Coldcard’s five-year seed-generation flaw has renewed calls for independent testing of hardware wallet firmware after suspected attacks have drained nearly $90 million worth of Bitcoin from thousands of wallets.
- Kraken’s chief security officer has called for independent testing of hardware wallet seed generation after the Coldcard security flaw.
- Suspected attacks have drained nearly $90 million in Bitcoin, with Galaxy Research tracking more than 5,200 potential victim addresses.
- Coinkite has released fixed firmware but says affected users must create new seed phrases because updates cannot repair existing wallets.
- Security researchers traced the issue to a firmware error that used a weaker random number generator during wallet creation.
Kraken chief security officer Nick Percoco said in a post on X on Sunday that the incident should serve as a warning for the hardware wallet industry, arguing that manufacturers should not be the only parties verifying how wallet seed phrases are generated.
He said production firmware should undergo independent testing to confirm that the approved source of randomness is the one actually used when creating wallet secrets.
According to Galaxy Research’s latest blockchain analysis, suspected attackers have now swept more than 1,800 BTC from over 5,200 potential victim addresses across four observed attack waves, although the firm has stressed that those figures are on-chain estimates rather than confirmed losses. Coinkite has not verified every affected wallet, and blockchain data alone cannot determine whether a single actor carried out all of the attacks.
Coldcard flaw escaped review for more than five years
Coinkite disclosed on Thursday that the vulnerability dates back to March 2021, when the company migrated part of its firmware while integrating a new cryptographic library.
Instead of using Coldcard’s intended hardware-backed true random number generator to create wallet seeds, the updated firmware accidentally called a weaker deterministic pseudo-random generator provided by MicroPython.
According to Coinkite’s postmortem, the intended random-number generator remained active elsewhere in the firmware, allowing code reviews to verify its presence without revealing that wallet creation relied on a different source of entropy.
The company said it was unaware that the MicroPython generator existed in the relevant code path until the investigation. While the hardware random-number generator continued operating for other functions, it was no longer responsible for generating new wallet secrets.
Block’s Bitcoin engineering and security team independently reached the same conclusion during its technical review. The company said the affected firmware invoked the deterministic MicroPython fallback instead of the STM32 hardware random-number generator when creating wallet seeds. Although Block said it had not completed full empirical testing of every device, it decided to disclose its findings because reports of active theft had already emerged.
Coinkite estimates that seeds created on affected Mk2 and Mk3 devices may contain about 40 bits of effective entropy, while affected Mk4, Mk5 and Q models may contain about 72 bits instead of the intended 128 bits.
Hardware wallet testing has lacked entropy verification
Using the Coldcard incident as an example, Percoco argued that hardware wallet certification has overlooked one of the most important parts of wallet security.
He said users currently have to trust that manufacturers correctly implement seed generation because no independent process verifies that production firmware actually calls the approved entropy source. Existing certifications, including Common Criteria evaluations for secure elements, CSPN reviews and vendor-sponsored audits, do not systematically validate that relationship, according to Percoco.
To illustrate the gap, he pointed to NIST SP 800-90B, the U.S. standard governing the design and validation of true random-number generators used in cryptographic systems, along with Germany’s BSI AIS-31 framework, which sets similar testing requirements. He argued that comparable end-to-end verification does not currently exist for hardware wallets.
Percoco also compared the sector with payment security, noting that PIN entry devices cannot be shipped without independent laboratory testing, while U.S. government cryptographic modules require entropy source validation before approval.
Coldcard users still need new wallet seeds
As attack activity continued over the weekend, Coinkite said it had halted all shipments after confirming the vulnerability and destroyed every remaining device in its facilities containing the affected firmware.
The company nevertheless advised customers not to discard affected devices because they may become important if stolen funds are eventually recovered through legal proceedings. Coinkite added that its legal team would coordinate with law enforcement agencies in multiple jurisdictions where appropriate.
Firmware updates have already been released for every affected model, including version 4.2.0 for Mk2 and Mk3, version 5.6.0 for Mk4 and Mk5, version 1.5.0Q for Coldcard Q, and versions 6.6.0X and 6.6.0QX for Edge releases. According to the company, installing updated firmware only fixes future wallet creation and does not strengthen seed phrases generated before the patch.
For that reason, users covered by the advisory are being instructed to generate entirely new seed phrases after updating their devices, verify a receiving address, send a small test transaction, and migrate the remaining balance only after confirming the transfer succeeded.
Coinkite said wallets created using at least 50 fair, private dice rolls are not considered exposed by the random-number-generation flaw alone. The company added that a strong and unique BIP-39 passphrase provides another layer of protection but does not remove the weakness from an already affected seed, meaning migration remains the recommended course of action.
Ongoing attacks continue to expand the known losses
Separate blockchain analysis from Galaxy Research indicates that the attacks have continued since the vulnerability became public.
Alex Thorn, head of research at Galaxy, identified a suspected fourth coordinated attack wave on Aug. 3, bringing the firm’s observed total to about 1,815.75 BTC across 5,294 potential victim addresses if none of the address groups overlap. Thorn described the wallets as “likely Coldcard victims” and emphasized that the figures come from blockchain analysis rather than confirmed device records or law enforcement findings.
Galaxy also reported that attack activity reached 13.8 wallet sweeps per block during the latest wave, compared with a baseline of 0.3 sweeps per block before the incident. The firm observed that most victim balances were sent to newly created addresses instead of a single collection wallet, while some funds had already moved through second-hop transactions, making the stolen Bitcoin harder to trace.
According to Galaxy, users whose stolen funds remain in unconfirmed Bitcoin transactions may still have a narrow opportunity to broadcast a higher-fee replacement transaction before miners confirm the original transfer.
Citing Bitcoin Core documentation, the research firm noted that Replace-by-Fee can only be attempted while the transaction remains unconfirmed and does not guarantee recovery even when the legitimate owner still controls the affected keys.
