Coldcard flaw: 594 bitcoin drained from 500 wallets in 25 minutes

Between 01:31 and 01:56 UTC last Friday, 594 bitcoin left roughly 500 hardware wallets. That is around 38 million dollars (roughly €33.3 million) in twenty-five minutes. The cause was neither phishing nor a stolen device, but a build setting in the firmware of one of the most widely recommended hardware wallets in bitcoin circles.

What actually happened

The affected devices are Coldcards of the Mk3 model running firmware 4.0.1 or later. The fault entered the code with version 4.0.0, released in March 2021. For five years nobody spotted it.

The analysis was published by Block's bitcoin engineering and security teams. Coinkite, which makes the Coldcard, has warned users. What makes the attack unusual is that it required no physical access to any device at all: everything was done from the blockchain, with computation.

The flaw sits in the randomness

A hardware wallet is at heart a machine for producing one secret number. That number is your private key. All of its security rests on whether that number is genuinely unpredictable. Which is why every serious hardware wallet carries a physical random number generator, a chip that turns real-world noise into bits.

Because of a wrongly set build flag, the Coldcard Mk3 skipped that chip. Instead the device fell back on a software generator seeded with two values: the chip's serial number and the state of its clock registers. Neither is secret. A serial number is fixed, and the clock state at the moment of creation falls within a narrow range. That shrinks the space of possible keys from astronomically large to something an attacker can simply walk through.

Once someone makes that leap, the rest is bookkeeping. Generate the candidate keys, derive the addresses, check the blockchain for which addresses hold a balance, and sign the transactions.

Which devices are and are not affected

Only the Mk3 is vulnerable, and only with firmware 4.0.1 or later. The Mk4, the Q and the Mk5 run different firmware and are not affected.

There is a detail here that is easy to get wrong. What counts is not which firmware sits on your device today, nor when you bought it. What counts is which firmware was running at the moment your wallet was created. A weak key stays weak after you update. The update fixes the generator, not the key it produced earlier.

Also worth noting: these were single-signature wallets. Multisig setups in which the Coldcard holds only one of the keys cannot be drained this way automatically, because the attacker would need the other keys too.

Twenty-five minutes, 500 transactions

The execution was visibly prepared. In twenty-five minutes roughly 500 transactions crossed the network, collecting the haul in 1,324 chunks. Afterwards, 562 of the 594 bitcoin were consolidated into a single address.

That timeline says something. The computation to find the keys was already done; what you see on the blockchain is only the harvest. Anyone who wraps up an operation like this inside half an hour has mapped the targets in advance and waited until everything was in place.

Why this does not sink hardware wallets

It is tempting to conclude that a hardware wallet does not help. That is the wrong lesson. The model held: the key never left the device, the PIN did its job, nothing was phished. What failed was a setting in the build process, precisely the kind of fault that open source and outside analysis are meant to catch, and which here was indeed caught by an external team.

The real lesson is that trusting a device always means trusting a production chain. Firmware, build environment and randomness are part of the product, even though you never see them. That argues for devices whose firmware can be built reproducibly and whose code is read by more than one party.

What this means for you

If you own a Coldcard Mk3 and your wallet was created on firmware 4.0.1 or later, assume the key is weak and move your bitcoin. Not to a fresh address on the same seed, because that derives from the same weak key, but to a wallet with an entirely new seed generated on a sound device.

If you cannot remember which firmware was on it at the time, treat it as compromised. The alternative is guessing well with your own money on the table.

If you use a Mk4, a Q or a Mk5, there is nothing to do. If your Coldcard sits in a multisig setup, the urgency is lower, but replace the key in question at your next scheduled rotation anyway.

More broadly: this is a good moment to check that your recovery phrase is somewhere you can find it and nobody else can. Last week's attack worked because keys were predictable. Most other attacks work because people photograph their recovery phrase.

Sources: CoinDesk, Coinkite, Block, FinanceFeeds, Crypto Economy, Cybernews. Last checked: 1 August 2026.