Coldcard seed generation flaw in bitcoin cold wallets was exploited on July 30, when more than 1,000 bitcoin, worth about $70 million, were drained from 1,196 wallets in a 41-minute window. A total of 1,082.65 BTC were swept between 01:10 and 01:51 UTC across six blocks, with three intervening blocks containing nothing; early reporting captured only one of the four destination addresses. The stolen proceeds sit in four addresses and have not moved; drained wallets show 1,183 used native segwit, seven an older standard and six an older format still.
The device’s seed generation used a software substitute seeded from the chip’s serial number and its clock registers, and that software substitute supplied the entropy used to create new wallet seeds. An internal build setting told it to skip that randomness generator, and a check in a supporting library tested only whether the setting existed rather than whether it was switched on. The serial number is fixed factory metadata, and clock values are timing state an attacker can narrow down or measure on a device of their own. The range of keys the device could ever produce collapsed from unimaginably vast to countable; on Mk4, Q and Mk5 the range is roughly four billion possibilities.
An attacker can generate candidate seeds on their own hardware, derive the addresses each would produce, and check those addresses against the public blockchain. Every step of that runs on the attacker’s machine. The victim’s device is not involved at any point and could be powered off in a safe on another continent. The combination of a software-substitute generator seeded by fixed serial and clock values, a build setting that skipped the intended generator, and a library check that only tested for the setting’s presence produced a small, enumerable keyspace that an attacker can search independently.
The devices affected by the flaw were Coldcard Mk4, Q and Mk5 models, which had their seed-generation range collapse to a countable set of possible keys. On Mk4, Q and Mk5 the range of keys the device could ever produce was roughly four billion possibilities. Of the wallets drained in the incident, 1,183 used the modern native segwit address format, seven used an older standard and six used an even older format. Those figures and the limited keyspace single out the specific Coldcard products and wallet formats implicated in the attack.
The Coldcard seed generation flaw in bitcoin cold wallets led to an incident that drained bitcoin from many wallets and left the stolen proceeds in a small number of addresses. Technically, the flaw arose from a software substitute for the randomness generator seeded from fixed chip metadata and clock registers, combined with a build setting and library check that produced a greatly reduced, enumerable keyspace; this incident serves as a cautionary example of hardware wallet vulnerabilities tied to seed generation flaws.
