Technical Root Cause
Published 7/31/2026, 12:27:01 PM
The Coldcard Mk3 seed vulnerability is classified as critical, following a coordinated exploit on July 30, 2026, that drained 594.48 BTC (approximately $38.3 million) from roughly 500 single-signature wallets [Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/]. The attack was highly efficient, occurring within a 25-minute window across Bitcoin blocks 960188–960191 [Source: https://www.reddit.com/r/Bitcoin/comments/1vb91uc/wallet_drain_megathread_check_your_balances/].
Technical Root Cause
The vulnerability originated from a firmware configuration error introduced in March 2021 (Firmware 4.0.0). A build setting caused the device to bypass its hardware random number generator (RNG), falling back to a predictable software-based method using the chip's serial number and clock registers [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware]. This reduced the entropy of generated seeds from the standard 128 bits to approximately 72 bits, making them vulnerable to brute-force attacks [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware].
Risk Assessment by Device and Firmware
The risk is determined by the firmware version active at the time the wallet seed was initially generated.
| Device Model | Risk Level | Affected Firmware Versions | Status |
|---|---|---|---|
| Coldcard Mk3 | Critical | 4.0.1 through 5.0.3 | Confirmed exploited [Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/] |
| Coldcard Mk2 | High | 4.0.0 and later | Likely vulnerable due to shared codebase |
| Mk4, Q, Mk5 | Moderate | Pre-fixed versions | Reduced entropy (72-bit); no confirmed drains |
| Mk1 | Safe | N/A | Does not run the affected codebase |
| Tapsigner | Safe | N/A | Entirely different codebase |
Severity and Real-World Impact
- Targeting: The attacker focused on single-signature wallets with balances exceeding 0.15 BTC [Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/].
- Total Potential Loss: While 594 BTC is the primary figure, secondary analysis suggests an additional 488.11 BTC may have been drained in related transactions, potentially bringing the total loss to 1,082.59 BTC [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware].
- Passphrase Mitigation: Wallets using a strong BIP-39 passphrase (entered only on the device) are considered to have minimal risk, as the passphrase provides additional entropy that cannot be derived from the predictable RNG [Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/].
Mitigation and Current Status
Coinkite has released updated firmware to address the RNG fallback issue. However, updating the firmware does not fix a seed that was already generated under the vulnerable versions.
- Immediate Migration: Users who generated seeds on affected Mk3/Mk2 devices must migrate funds to a newly generated seed on a patched device (Mk4/Mk5 v5.6.0+ or Q v1.5.0Q+) [Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/].
- Dice-Roll Method: To ensure maximum security regardless of firmware, users are encouraged to use the physical dice-roll method (99+ rolls) to generate seeds, which bypasses the internal RNG entirely [Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/].
- Multisig: Moving funds to a multisig setup (e.g., 2-of-3) using hardware from different vendors is the most robust defense against single-device vulnerabilities.
The vulnerability is considered "resolved" in terms of software patches, but the "unresolved" risk remains for any user still holding funds in a seed generated on vulnerable Mk3 firmware between 2021 and mid-2026.