Introduction
On July 30, 2026, an unidentified attacker swept 1,196 Bitcoin addresses in under three quarters of an hour, making off with 1,082 bitcoins worth approximately 70 million dollars at the time of the attack. More recent estimates put the total above 88 million dollars, spread across 4,585 compromised addresses. This was not phishing. It was not social engineering. It was the predictable consequence of a broken random number generator quietly embedded in the Coldcard hardware wallet firmware since March 2021.
One Misconfigured Macro, Five Years of Silent Exposure
Coldcard is manufactured by Canadian company Coinkite. The vulnerability traces back to a firmware integration error: the configuration variable MICROPY_HW_ENABLE_RNG was set to zero in the production build profile. The libngu library tested for the macro's existence rather than its actual value — causing the build to silently fall back to MicroPython's software PRNG, an algorithm called Yasmarang, instead of the STM32 chip's hardware random number generator.
This fallback PRNG initialized solely from the chip's unique identifier and timer registers, with no fresh entropy collection after startup. Effective entropy dropped to approximately 40 bits on Mk3 devices, and 72 bits on Mk4, Mk5, and Q models — far short of the 128 bits required for a standard BIP-39 seed phrase. The gap is not trivial: every missing bit of entropy halves the search space an attacker needs to brute-force.
From Mathematical Weakness to Real-Time Exploitation
An attacker who knows the PRNG's input range can reproduce all candidate output streams offline, derive the corresponding Bitcoin addresses, and cross-reference them against public blockchain data to identify which ones hold funds. Galaxy Research, which mapped the attack, confirmed this exploitation pattern. Approximately 600 addresses were reported to US federal authorities. The affected models span firmware versions 4.0.0 through 4.1.9 on Mk2 and Mk3 devices, and all versions prior to 5.6.0 on Mk4 and Mk5.
A Patch With Explicit Limits
Coinkite released emergency updates on July 31 for all affected models. The accompanying advisory is unambiguous: installing the patch does not fix an existing seed. Users must generate a new seed on patched firmware and transfer their funds to the new addresses. The only users not at risk are those who used physical dice — at least fifty independent rolls — when originally creating their wallet.
What IT and Security Teams Should Take Away
This incident is a textbook example of a particularly dangerous vulnerability class: silent flaws that produce no detectable anomaly for years, yet become nearly instantaneous to exploit once the conditions are met. Randomness quality is an absolute prerequisite for any cryptographic system — whether hardware wallets, enterprise HSM modules, or TLS certificate generators.
For CISOs and security architects, the lesson is direct: firmware parameters related to key generation require explicit integration tests, not simple macro presence checks. Every toolchain update should trigger a review of embedded cryptographic libraries. The window between discovering a weak key and exploiting it is shrinking toward zero. Forty-one minutes just made that brutally clear.