The Coldcard Security Breach, Explained Simply

The short answer

A build error in Coldcard's firmware, present since March 2021, caused some devices to generate seed phrases from a weak software substitute instead of the dedicated randomness chip they were built around. That made the resulting keys guessable. Attackers worked out the flaw and started draining the affected wallets.

If you don't own a Coldcard, your Bitcoin was never touched by this. If you do, Coinkite has published exactly which firmware versions are affected, and the section below on moving your seed applies to you.

What actually went wrong

Every hardware wallet needs a way to generate a private key that's truly unpredictable. Coldcard was built with a dedicated chip for exactly this. In 2021, the code that generates seed phrases was moved to a new internal library, and a safety check in that move was written incorrectly: it tested whether a setting had been mentioned in the build rather than whether it had been turned on. That check passed when it should have failed, and seed generation quietly fell back to a simple software substitute meant for devices with no randomness chip at all.

The result is easier to grasp as a number. A seed phrase is supposed to carry 128 bits of entropy, which is another way of saying there are 2 to the power of 128 possible seeds an attacker would have to work through. Affected devices produced closer to 40 bits on the older Mk2 and Mk3, and around 72 bits on the Mk4, Mk5 and Q. Those look like modest reductions written down. They aren't. Each missing bit halves the search space, so 40 bits is not a third of the protection of 128 bits, it's the difference between “no computer will ever get there” and “a determined person with ordinary hardware can work through it.”

Because your public addresses are visible to everyone on the blockchain, an attacker could generate candidate seeds, check them against the addresses already on the ledger, and go straight to the ones that matched. No seed phrase needed, no physical access, no contact with you at all.

The flaw sat there for five years. Coinkite's own review missed it, and the company initially suggested the flaw was subtle enough to need frontier AI tooling to find. That part is worth a caveat: an independent Bitcoin developer, James O'Beirne, reviewed this exact code path in May 2025, named the library, and raised the possibility that the software fallback was the one actually running. The concern was discussed and set aside, more than a year before any coins moved. It was found by a person, with ordinary methods, and the finding didn't get acted on.

The one workaround that sidesteps this entirely

This flaw only exists because the device generated the randomness for you. There's a way around that: rolling physical dice and using the results to build your own seed phrase by hand, instead of trusting any chip to do it. Economist Saifedean Ammous, who wrote up clear guidance on this event, put the safe threshold at 100 fair, independent, private dice rolls for a 24-word seed, with 50 or more also appearing safe. Do that correctly, and no firmware bug on any device can ever make your key guessable.

Coldcard had supported this for years as an optional extra step, aimed at people who didn't want to trust the hardware's randomness even in principle. It was the one thing that protected people here. Owners who rolled their own dice were fine on exactly the same firmware that left everyone else exposed, because their entropy came from outside the broken code path entirely.

I mention it because it exists, not because I expect most people to do it. It's slow, unforgiving of mistakes, and genuinely not simple. For most people, multisig across a few trusted vendors gets you almost all of the same protection with far less friction.

If your Coldcard seed needs to move

If you generated your seed on a Coldcard without 100 private dice rolls, or you're not sure whether you did, or you're not sure which firmware you were on, treat your seed as affected. The safe process:

1. Generate a completely new seed on a device that isn't affected, or an air-gapped computer.
2. Carefully write down and verify the new backup.
3. Check the wallet fingerprint and a receiving address against what the hardware wallet itself shows.
4. Send yourself a small test amount first.
5. Once the test transaction confirms and everything checks out, move the rest.

A strong BIP-39 passphrase adds a real extra layer, but only if it's strong and kept separate from the seed. Even with one, moving to a freshly generated seed is worth doing.

If all of that feels like too much right now, moving your funds to a reputable exchange temporarily, just until you're ready to set up a new seed safely, is a reasonable stopgap. It's not where Bitcoin should live long-term, but it beats sitting on a seed you don't trust while you figure it out.

