bitcoinstatus.org

On July 30, 2026, Bitcoin began disappearing from Coldcard wallets whose owners had not exposed their recovery words, had not handed their devices to attackers, and in many cases had not touched the wallets for years.

The incident was unusual because the attackers did not need physical access to the hardware wallet and did not need to steal the victim’s written seed phrase.

The underlying problem was more fundamental: certain versions of Coldcard firmware did not provide the amount of unpredictable randomness that users expected when new wallet seeds were generated.

That reduced the effective search space enough for attackers to generate candidate seeds offline, derive the Bitcoin addresses associated with them, compare those addresses against the public blockchain, and sweep wallets when a match was found.

This was not a break of Bitcoin’s cryptography. It was a failure in wallet key generation.

What Happened in the Coldcard Attack?

According to analysis cited by Galaxy Research, one major attack wave on July 30 swept approximately 1,082.65 BTC from 1,196 wallet addresses in only 41 minutes.

The transactions were broadcast across six Bitcoin blocks and appeared in batches rather than as isolated manual thefts.

Additional suspicious sweeps were identified afterward, and the total amount associated with the incident continued to increase as researchers analyzed the blockchain.

For that reason, claims about the final number of victims should be treated carefully. A Bitcoin wallet can control multiple addresses, and one person can control multiple wallets. The number of affected addresses is not necessarily the number of individual Coldcard owners.

The technical mechanism is more important than the exact victim count.

The attack did not require compromising each victim individually.

How Bitcoin Seed Security Is Supposed to Work

When a Bitcoin wallet is created, the device generates secret random data with very high entropy.

Entropy, in this context, means unpredictability.

The familiar 12-word or 24-word recovery phrase is generated from this secret information and can later reproduce the wallet’s private keys.

With properly generated entropy, the number of possible seeds is so enormous that searching through them is computationally unrealistic.

A 128-bit security level represents approximately 340 undecillion possible values. A 256-bit space is vastly larger again.

The security assumption is therefore not that nobody knows how Bitcoin keys work. The derivation rules are public.

The security comes from an attacker having no realistic way to determine which secret was randomly selected.

The Coldcard Random Number Generation Bug

Coldcard was designed to use hardware-generated randomness when creating wallet seeds.

According to Coinkite’s technical investigation, the problem was introduced during a 2021 firmware change related to the integration of Bitcoin Core’s libsecp256k1 cryptographic library.

During that migration, seed generation moved from Coldcard’s previous hardware-randomness function:

ckcc.rng_bytes()

to:

ngu.random.bytes()

The cryptographic library itself was not the problem.

The integration was.

The new code path could resolve to a fallback pseudorandom number generator supplied by MicroPython instead of Coldcard’s intended hardware random number generator.

In other words, the firmware contained the proper hardware RNG implementation, but wallet seed generation was not necessarily reaching it.

Coinkite also identified a build-time configuration problem involving MICROPY_HW_ENABLE_RNG. The macro had been defined as zero, while a preprocessor check tested whether the macro existed rather than whether its value was nonzero.

The result was that a software PRNG implementation with the expected function signature could be included without causing the build to fail.

This is the kind of bug that can survive code review because the correct random-number-generation code exists in the firmware and everything appears to compile normally. The failure happens in which implementation the seed-generation path actually reaches.

Why a Software PRNG Was Dangerous Here

A pseudorandom number generator can produce numbers that appear random while still being predictable if an attacker can determine or sufficiently narrow its internal state.

On affected Mk2 and Mk3 firmware, Coinkite says the active PRNG was seeded primarily using device information and timing-related state.

Those inputs do not provide anything close to the security expected from a properly functioning cryptographic hardware random number generator.

Under Coinkite’s current attack assumptions, the company estimates that affected Mk2 and Mk3 seeds had an effective search space of approximately 40 bits.

Later Coldcard generations added entropy from secure elements, which substantially improved the situation but did not restore the intended security target.

Coinkite currently estimates approximately 72 bits of effective entropy for affected Mk4, Mk5 and Q seeds.

Independent researchers have reached somewhat different conclusions about the exact effective search space depending on what information an attacker is assumed to know.

