A flaw in how Coldcard hardware wallets generated private keys allowed an attacker to steal roughly 594 bitcoin, worth about $38 million, from around 500 single-signature wallets in a 25-minute window early Friday. The theft is remarkable not for its size, bitcoin’s market barely flinched, trading above $64,000 in Asian hours, but for what it reveals about the gap between security marketing and firmware reality. A device sold on the promise of “impossible to guess” seeds was, for years, generating them from a chip’s serial number and clock registers.
The bug was a build setting
According to a report from Block’s Bitcoin engineering and security teams, a commit dated March 1, 2021 shipped in firmware 4.0.0 that month. A build setting told the device to skip its hardware randomness generator. A check in a supporting library tested only whether that setting existed, not whether it was switched on. Key generation quietly fell through to a basic software substitute seeded from non-secret factory metadata and timing state an attacker can narrow down or measure on a device of their own. The vulnerability persisted through firmware 4.0.1 and later on Mk3 devices.
The sweep was surgical
Between 01:31 and 01:56 UTC, the attacker moved 1,324 chunks of bitcoin across 500 transactions inside a three-block window. Every drained wallet was single-signature and held more than 0.15 BTC. Many had been dormant for years, and the coins spanned 2021 to 2026, matching the flaw’s age almost exactly. After the initial sweep, 562 BTC were consolidated into a single address that has not moved since. The precision suggests the attacker knew exactly which seeds were guessable and had the infrastructure ready to drain them before disclosure.
Exposure runs past seeds
The same compromised generator produced Coldcard’s paper wallet private keys, where the output becomes the key directly with no further derivation, along with seed-splitting masks, device cloning keys and Key Teleport transfers. Coinkite has warned users who generated a seed on an Mk3 running version 4.0.1 or later, while stressing that Mk4, Q and Mk5 appear unaffected based on early analysis. Both companies describe their analyses as preliminary. Block said it published without full testing to confirm exploitability because exploitation was already under way. That sequence, exploit first, disclose later, is the only reason the market learned about the flaw at all.