the promise but still an enormous search, the kind that costs real money and real time. Block's analysis says only 32 bits of genuine randomness made it into the process, which works out to about 4.3 billion possibilities, and one gaming graphics card can chew through that. Coinkite is saying weakened, but still a hard target. Block is saying weakened to the point a hobbyist could crack it. Nobody is saying safe anymore.

Here is the guidance in plain terms:

• If you bought and set up a Coldcard between March 2021 and mid-2023, that window covers the firmware at the heart of this. Assume the seed is compromised.
• If you set up an Mk4, Q or Mk5, your seed is weakened. Both teams agree on that; they disagree on how much. Treat it as something to rotate, calmly, soon.
• If your device predates 2021 and never ran the affected firmware, you are likely fine.
• Upgrading firmware today does not repair a seed that already exists. The fix going forward does nothing for keys made in the past.

Those are the broad strokes. To figure out exactly where you stand, work through the questions below in order and stop at the first one that describes your setup.

Did your seed come from a Coldcard at all? If it was generated on another vendor's device or through a custody provider, this specific issue does not apply to you. If you used Coldcard's own dice import path with enough rolls, it does not apply either; more on that below.

Mk2 or Mk3 on affected firmware, single-signature, no passphrase, no dice rolls. This is the group that was drained on Thursday. Assume the seed is reconstructable and move funds today. Developers tracking the attack believe every wallet in this category will eventually be swept, and Block warns that exploitation is likely ongoing.

Did you use dice rolls? Independent developers have verified it is safe, provided enough rolls were used. The dedicated dice import path calls for 99 rolls, which works out to roughly 256 bits of entropy. If you used that path as documented, this exploit does not touch you.

Do you use a strong BIP39 passphrase? Then your coins are now only as safe as that passphrase. That is better than nothing and worse than you assumed. Seven BIP39 words chosen at random carry about 77 bits, and the consensus suggestion is more than that. Treat anything shorter as temporary cover while you migrate.

Is the wallet multisig? Multisig protects you when the keys are genuinely independent. If enough of your signing devices are affected Coldcards to reach the spending threshold on their own, they are not independent, and the arrangement inherits the flaw. Block's report puts it plainly: a quorum of secure devices is necessary. Attackers went after single-signature wallets first because that is where the yield per unit of compute is highest. A multisig wallet with affected keys is the same attack with a bigger price tag: crack enough weak seeds to reach the threshold instead of just one. If that describes your setup, treat it as compromised on the same timeline as single-sig and rotate the affected keys out with replacements generated elsewhere.

Did you ever export this seed anywhere? Anywhere includes another wallet brand, another chain, a backup tool. Still compromised.

The short version: seed born on a Coldcard, single key, no dice, no strong passphrase, move your funds today.

The scam wave has already started

Within hours of the news, fake "verify your wallet" and "migrate your funds" messages began circulating, harvesting seed phrases from frightened people.

No legitimate company will ever ask for your seed phrase. Not Coinkite, not us, not anyone. Never type your seed into a website, a form, a chat window, or a phone, and assume that anyone who messages you offering to help recover your funds is attempting to take them. People get robbed twice in weeks like this: once by the flaw, and once by the response to it.

If you need to move funds, slow down

The greatest risk to you this morning is probably not the attacker. It is a rushed migration made by someone who is frightened. The right move depends on who you are, so here are two honest paths.

If you are comfortable with wallets and want to stay in self-custody, the sequence experienced developers recommend is: generate a new seed on unaffected equipment, verify the receiving address on the device screen itself, send a small test amount, confirm it arrives, then move the remainder. At no point should your seed phrase touch a computer or a phone.

If that paragraph reads like a foreign language, do not attempt it hastily. The advice we would give a family member is to get the coins somewhere with professional key management first and sort out the long-term home second. That can be an exchange you already use and trust, or a custodian like us. You are trading one kind of risk for another and doing it under time pressure, so go in with your eyes open, but a calm stopgap beats a botched migration.

If you want a person to walk you through either path, we are holding custody walkthrough calls all week, client or not [book a call here]. A lot of people want to do something right now and are scared to do it wrong. That is a reasonable thing to feel, and support beats speed.

Why this is bigger than one vendor

It would be easy, and wrong, to file this as a story about one company's bug.

The failure mode generalizes. This was a silent fallback in an entropy path, buried in firmware, invisible to the user and effectively unaudited for five years. Every hardware vendor has an entropy path. Every one of those paths is being read this week by people working with a new kind of assistance.

That is the second thing that changed on Thursday. Once rumors of the thefts began circulating, a security researcher pointed an AI model at the firmware, and the model identified the bug within two prompts. Another researcher cloned the repository and had a model locate the flaw independently. A Bitcoin Core developer reproduced key theft on a fresh, untouched device using nothing more exotic than the number of button presses made during setup, and summarized the afternoon: "Bots made this trivial." Bitcoin Optech, the developer newsletter of record, told its readers that the attack is easy to reproduce with AI assistance.

Precision matters here, because the precise version is more sobering than the caricature. Nobody's chatbot found this on its own over breakfast. The researcher who found the flaw had verified research access to the model, knew what he was looking for, and still had to work around the model's restrictions at later stages. The digging was real. What changed is that AI compressed it: work that once meant a specialist's career skill became an evening of guided effort, and once the path was public, reproduction became trivial. The researcher has also said there are further entropy issues in newer models working through disclosure channels. This story has a second act.

Then there is what happened to the security estimate once the flaw became public. A bitcoin key is designed to carry 128 bits of security. By late Thursday evening, researchers working the problem in the open put the effective security of affected wallets at roughly 2^70, an estimate they revised downward twice in under three hours. Moving from 2^128 to 2^70 makes a key roughly 288 quadrillion times easier to attack. One developer, scanning only the first address of each known-victim wallet, recovered two private keys holding about 34 bitcoin. The exercise took five minutes and less than five dollars of GPU time. The wallets had carried this weakness since the day they were set up. What changed on Thursday is that everyone could see it.

The conclusion to draw is about architecture, not about which brand sits in your desk drawer. Nobody can guarantee the entropy inside any single device, and this week proved that even diligent users cannot audit it themselves. What you can guarantee is that one bad number, wherever it comes from, never stands alone between an attacker and your savings. That is what multisig is for. A properly built multisig arrangement involves enough independent randomness that a flaw like this one is practically impossible to exploit, and that is why multisig should be the standard for anyone holding a meaningful amount of bitcoin.

What we built, and why

We built Onramp because we deeply understand how custody works and what issues can arise with these devices. The system is designed to be fault tolerant and remove single points of failure, so even if something goes wrong, funds are safe and can be recovered. That's the realistic starting point for true peace of mind. Instead of hoping for a perfect device that does not exist, we designed an architecture where your security does not depend on any single point of failure.

Given that, the only custody question that matters is what happens to your bitcoin when any single component fails. If the honest answer is total loss, the architecture is wrong, regardless of how good the component is.

Multi-Institution Custody is our answer to that question. Three independent, regulated institutions (Onramp, BitGo and CoinCover) each generate and hold one key to your vault. Keys are created using institutional key-generation practices and sharded into pieces, so that no complete key ever exists in one place or in anyone's hands. You hold a direct legal agreement with each institution separately. Moving funds requires two of three approvals, and you are the only party who can initiate a transaction. No institution, including Onramp, can act alone.

Self-custody is part of what makes bitcoin open to everyone, and we do not want a world without it. But this week showed, again, that it is error-prone even for people who do everything right. Self-custody multisig fixes the error problem and creates an assembly problem: sourcing independent keys, coordinating vendors, planning for inheritance, all of it on you. Multi-Institution Custody is multisig security with the assembly work removed.

The practical consequence, this week, is simple. There is no seed for you to generate, which means there is no entropy for you to get wrong. There is no device to update, no firmware to audit, no serial number and clock standing between an attacker and your savings. And if any one institution in the arrangement were to suffer a failure of its own, whether a breach, an insolvency, or a bug of exactly this kind, your funds do not move. A provider failure is a defined process, not a crisis.

We are not going to claim that Onramp cannot fail. Any vendor making that claim this week should be ignored on principle. The claim we make is narrower and, we think, more useful: no single failure, including one of ours, can move client funds.

One honest question to end on. When you read about the Coldcard incident, were you, even for a second, worried about your own bitcoin? If the answer is yes, it is worth an hour to fix the reason why.

[Book a custody walkthrough →]

Sources and further reading

• Coinkite security advisory 
• Coinkite Technical Deep Dive into the Entropy Issue 
• Block bitcoin engineering and security, "Predictable RNG fallback and 32-bit reseed in COLDCARD firmware" 
• Bitcoin Optech PSA (July 30, 2026)

Our thanks to the researchers and developers who worked on this problem in public and at speed on Thursday, and our sympathy to everyone who lost bitcoin. If you are affected and want to talk to a person, our team is available this week whether or not you ever become a client.