The Coldcard wallet exploit emptied Bitcoin wallets whose devices had never touched the internet. How did that happen? In 6 cards

Coldcard, a Bitcoin-only hardware wallet made by Canada's Coinkite, was apparently under attack by July 29, when users began reporting unexplained withdrawals and researchers at Block, the payments company co-founded by Jack Dorsey, traced the activity to a five-year-old flaw in how the devices created wallet seeds.

Jonathan Goodman, a Canadian entrepreneur and one of the victims, wrote in an X post that all 18.2 BTC held across his Coldcard wallets disappeared within seven minutes that evening. At least one device was stored in a safe-deposit box and had never connected to the internet.

Block's researchers began investigating similar reports on July 30 and concluded that affected Coldcards had created seeds using far less randomness than intended, potentially allowing an attacker to reconstruct their private keys remotely.

The Bitcoin was never physically inside the Coldcard crypto wallet. It existed on Bitcoin's public blockchain, while the device held the private keys needed to authorize its movement.

Those keys are derived from a seed phrase, usually 12 or 24 words created when the wallet is first configured. If that starting secret is genuinely random, guessing it is effectively impossible.

Once the attacker reconstructs the correct private key, Bitcoin accepts their signature exactly as it would the owner's.

They never need the original Coldcard, its PIN or an internet connection to it.

A March 2021 software change redirected seed creation away from Coldcard's functioning hardware random-number generator and into a weaker software fallback, according to Coinkite's post-mortem and findings published by Block.

A configuration flag said the standard hardware generator was disabled because Coldcard supplied its own. However, a library checked only whether the flag existed, not whether its value was zero. The code therefore compiled successfully while silently selecting the wrong generator.

"The cryptographic choice was sound. The integration was not," Coinkite said.

Coinkite estimates that affected Mk2 and Mk3 devices created wallet keys with about 40 bits of randomness instead of the intended 128, leaving dramatically fewer combinations to search. The Mk4, Mk5 and Q had about 72 bits, which was stronger but still inadequate.

Block said the time required to guess a key depends on the individual device and its usage, so there's no universal cracking time.

Coinkite suspects someone used artificial intelligence to uncover the flaw in its public code. No published evidence establishes that.

Galaxy Research, the research division of crypto investment firm Galaxy Digital, says it has identified at least three related waves involving more than 1,367 BTC, worth about $87 million at the prices used in its latest update.

Its analysis tracks 4,585 drained Bitcoin addresses, while around 1,367 BTC remains at endpoint addresses attributed to the suspected attacker and hasn't moved.

• One thing to note, though. An address isn't necessarily a separate wallet, device or victim, and Galaxy Research didn't test whether every address was actually created with Coldcard's weak generator.
• It grouped the transactions through their shared fee choices, derivation paths, batching and funnel structure. Galaxy Research said treating the waves as one operator is reasonable, though resemblance doesn't prove common control or the exact attack method.

Block engineer Clay Garrett said in an X thread the operator used a paid account at an unnamed blockchain-services provider to query targeted addresses. The provider's logs reportedly matched the suspected workflow with "extraordinary specificity," and the information has been shared with authorities.

Garrett said there was no evidence the provider knowingly assisted the theft.

According to Coinkite, a wallet may be affected if the Coldcard itself generated its seed on any of these versions:

• Mk2 or Mk3 running firmware 4.0.1 through 4.1.9.
• Mk4 or Mk5 running regular firmware older than 5.6.0, or experimental Edge firmware older than 6.6.0X.
• Q running regular firmware older than 1.5.0Q, or Edge firmware older than 6.6.0QX.

Coinkite initially said the Mk4, Mk5 and Q were unaffected, but later expanded its warning to include them.

The company doesn't consider a seed exposed by this bug alone if it was created elsewhere and later imported into a Coldcard, or if at least 50 private dice rolls were added during its creation.

A strong additional passphrase provides some protection, although Coinkite still recommends generating a new seed and moving the funds.

Tapsigner, Opendime and Satscard are unaffected. According to Block, a multisignature wallet is protected only if spending requires enough secure keys generated outside affected Coldcards.

Installing new firmware is necessary, but it doesn't repair an old seed. Coldcard owners within the affected ranges should follow Coinkite's official migration instructions:

1. Install the fixed firmware for the exact model and release track.
2. Generate a completely new seed after updating.
3. Record and verify its backup, wallet fingerprint and receiving address.
4. Send a small test transaction.
5. Move the remaining balance only after confirming the test.
6. Keep the old backup until the migration is complete.

Users should never enter their seed words into a website, support form or internet-connected computer. Anyone already affected should preserve the device and transaction records rather than destroying possible evidence.

Recovery remains uncertain because confirmed Bitcoin transfers can't be reversed. The unmoved funds and the paid service account may give investigators useful leads, but neither guarantees restitution.