That technical disagreement does not change the central finding:

Affected Coldcard seeds were substantially more predictable than they were supposed to be.

How the Hacker Could Find Real Bitcoin Wallets

The attacker did not need to choose a person first and then somehow determine that person’s recovery phrase.

The process could work in the opposite direction.

An attacker can:

1. Reproduce or enumerate candidate seeds that vulnerable Coldcard firmware could have generated.
2. Derive the corresponding Bitcoin private keys and public addresses using standard Bitcoin wallet derivation rules.
3. Check those addresses against publicly available blockchain data.
4. Identify addresses containing Bitcoin.
5. Use the reconstructed private keys to sign transactions transferring the funds.

All of this can happen on systems controlled by the attacker.

The owner’s Coldcard does not need to be online.

It does not need to be connected to USB.

It does not need to contain malware.

The attacker does not need to communicate with it at all.

A vulnerable Coldcard could theoretically be powered off and stored thousands of miles away while its wallet was being reconstructed elsewhere.

Why the Public Bitcoin Blockchain Helped the Attack

Bitcoin’s blockchain is intentionally public.

Anyone can determine whether a Bitcoin address has received funds and whether those funds remain unspent.

Normally this transparency does not endanger private keys because generating an address does not reveal the secret key behind it.

The Coldcard bug changed the attacker’s problem.

If the attacker already had a manageable collection of candidate seeds, the blockchain provided an efficient way to determine which candidates corresponded to real funded wallets.

The attacker could derive addresses from candidate seeds and check whether those addresses existed on-chain.

A funded match confirmed that a candidate seed was useful.

This also helps explain why the observed thefts appeared automated and why wallets using different Bitcoin address formats could be swept during the same attack.

The Attack Did Not Care Whether the Wallet Was Large or Small

Traditional targeted theft has an economic filter.

An attacker may decide that spending hours attacking a wallet containing a small amount of Bitcoin is not worth the effort.

Automated enumeration changes that calculation.

Once software is generating candidate seeds, deriving addresses and checking balances automatically, the additional cost of checking another candidate can be extremely small.

The system does not need to know who owns the wallet.

It does not need to decide whether the owner is wealthy.

It can simply determine whether a candidate private key controls spendable Bitcoin.

If it does, the funds can be swept.

This is one reason attacks based on weak key generation can be particularly destructive. They can affect both large holders and ordinary people who assumed their relatively small balance made them an unattractive target.

Why Physical Cold Storage Could Not Stop This Attack

Hardware wallets are primarily designed to protect private keys from being extracted or exposed during normal wallet operation.

Physical seed backups protect against device failure and provide a way to recover a wallet.

Safes, steel backups, separate locations and bank vaults can protect those recovery words from theft, fire or destruction.

None of those protections can increase the entropy of a seed after the seed has already been generated.

If a secret was created from a significantly smaller set of possibilities than intended, protecting the physical copy does not make the original secret more random.

This distinction is critical:

Secure key storage and secure key generation are separate security problems.

Cold storage can perform its storage function perfectly while still being undermined by a weakness that existed at the moment the key was created.

Which Coldcard Firmware Versions Are Affected?

Coinkite’s current security advisory identifies the following affected seed-generation ranges and fixed firmware releases:

Coldcard Model	Affected Seed Generation	Fixed Firmware
Mk2 / Mk3	4.0.1 through 4.1.9	4.2.0 or later
Mk4 / Mk5 Standard	Before 5.6.0	5.6.0 or later
Mk4 / Mk5 Edge	Before 6.6.0X	6.6.0X or later
Q Standard	Before 1.5.0Q	1.5.0Q or later
Q Edge	Before 6.6.0QX	6.6.0QX or later

Coinkite states that TAPSIGNER, OPENDIME and SATSCARD are not affected because they use different codebases.

Standard and Edge firmware are separate release tracks. Users running Edge firmware should use the corrected Edge version specified for their device rather than assuming that any firmware with a numerically higher version number contains the fix.

Updating the Firmware Does Not Fix an Existing Seed

This is probably the most important point for current Coldcard owners.

Installing corrected firmware does not repair a seed that was created using vulnerable firmware.

The weakness exists in how the old seed was originally generated.

