A five-year-old firmware bug in Coldcard bitcoin hardware wallets has cost holders roughly 1,367 BTC — about $88.6 million, or around ₱5.43 billion at current rates. The theft ran in at least three waves, the largest of which emptied more than a thousand wallets in 41 minutes. If you own a Coldcard, the firmware version matters, and updating alone does not fix it.
How the money moved
The first and biggest wave hit on July 30. Attackers swept 1,082.65 BTC — about $70.2 million, or around ₱4.3 billion — from 1,196 addresses in 41 minutes, averaging roughly one bitcoin per victim.
A third wave followed over the weekend and was flagged by Galaxy Research. CoinDesk reported that this round drained about 208 BTC from 1,912 addresses — closer to 0.1 BTC each — and used noticeably more careful technique: a separate destination address per victim instead of shared collector addresses, pay-to-witness-script-hash outputs, six victims batched into each sweep transaction, and scanning limited to default key derivation paths. Galaxy said it cannot confirm from blockchain data alone whether the same operators ran all three waves.
Total observed losses now stand at roughly 1,367 BTC across 4,585 addresses. Notably, the stolen coins have not moved on to exchanges — they are sitting unspent.
The bug: a hardware random number generator that was never used
The flaw is not a break in bitcoin's cryptography. It is a configuration error in how Coldcard devices generated seed phrases — the 12 or 24 words that are, in effect, the master key to a wallet.
A March 2021 firmware release routed seed generation through a deterministic software pseudorandom number generator instead of the device's dedicated hardware random number generator. Deterministic means the output can be reproduced if you know the inputs. The Hacker News quotes Block's analysis of the root cause: the libngu library "checked whether the macro existed rather than whether it was enabled." One wrong check, and every seed generated afterward came from predictable randomness.
That is why the attack scales the way it does. With a device's UID, timer state, and RNG history, an attacker can regenerate candidate seeds offline — no physical access to the wallet, no phishing, no user mistake. The victims did nothing wrong.
Which devices and firmware versions are affected
| Model | Vulnerable firmware | Fixed in |
|---|
| Mk2 and Mk3 | 4.0.0 – 4.1.9 | 4.2.0 |
| Mk4 and Mk5 | anything before 5.6.0 | 5.6.0 |
| Q | anything before 1.5.0Q | 1.5.0Q |
| Edge builds (Mk4/Mk5) | before 6.6.0X | 6.6.0X |
| Edge builds (Q) | before 6.6.0QX | 6.6.0QX |
What Coinkite says owners must do
Coinkite, the company behind Coldcard, shipped emergency firmware on July 31 — and issued the warning that matters most: installing it does not repair an existing seed. A seed generated with weak randomness stays weak forever. Patching the device closes the door for future seeds only.
The steps for an affected owner, per Coinkite and the reporting:
- Update to patched firmware for your model.
- Generate a completely new seed on the updated device.
- Move every coin to addresses derived from that new seed.
- If you cannot migrate immediately, a strong BIP-39 passphrase adds a temporary layer — it is a stopgap, not a fix.
The third wave's habit of scanning only default derivation paths is a hint, not a defence. Do not treat a non-standard path as protection.
Why this should matter to Filipino crypto holders
No Philippine victims have been identified in the reporting, and no local regulator has issued an advisory on this specific flaw as of publication. But hardware wallets are sold and shipped here, and self-custody — holding your own keys instead of leaving coins on an exchange — is exactly what Filipino holders are repeatedly told is the safer choice.
This incident complicates that advice in a specific way. Self-custody removes exchange risk, but it moves the trust to the device and the firmware inside it. The people who lost coins here were following best practice: cold storage, keys offline, nothing on an exchange. What failed was a build configuration they had no way to inspect.
The practical takeaway for anyone here running a hardware wallet of any brand: know your firmware version, subscribe to the manufacturer's security notices, and treat "generate a new seed and migrate" as a procedure you have rehearsed rather than one you will improvise during an incident. A wallet that cannot tell you which firmware built its seed is a wallet you cannot audit.
What is still unknown
Three things remain open. Whether one group or several ran the waves is unresolved. Whether more waves are coming — the pattern of escalating sophistication suggests the operators are still working — is unknown. And why 1,367 BTC is sitting unspent in 4,585 addresses, rather than being laundered, is the question researchers are watching most closely.