For the latest official word, use Coinkite's own channels only: blog.coinkite.com and coldcard.com/docs/upgrade.

Why Coldcard, of all devices

If you've shopped for hardware wallets, you probably know Coldcard by reputation: air-gapped, open-source, built for people who want maximum control and don't mind a steeper learning curve. It's not the beginner-friendly option. It's the one serious, security-conscious people reach for.

That's exactly why this matters. This wasn't a cheap knockoff device or a careless company. It was one of the most respected names in Bitcoin hardware, and a coding mistake still slipped through for years. That's not a reason to distrust Coldcard specifically. It's a reason to stop assuming any single vendor is infallible, no matter how good their reputation is.

The safeguards that didn't help

The uncomfortable part of this story isn't that a device had a bug. It's that the things we normally point to as proof a wallet is trustworthy were all present, and none of them caught it.

Air-gapping didn't help. Coldcard's signature feature is that it never touches a computer; transactions move back and forth on an SD card. That defends against something reaching into your device. It does nothing when the weakness is in how the key was created, because the resulting addresses publish themselves on the blockchain for anyone to check against.

Open source didn't help by itself. The code was public the entire time. Public isn't the same as read. “Anyone can audit this” quietly becomes “surely someone already has,” and for five years, on the single most important function in the device, nobody had. Open source is still better than the alternative, because it's what eventually made the flaw findable and provable. It just isn't a guarantee on its own.

Reproducible builds didn't help. They let you confirm the firmware on your device matches the published source. That worked exactly as designed here, and faithfully reproduced the flawed code. Verifying that you got what the developers intended to ship is a different question from whether what they intended to ship was correct.

The lesson: don't put all your trust in one device

A single hardware wallet, from any brand, is one company's mistake away from a problem. For most people, holding a modest amount of Bitcoin on one well-chosen device is still perfectly reasonable. But once you're holding an amount that would genuinely hurt to lose, it's worth adding a second layer: multisig.

Multisig means your Bitcoin needs signatures from more than one key to move, and those keys can come from completely different hardware vendors. If one vendor has a flaw like this one, an attacker who compromises that single key still can't move your funds, because they don't have the others.

This is exactly the scenario multisig services like Casa are built for. Casa users who had a Coldcard as one of several keys in their setup weren't at risk of losing anything. Worst case, they rotate out one key. That's the entire point of spreading trust across more than one device.

How to not be in the next one

There was no single habit that would have prevented every part of this story, and anyone selling you one is overstating things. What follows are the layers that actually did the work here, roughly in order of how much protection they buy for the effort involved. You don't need all of them on day one.

1. Spread your keys across more than one vendor. This is the big one. Multisig means your Bitcoin needs signatures from several keys before it can move, and those keys can come from different manufacturers. One vendor's flaw then costs you an afternoon rotating a key instead of everything you hold. It's the difference between a single point of failure and no single point of failure.
2. Generate your own randomness with dice. Rolling physical dice and building your seed phrase by hand is the one thing that fully sidestepped this flaw, because the entropy never came from the broken code at all. The guidance going around during this event put the safe threshold at 100 fair, independent, private rolls for a 24-word seed, with 50 or more also appearing safe. It's slow and unforgiving of mistakes, so it isn't for everyone, but it's genuinely the strongest answer to “what if the device lies to me.”
3. Always go to the source to load software. Firmware, wallet apps, recovery tools: get them from the vendor's own domain, typed in yourself or opened from a bookmark you made earlier. Not from a search ad, not from a link in an email, not from a third-party mirror. Where the vendor publishes a signature or a checksum, check it. That habit is what turns “I hope this is the real download” into something you actually know.
4. Never click a link you didn't go looking for. If a message, post, DM, text, or ad brought the link to you, treat it as unverified no matter how official it looks. Navigate to the site yourself instead. Nearly every loss that follows a security event comes through a link somebody clicked because the timing felt right, and the timing feeling right is exactly what the sender was going for.
5. Use a hot wallet well, rather than avoiding it. A wallet on your phone is the right tool for small, spendable amounts, and using one regularly is how you get fluent before larger sums are involved. Keep it deliberately small, keep it separate from your long-term savings, keep the phone's operating system updated, and download the app from the vendor's own site rather than trusting an app store listing to be the real thing. Here's how to check that a wallet really is who it claims to be.
6. Keep your seed phrase off every screen, permanently. No photos, no cloud notes, no password manager entry, no typing it into a recovery tool that offered to help. Written down, verified, stored somewhere physical. A seed that has never touched an internet-connected device can't be taken by anyone who isn't standing in your house.
7. Slow down when something feels urgent. Every expensive mistake in this story, both the original flaw and the scams that followed it, had speed in common. Real security news keeps until tomorrow. Pressure to act right now is information about the person applying it.

