Coldcard exposes crypto custody risks

The new tally changes the scale of the Coldcard story

A new reconstruction of the Coldcard hardware-wallet incident says the losses tied to weak seed generation were substantially larger than the figures previously circulating in public dashboards and address-list writeups. The researcher, posting under the name Mikhail, said he brute-forced the affected seed space “up to the practical ceiling” and identified about 2,052 compromised wallet seeds and 35,189 unique drained addresses [1].

That figure matters because a hardware-wallet failure is not measured only by the number of visible theft transactions. A single seed can control many addresses, including change addresses and addresses at deeper derivation paths. The researcher argues that earlier public counts undercounted the footprint because they focused on final sweep addresses rather than reconstructing the wallet roots behind them [1].

The same post estimates net theft at roughly 5,080 BTC, while gross flows through weak keys reached about 10,950 BTC, with much of the difference attributed to internal change movement rather than additional victim losses [1]. The researcher also says about 2,918 BTC remains on-chain in attacker-controlled consolidation addresses and that roughly 991 BTC reached exchanges or service endpoints [1].

Those numbers are not yet a court finding, a regulator’s report or a full independent audit. But they are specific, reproducible-style claims presented with an accompanying data repository, and they sharpen the central lesson: if entropy fails at seed creation, the wallet can appear secure for years while being mathematically guessable.

What allegedly went wrong

The alleged root cause is brutally simple: firmware intended to use hardware randomness during seed creation instead routed seed generation through a weak software pseudo-random path. The new reconstruction describes a batch of firmware in which the hardware RNG was effectively switched off for seed generation, leaving seeds with roughly 19 to 20 bits of practical entropy in the researcher’s model [1].

That is catastrophic for a Bitcoin wallet. A seed phrase is supposed to be unguessable even to an adversary with massive computing resources. If the actual search space collapses to something that can be explored on commodity GPUs, the difference between a cold wallet and a hot target disappears. The device can be air-gapped, the seed can be stamped into steel, and the owner can avoid phishing completely; if the seed was born weak, the attacker does not need to touch the device or trick the user.

A second researcher, writing two days earlier, independently reproduced part of the weak-RNG search for Mk3 devices and said a complete pass through one 24-bit candidate dimension took just over four and a half hours on an Nvidia 3090 GPU [2]. That researcher reported 1,157 reconstructed weak-seed wallet roots, 2,808 matched Bitcoin addresses, and said all matched Bitcoin addresses were empty, either because they were drained in the attack or had previously been emptied by their owners [2].

The second analysis also widened the concern beyond Bitcoin. It reported eight Ethereum wallets linked to weak roots, all drained, and later added a follow-up comment claiming a Dogecoin wallet had also been drained and cashed out through a service-labeled destination in under 15 minutes [2]. The amounts outside Bitcoin were far smaller, but the point is structural: one weak BIP-39 seed can generate keys across chains.

The danger is not only historical

The most unsettling part of the latest reconstruction is the claim that the sweeper infrastructure is still live. Mikhail wrote that the most recent automated drain he found was on August 19, 2026, and that the activity had been running since at least 2021 [1]. In a comment, he characterized the episode not as a single smash-and-grab, but as a long-running bleed whose July wave was only the visible tail [1].

That distinction matters for users. A past theft is a loss event. A live sweeper is an ongoing hazard. If a user sends new funds to an address derived from an affected seed, an automated attacker can still attempt to remove them. That is why the practical advice has converged on migration, not reassurance.

Coinkite’s September 4 firmware update makes the same point from the vendor side: installing the new firmware does not make an existing vulnerable seed safe [3]. The company says users whose seed may have been generated on affected firmware from 2021 through July 2026 should create a completely new seed using fixed firmware and move funds under the separate seed-generation advisory [3].

The current Coldcard security-status page repeats that distinction in operational terms: updating corrects future seed generation but does not repair an existing affected seed [4]. It lists fixed release lines, including Mk2/Mk3 4.2.0 or later, Mk4/Mk5 standard 5.6.0 or later, Q standard 1.5.0Q or later, and current recommended standard releases Mk4/Mk5 5.6.2 and Q 1.5.2Q [4].

Coinkite’s new controls show what had been missing

The September 4 release tries to make seed creation more inspectable. Coinkite says firmware 5.6.2 for Mk4/Mk5 and 1.5.2Q for Q restores visibility into the device-generated input used during seed creation and adds a standalone tool for checking dice-roll or coin-flip mixing [3].

The updated workflow requires one user-sourced entropy method for newly generated master seeds, temporary seeds and generated CCC Key C: at least 65 unpredictable key presses, 50 physical six-sided-die rolls, or 128 physical coin flips [3]. Coinkite says the standard workflow combines that user input with fresh device entropy from the STM32 TRNG and two secure elements [3].

The new “View TRNG Words” feature displays a 256-bit device-generated input before user entropy is mixed, and the verification tool can recompute the final seed from displayed TRNG words plus the full dice or coin sequence [3]. This does not prove that every possible failure has been eliminated. But it reflects an important design lesson: users need ways to verify the seed-generation process, not merely trust that the hardware did the right thing.

The security-status page says targeted independent checks have validated specific remediation mechanisms, including a real-device hardware-RNG test, source reviews, and a reproducible-build plus dice-path trace, while explicitly noting that these checks are not a complete audit of every firmware binary [4]. That caveat is important. The right takeaway is not “Coldcard is now risk-free.” No hardware wallet is. The takeaway is that invisible implementation details must be made visible, testable and independently reviewable wherever possible.

Why this cuts to the heart of self-custody

Hardware wallets are sold as an answer to exchange risk. They remove assets from custodians, reduce exposure to online malware and give users control over keys. The Coldcard episode shows the other side of that bargain: self-custody also transfers implementation risk, operational risk and recovery burden to individuals.

Most users cannot inspect firmware build flags, trace entropy paths or prove that a seed came from a true random source. They see a sealed device, a seed phrase and a security brand. In normal circumstances, that abstraction is useful. In an entropy failure, it becomes dangerous because the weakness is silent. There is no red warning on the device, no obvious malformed address, and no on-chain sign until funds move.

The new reconstruction therefore lands as more than a Coldcard-specific controversy. It is a stress test for crypto’s broader trust model. “Don’t trust, verify” is a strong slogan, but verification must be realistically available. If only a handful of specialists can reconstruct failures years later, the average self-custody user is still trusting a supply chain, a firmware process, and a random-number implementation they cannot see.

The practical conclusion

For affected users, the practical line is clear: a firmware update is not enough; funds must move to a newly generated seed created under fixed guidance [3]. A strong BIP-39 passphrase can add a barrier, but Coldcard’s current guidance says it does not repair an affected seed [4].

For the industry, the lesson is broader. Randomness is not a minor implementation detail. It is the root of ownership. When entropy collapses, self-custody collapses with it. Coldcard’s latest scrutiny has exposed not only one wallet’s failure mode, but the fragile assumption behind every promise that users can safely become their own bank.

Sources from the last 72 hours

1. [1][SERIOUS] I reconstructed the Coldcard RNG losses on-chain and it came out bigger than the public numbers (2,052 seeds, 35,189 drained addresses)Sep 6, 2026, 8:31 PM UTC
2. [2][SERIOUS 2] Results of reproducing the MK3 weak-RNG search: 1157 weak wallet roots reconstructed and evidence the hack extended to ETH.Sep 4, 2026, 7:30 PM UTC

AI-generated article based on recent web research, then preserved as a dated editorial snapshot.