Updating the device changes how future seeds are created. It cannot retroactively add entropy to an existing recovery phrase.

Importing the same affected 24 words into another Coldcard also does not fix the problem.

Importing them into a Ledger, Trezor, software wallet or any other wallet does not fix it either.

The old seed remains the same secret with the same original entropy.

Affected users need to create a completely new seed using corrected firmware and migrate their Bitcoin to addresses controlled by that new seed.

What Coldcard Owners Should Do Now

If a seed was generated using affected firmware and does not qualify for the dice-roll exception described below, Coinkite recommends migration.

1. Determine which Coldcard model and firmware track you are using.
2. Install the corrected firmware before generating any replacement seed.
3. Generate a completely new wallet and new seed.
4. Write down and carefully verify the new recovery phrase.
5. Verify the new wallet fingerprint.
6. Verify a receiving address directly on the Coldcard screen.
7. Send a small test transaction to the new wallet.
8. Confirm that the test transaction arrived and that the new wallet can be restored correctly.
9. Move the remaining balance only after the new wallet has been verified.
10. Keep the old backup until the entire migration has been completed and confirmed.

Users should not rush the migration process. Sending Bitcoin to an incorrectly verified address, confusing old and new wallets, or destroying the only valid backup can create an immediate loss unrelated to the original Coldcard vulnerability.

What If You Used Dice Rolls When Creating the Seed?

Coldcard allows users to contribute their own entropy using physical dice rolls.

This matters because the disclosed bug affected device-generated entropy. It did not remove genuinely independent randomness supplied by the user.

According to Coinkite:

• 50 to 98 fair, independent and private dice rolls contribute at least approximately 128 bits of independent entropy.
• 99 or more fair, independent and private rolls contribute approximately 256 bits.
• If fewer than 50 rolls were used, or the user does not remember how many were used, Coinkite recommends migration.

Coinkite does not consider a seed created with at least 50 fair, independent and private dice rolls to be at risk from this RNG issue alone.

The word private is important.

A dice sequence that was photographed, saved in a computer file, uploaded to cloud storage or otherwise exposed should not be treated as secret entropy.

What If the Wallet Used a BIP-39 Passphrase?

A strong BIP-39 passphrase provides an additional independent secret.

The passphrase is combined with the seed words to derive a different wallet. Reconstructing the underlying seed alone is therefore not sufficient to access Bitcoin stored in a wallet protected by a strong, unique and secret passphrase.

However, not every passphrase provides meaningful protection.

A short passphrase, dictionary word, quotation, common phrase, reused password, predictable pattern or exposed password may itself be susceptible to guessing or brute-force attacks.

Coinkite’s advisory specifically refers to a strong, unique BIP-39 passphrase.

The Coldcard PIN is not a BIP-39 passphrase and does not provide the same protection against this attack.

Even where a strong passphrase significantly reduces the immediate risk, Coinkite recommends replacing an affected underlying seed as soon as practical.

What About Multisig Wallets?

Multisignature Bitcoin wallets can reduce the impact of a compromised individual seed when the required signing keys were generated independently.

For example, in a 2-of-3 multisig wallet, reconstructing one vulnerable Coldcard seed would not by itself provide the two signatures required to spend the Bitcoin.

However, multisig is not automatically protection against this particular vulnerability.

If enough keys in the multisig setup were independently generated using affected Coldcard firmware, an attacker may be able to reconstruct enough keys to satisfy the signing threshold.

The important question is how many required keys were generated independently and securely.

Did Artificial Intelligence Discover the Vulnerability?

There has been considerable discussion about whether AI helped identify the Coldcard vulnerability.

Coinkite has publicly suggested that this is possible because Coldcard firmware source code was publicly available and modern AI systems can analyze large historical codebases quickly.

Coinkite also disclosed that it had previously used a leading AI model to review its own code and that the model did not identify this issue.

At this point, however, there is no public evidence establishing that the attacker used AI to discover the vulnerability.

The technical flaw can be identified, analyzed and exploited using conventional security research and computing techniques.

The accurate conclusion is therefore:

AI may have helped discover or analyze the Coldcard bug, but its role in the actual attack has not been established.

What If Your Bitcoin Has Already Been Stolen?

