"A sweep looks the same as if a coin owner chose to move coins," Galaxy Research warned.
The July 30 sweep: 1,196 addresses emptied in 41 minutes
On July 30 an attacker drained 1,196 Bitcoin addresses in 41 minutes, taking 1,082.65 BTC — worth about $70.2 million at the time — according to public tracing described by Galaxy Research. Galaxy mapped the sweep and found the transactions used a distinctive 30 sat/vB, no‑change signature; the firm cautioned that the pattern identifies the operator, not necessarily the theft, because a sweep "looks the same as if a coin owner chose to move coins." No one has publicly named the attacker, and Galaxy said it found no other Bitcoin transactions in the previous 30 days with the same signature pattern.
How researchers tied the sweep to Coldcard firmware
Galaxy Research mapped the drain and linked it to a flaw in Coldcard, a Bitcoin‑only hardware wallet made by Coinkite. Block researchers traced the root cause to a March 2021 firmware integration error that routed seed generation to a deterministic software pseudorandom number generator (PRNG) instead of the STM32 hardware random number generator (RNG). Block reported that an attacker who can determine or sufficiently constrain the device UID, timer state, and prior RNG‑call history can reproduce candidate output streams offline without accessing the device; those candidate seeds can be checked by deriving addresses and comparing them with public blockchain data.
Technical detail: production config, MicroPython fallback, and entropy estimates
Block traced the fault to Coldcard's production config, which defines MICROPY_HW_ENABLE_RNG as zero because Coinkite supplies its own hardware‑RNG wrapper. The libngu library checked whether the macro existed rather than whether it was enabled, binding the build to MicroPython's Yasmarang fallback. That MicroPython fallback was initialized from the chip's unique ID and timer registers and collected no fresh entropy after initialization.
Coinkite estimates effective entropy at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q, versus 128 bits expected for a 12‑word BIP‑39 seed. Block "does not give one practical figure. It sets conditional ceilings below 240.7 and 273.3 and warns that the latter is not equivalent to 73‑bit cryptographic security." Block published no brute‑force benchmark. The company and Block both note that practical cost to an attacker depends on available UID information, boot timing, prior RNG calls and derivation cost; later‑model reseed behavior raises the number of candidate seeds to be checked.
Coinkite's emergency measures and owner guidance
Coinkite shipped emergency firmware for every affected model and release track on July 31. The company cautioned that installing the patch does not repair an existing seed: restoring the old seed to updated firmware or moving it into another wallet "carries the weakness forward." Coinkite tells owners with exposed seeds to generate a new seed on patched firmware and move their coins.
The company also provided thresholds for acceptable manual entropy: a seed built with at least 50 fair, independent, private dice rolls is not at risk from this bug alone; if the number or privacy of the rolls is uncertain, Coinkite advises migration. A strong, unique BIP‑39 passphrase creates a separate wallet the seed words cannot reach on their own, but Coinkite still recommends replacing the seed.
Which Coldcard builds are affected
- Mk2 and Mk3: Block places Mk2 and Mk3 versions 4.0.0 through 4.1.9 on the vulnerable path; Coinkite lists Mk3 versions 4.0.1 through 4.1.9 as vulnerable and says the issue is fixed in 4.2.0 (Coinkite does not name Mk2 in its public list).
- Mk4 and Mk5: any firmware before 5.6.0 is vulnerable.
- Q: any firmware before 1.5.0Q is vulnerable.
- Edge builds: anything before 6.6.0X for Mk4 and Mk5, and before 6.6.0QX for Q, are on the vulnerable path.
What this means for multisig holders, TAPSIGNER/OPENDIME/SATSCARD users, and custodians
- Multisig holders: Coinkite notes multisig "helps only when the quorum is not built entirely from affected devices." If all keys in a quorum were created on vulnerable firmware, the weakness survives unless at least one key is replaced.
- TAPSIGNER, OPENDIME and SATSCARD users: those products use different codebases and are unaffected by this specific Coldcard bug, per Coinkite's advisory.
- Custodians and any owner who generated a seed on affected firmware: because exposure depends on the firmware that ran when the seed was created rather than the firmware installed now, owners must check the seed‑creation firmware version and follow Coinkite's migration guidance when in doubt.
No public report has reconstructed a victim's seed and matched it to a drained address. The disclosure follows Coinspect's Ill Bloom research in early July, which described a separate weak‑PRNG flaw in older software wallets tied to more than $5 million drained across multiple chains since May. For Coldcard owners and custodians, the immediate steps Coinkite prescribes — verify the seed‑creation firmware, install the emergency firmware, and generate new seeds on patched firmware when exposure is possible — are the concrete actions the company has issued; the broader recovery and attribution questions remain unresolved.
