Critical Entropy Vulnerability in Coldcard Wallet Leads to $70.2 Million Loss
A vulnerability in Coldcard Mk3 firmware allowed attackers to exploit weak entropy during seed generation, leading to significant losses. The incident resulted in the draining of 1,196 addresses of Bitcoin within a short timeframe.
Our full investigation: Coldcard hack: where the bitcoin is now — 1,038.85 BTC still on four addresses, 649 ETH into Tornado Cash
On July 30, 2026, a critical vulnerability was identified in the firmware of Coldcard Mk3 hardware wallets, specifically in versions 4.0.1 to 4.1.9. This flaw caused the wallets to utilize a weak software pseudo-random number generator (PRNG) instead of the intended hardware true random number generator during seed generation, resulting in insufficient entropy of approximately 40 to 72 bits.
As a consequence, attackers were able to derive private keys and drain a total of 1,196 addresses, amounting to 1,082.65 BTC, which is roughly $70.2 million. The stolen funds were quickly consolidated into four addresses and have not been moved since. Coinkite issued a security advisory about 30 hours after the incident, confirming the vulnerability, releasing a fixed firmware version, and urging affected users to migrate their funds.
Addresses in this incident
| Address | Chain | Role | Check |
|---|---|---|---|
| bc1qt8rrtnxlszm7rcdjpeepzk076jd5hevakqerzjyxpk8u3p6dfh2q92ua36 | BTC | mentioned in coverage | Check live |
| bc1qgw8v0fa7877ntrueghhz5tyc8lah8hm5phvsmu | BTC | mentioned in coverage | Check live |
| 0x160a7a4c067b084f03400c6980ac29f73f6782f6 | ETH | mentioned in coverage | Check live |
Roles are attributed to the source that stated them. Addresses without an attributed role are listed because coverage mentioned them, not because we assign them a part in the incident.