Bitcoin transactions cannot simply be reversed after they have been confirmed.

That does not mean victims should do nothing.

Preserve as much information as possible, including:

• the affected Bitcoin addresses;
• transaction IDs or transaction hashes;
• the amount of BTC stolen;
• the date and approximate time of the unauthorized transaction;
• the destination addresses;
• the Coldcard model;
• the firmware version if known;
• the wallet fingerprint if available;
• the approximate date the seed was originally created;
• whether dice entropy was used;
• whether a BIP-39 passphrase was used;
• purchase records showing the acquisition and cost basis of the stolen Bitcoin.

Do not automatically erase or destroy the affected Coldcard. Device information may later be useful when establishing what happened.

U.S. victims should consider filing a report with the FBI’s Internet Crime Complaint Center, or IC3.

The FBI specifically requests cryptocurrency transaction details such as wallet addresses, transaction hashes, cryptocurrency type, amounts, dates and times.

Because Bitcoin transactions remain visible on-chain, investigators can continue following stolen funds after the original theft.

Recovery is never guaranteed, but funds can sometimes eventually reach regulated exchanges or other services where additional identification or law-enforcement action becomes possible.

Beware of Cryptocurrency Recovery Scams

People who have just lost cryptocurrency are frequent targets for a second scam.

Fraudsters may claim that they can trace, hack back, unlock or recover stolen Bitcoin in exchange for an upfront payment.

The FBI specifically warns cryptocurrency victims to be cautious of recovery services, especially those demanding advance fees.

A victim should not send additional cryptocurrency, seed phrases, private keys or wallet credentials to someone simply because that person claims to have recovered stolen funds before.

Can U.S. Taxpayers Deduct Bitcoin Stolen in the Coldcard Attack?

Potentially, but the deduction is not automatic and the facts of each case matter.

For U.S. federal tax purposes, Bitcoin is treated as property.

Internal Revenue Code Section 165 allows certain theft losses, including losses connected with a transaction entered into for profit.

Current IRS guidance indicates that a theft loss may potentially qualify under Section 165(c)(2) when:

• the property was taken through conduct that qualifies as criminal theft under applicable law;
• the taxpayer entered into the transaction primarily for profit; and
• there is no reasonable prospect of recovering the stolen property or receiving reimbursement.

This distinction is important because the restriction on deductions for most personal casualty and theft losses does not operate the same way for property held in a transaction entered into for profit.

Bitcoin purchased and held primarily as an investment may potentially fall into the profit-motivated category.

Whether a particular taxpayer qualifies depends on the actual facts.

The Tax Deduction Is Generally Limited by Cost Basis

One of the most important tax points is that the deductible theft loss is generally limited by the taxpayer’s adjusted basis in the stolen property, subject to reimbursement and other applicable rules.

It is not automatically the Bitcoin’s market value when it was stolen.

For example, suppose someone bought Bitcoin for $20,000 and it was worth $80,000 when stolen.

The fact that the Bitcoin had appreciated to $80,000 does not automatically create an $80,000 theft-loss deduction.

The taxpayer generally cannot deduct unrealized appreciation that had never been included in taxable income.

The original acquisition cost and subsequent basis adjustments therefore matter.

Which Tax Year Is the Loss Claimed?

Section 165 generally treats a theft loss as sustained in the year the taxpayer discovers the theft.

There is an important exception.

If a reasonable prospect of recovery or reimbursement exists at the end of the tax year, the deductible loss may have to be postponed until it becomes reasonably certain whether that recovery will occur.

The IRS treats the existence of a reasonable prospect of recovery as a factual determination based on the circumstances known at the end of the tax year.

This could become especially important for Coldcard victims because the 2026 investigation is still active.

Law enforcement may be tracing funds. Potential claims against third parties may develop. Coinkite’s investigation is continuing. Some stolen Bitcoin may remain identifiable on-chain.

Those circumstances do not automatically mean there is a reasonable prospect of recovery, but they are factors that a tax professional may need to evaluate before a 2026 deduction is claimed.

How Is a Qualifying Theft Loss Reported?

For investment or other income-producing property, Form 4684, Section B is generally used to calculate and report casualty and theft losses.

