The Vulnerability: Predictable Seed Generation

The recent Coldcard security incident was not a physical hack but a critical firmware integration error that compromised the randomness of generated seed phrases. Between July 30 and July 31, 2026, attackers exploited this vulnerability to drain approximately 1,082.65 BTC (valued at ~$70.2 million) from 1,196 addresses in just 41 minutes [Source: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to-70-million-bitcoin-theft-in-41-minutes].

The Vulnerability: Predictable Seed Generation

The root cause was a production configuration flag (MICROPY_HW_ENABLE_RNG = 0) introduced in March 2021 (v4.0.0) that accidentally disabled the hardware Random Number Generator (RNG). This forced the devices to use a software-based generator seeded with non-secret data, drastically reducing the "entropy" (randomness) of the generated 24-word seeds [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware].

[Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/]

Recommended Security Measures

To protect assets following this incident, users should adopt a "Defense in Depth" strategy that removes reliance on any single manufacturer's firmware.

1. Immediate Remediation for Coldcard Users

• Update and Migrate: Install the latest firmware (v4.2.0+ for Mk3; v5.6.0+ for Mk4/Mk5) immediately. You must generate a completely new seed phrase; do not continue using a seed generated on vulnerable firmware [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware].
• Use Physical Dice Rolls: When setting up a new wallet, use the "Dice Rolls" feature. By manually entering the results of 50–99 physical dice rolls, you provide the entropy yourself, bypassing the device's internal RNG entirely [Source: https://www.techtimes.com/articles/322392/20260731/coldcard-hardware-wallet-hacked-via-firmware-bug-that-bypassed-rng-five-years.htm].

2. Architectural Protections (All Cold Wallet Users)

• Multi-Vendor Multisig: Instead of a single wallet, use a 2-of-3 multisig setup using hardware from different vendors (e.g., Coldcard, Trezor, and Ledger). This ensures that even if one manufacturer has a catastrophic firmware bug, your funds remain secure [Source: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to-70-million-bitcoin-theft-in-41-minutes].
• BIP-39 Passphrases: Always apply a "25th word" passphrase. This passphrase is never stored on the device. Even if an attacker successfully brute-forces your 24-word seed due to low entropy, they cannot access your funds without this additional user-generated string.
• Air-Gapped Operations: Prefer devices that use QR codes or microSD cards for transaction signing. This prevents the private keys from ever having a direct physical or digital connection to an internet-connected computer.

3. Verification Best Practices

• Verify on Device: Always confirm the full destination address on the hardware wallet's physical screen. Malware on your PC can change the address shown in your software wallet.
• Test Recovery: Before depositing significant funds, perform a "Dry Run" recovery. Wipe the device and restore it using your backup seed phrase to ensure your backup is accurate and functional.

While the latest firmware patches resolve the RNG issue, the primary lesson for users is that entropy is the foundation of security. Manually providing randomness via dice rolls and adding a passphrase are the most effective ways to neutralize future firmware-level vulnerabilities [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware].