594 BTC Gone in 25 Minutes: The Coldcard Flaw That Made Seed Phrases Guessable

Hardware wallets are supposed to remove a single category of risk: the possibility that someone who is not you can compute your private key. Early this morning, roughly 500 Bitcoin holders discovered that their devices had failed at exactly that job, and had been failing quietly since March 2021.

The loss came to about 594 $BTC, roughly $38 million, and it took 25 minutes.

Bitcoin Wallet Hack: What exactly happened?

Between 01:31 and 01:56 UTC on Friday 31 July 2026, an attacker swept funds out of around 500 separate Bitcoin wallets. The mechanics were industrial. More than 1,300 individual UTXOs were moved across 500 transactions inside a three-block window, then 562 BTC was consolidated into a single address. At the time of writing, that address has not moved.

The victim profile is unusually consistent:

• Every drained wallet was single-signature.
• Every one held more than 0.15 BTC.
• Most had been dormant for years.
• Wallet creation dates spanned 2021 to 2026, closely matching the window during which the flaw was live.

That last point is the tell. The attacker was not picking targets by observing the network. The targets were determined by when each wallet was created.

How did the attacker guess keys that should be unguessable?

This is the part that matters, and it has nothing to do with phishing, malware, or a compromised computer.

A Bitcoin seed phrase is meant to be drawn at random from a pool so vast that guessing is arithmetically hopeless. The entire security model rests on that randomness being real. Hardware wallets include a dedicated hardware random number generator precisely so that the randomness does not depend on software.

According to analysis published by the Bitcoin engineering and security teams at Block, affected Coldcard firmware was not using it.

A build setting instructed the device to skip its own hardware randomness generator. A check in a supporting library then tested only whether that setting existed, not whether it was switched on. With no working hardware source and no error raised, key generation fell through to a basic software substitute, seeded from the device's serial number and its internal clock registers.

Neither of those inputs is secret. The serial number is fixed factory metadata. The clock values are timing state that an attacker can narrow down, or simply measure on an identical device they own.

The result: a seed that was supposed to be one candidate among an unimaginable number became a solvable problem. Coinkite, the Canadian firm that builds Coldcard, traced the change to a commit dated 1 March 2021, shipped in firmware 4.0.0 that same month.

The flaw sat in production for nearly five and a half years before someone exploited it.

Which Coldcard devices are affected?

Coinkite's advisory centres on Mk3 devices where the seed was generated on firmware 4.0.1 or later. Based on preliminary analysis, the company says Mk4, Q and Mk5 appear unaffected.

One critical distinction: exposure depends on which firmware was running at the moment the wallet was created, not on when you bought the device or what firmware it runs today. Updating your firmware now does not retroactively fix a seed that was generated with bad randomness. The key material is already weak.

Reporting on the full list of affected models has not been fully consistent, and the investigation is still developing. If your seed was generated on any older Coldcard, treat it as suspect until Coinkite confirms otherwise rather than assuming your model is on the safe list.

What should you do right now if you own a Coldcard?

Coinkite is urging affected users to move their funds. Concretely:

1. Identify which device and firmware generated your seed. Not what it runs now. What it ran when the wallet was first created.
2. If that was an Mk3 on firmware 4.0.1 or later, treat the seed as compromised. Not at risk. Compromised.
3. Generate a fresh wallet on a device you have reason to trust, and move the funds. Do not reuse the existing seed anywhere.
4. Do not wait for confirmation that you were specifically targeted. The wallets drained this morning were mostly dormant, which means their owners were not watching. The attack cost nothing per additional target.
5. Consider multi-signature for meaningful balances. Every wallet drained in this incident was single-signature. A multi-sig setup across devices from different manufacturers would have survived a flaw in any one of them.

If you generated your seed by rolling dice and entering the entropy yourself, a practice Coldcard has long supported, your randomness did not come from the broken code path.

Why did the Bitcoin price not react?

It barely moved. Bitcoin traded around $63,847 through the morning, down roughly 1% on the day and already softer on the week before the news landed.

Partly that is scale. $38 million is a rounding error against a $1.28 trillion market cap, and the stolen coins have not been sold, only consolidated. Partly it is the current market. This week also contained a record two-day crash in Korean equities and a 17% KOSPI rebound, and crypto ignored both. A market where almost nothing produces a reaction is not necessarily a strong one.

What does this actually tell us about hardware wallets?

Three things worth separating from the panic.

1. This is not a Bitcoin failure. The protocol worked exactly as designed. It faithfully executed valid signatures from keys the attacker was able to reconstruct. Nothing about Bitcoin's cryptography was broken.
2. This is not an argument against self-custody. Exchange failures have cost holders far more than $38 million, repeatedly. The lesson is not that self-custody is unsafe, it is that a hardware wallet is a piece of software running on a small computer, and software has bugs.
3. It is an argument against single points of failure. The uncomfortable feature of this incident is the delay. A silent randomness failure produces no symptoms. Nothing looks wrong. There is no alert, no failed transaction, no warning. The wallet works perfectly for five years and then, in 25 minutes, does not.

That is the case for multi-signature setups, for hardware from more than one vendor, and for user-supplied entropy on high-value wallets. Not because any single device is untrustworthy, but because a device that fails silently gives you no chance to notice before it matters.