The resulting amount is then carried to the appropriate part of the individual income-tax return according to the Form 4684 instructions and the taxpayer’s specific circumstances.

A qualifying Section 165(c)(2) theft loss is not simply treated as a normal sale of Bitcoin and should not automatically be reported as an ordinary cryptocurrency capital loss.

Taxpayers with substantial Coldcard losses should preserve complete acquisition records, transaction histories and evidence supporting both ownership and cost basis.

Because the final treatment can depend on state theft law, investment intent, recovery prospects, tax basis and other circumstances, anyone considering a substantial deduction should discuss the case with a CPA, enrolled agent or tax attorney familiar with digital assets and Section 165 theft losses.

What the Coldcard Incident Does Not Mean

The attack does not mean Bitcoin’s cryptographic signatures were broken.

It does not mean somebody discovered a practical way to calculate arbitrary Bitcoin private keys from public addresses.

It does not mean every hardware wallet is vulnerable.

It does not mean physical seed backups are useless.

And it does not mean air-gapped signing has no security value.

The incident involved a specific and severe failure in the generation of secret wallet entropy.

A properly generated Bitcoin seed remains protected by an enormous cryptographic search space.

The Larger Lesson for Bitcoin Self-Custody

Hardware-wallet security is often discussed almost entirely in terms of protecting an existing seed.

Users worry about where to store recovery words, whether to engrave them into steel, whether to use a bank vault, whether the signing device should be air-gapped, and how to prevent physical access.

Those are legitimate security concerns.

But they all depend on a more basic assumption:

The secret being protected must have been generated securely in the first place.

A flawless backup procedure cannot compensate for predictable entropy.

A perfectly air-gapped device cannot repair a weak seed after it has been generated.

A bank vault can prevent someone from reading a piece of paper, but it cannot prevent an attacker from independently reproducing the secret written on that paper if the original random-number-generation process was sufficiently predictable.

The Coldcard incident is therefore not simply a story about one hardware-wallet bug.

It demonstrates why independent entropy, reproducible builds, end-to-end testing of cryptographic code paths, hardware RNG verification, strong passphrases and diversified multisig designs matter in serious Bitcoin custody.

Self-custody removes reliance on a bank or exchange.

It does not remove the requirement to trust that the tools creating and protecting cryptographic secrets perform those functions correctly.

Coldcard Holder Checklist

• Identify the Coldcard model that originally generated your seed.
• Determine which firmware version was running when the seed was created.
• Do not assume that installing new firmware makes an old affected seed safe.
• Install the corrected firmware before generating a replacement seed.
• Create an entirely new seed if the original falls within an affected range.
• Verify the new backup, wallet fingerprint and receiving address.
• Send a small test transaction before migrating the full balance.
• If you used dice during original seed generation, determine whether you supplied at least 50 fair, independent and private rolls.
• Do not confuse a Coldcard PIN with a BIP-39 passphrase.
• If using a passphrase, make sure it is strong, unique, secret and backed up separately.
• If funds were stolen, preserve all wallet and transaction evidence.
• U.S. victims should consider reporting the theft to IC3.
• Be extremely skeptical of paid cryptocurrency recovery services.
• Keep records establishing the cost basis of stolen BTC for possible U.S. tax reporting.

Sources

• Coinkite: Coldcard Security Advisory, published July 30, 2026 and updated as the investigation developed.
• Coinkite: Technical Deep Dive into the Entropy Issue, including the RNG integration failure, affected firmware ranges and current entropy estimates.
• Block Bitcoin Engineering and Security: Independent analysis of the predictable RNG fallback and reseeding behavior in Coldcard firmware.
• Galaxy Research: Blockchain analysis of the July 30 Coldcard wallet sweeps.
• CoinDesk: Reporting on the initial 1,082.65 BTC sweep and the mechanics of offline seed enumeration.
• FBI Internet Crime Complaint Center: Cryptocurrency crime reporting and evidence guidance.
• Internal Revenue Service: Publication 547, Form 4684 instructions and Section 165 theft-loss guidance.

Last updated: August 4, 2026. The investigation is ongoing. Loss totals, technical conclusions and official remediation guidance may change as additional evidence becomes available.