If you want the wider version of this, beyond Bitcoin, digital security hardening covers the same thinking applied to passwords, two-factor authentication, and phishing.

If you're starting out

You don't need multisig on day one, and you shouldn't feel behind if you don't have it yet. What you do need, from the very beginning, is to get your Bitcoin off exchanges and into a wallet only you control. Every single-vendor flaw is still safer than leaving your Bitcoin sitting on a platform that can freeze it, lose it, or get hacked at the account level.

A hot wallet on your phone is a fine place to start for small, spendable amounts. As your holdings grow into something that would genuinely hurt to lose, that's the point to move to a hardware device, and eventually to multisig across more than one device.

What entropy actually means here

The word at the center of this whole story is entropy: genuine, unpredictable randomness. A wallet generates your seed phrase from a source of entropy, and that randomness has to be real. If it isn't, meaning a chip or piece of code takes a shortcut and produces something only partially random, the space of possible keys shrinks enough that an attacker can eventually guess them, exactly what happened here.

You can't inspect a chip and confirm its entropy is genuinely high quality yourself. That's not a flaw unique to Coldcard, it's true of every hardware wallet on the market. Which is why the real defense isn't picking the “right” brand, it's never trusting one vendor's entropy with everything you own. Multisig across multiple manufacturers means one vendor's bad randomness, whichever vendor it turns out to be, can't empty your wallet.

This same idea applies to every password you've ever created, not just Bitcoin seeds. A short PIN, something like four digits, only has ten thousand possible combinations, so a computer can try every single one in seconds. Stretch that to an eight-character password mixing letters, numbers, and symbols, and the possibilities climb into the trillions, enough to slow a computer down but not enough to stop modern hardware, which can still work through it in anywhere from hours to a few years. Keep going to sixteen or more genuinely random characters, and you cross into a search space so large that even the fastest hardware available today would take far longer than anything has existed to try every option. Length and true randomness are what make a password actually hard to guess, far more than throwing in a capital letter or a symbol.

Your Bitcoin seed phrase takes this to another level entirely. A standard 24-word BIP-39 seed carries 256 bits of entropy, meaning there are 2 to the power of 256 possible seeds. Written out, that number is:

115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007, 913,129,639,936

There isn't really a way to picture a number that size, so try this instead: imagine every atom in the observable universe turned into its own supercomputer, all of them running since the Big Bang, each one checking billions of seed phrases every second. Even then, together they wouldn't make a meaningful dent in the total number of possible seeds. That's the scale of protection a properly generated seed phrase actually has.

Which is exactly why the Coldcard flaw mattered so much. All of that math only holds if the randomness behind it is real. The theoretical search space doesn't protect you if the device quietly narrows it down before you ever see your seed phrase. Genuine entropy is the whole game, on a Coldcard, on any other hardware wallet, and on every password you type anywhere else.

Watch out for the scammers this brings out

Every time news like this breaks, scammers show up pretending to help: fake “urgent migration” tools, DMs asking you to “verify” your seed phrase, links to look-alike websites. Never type your seed words or passphrase into a website, computer, phone, chatbot, or anyone offering to “recover” your funds for you, no matter how official they sound. If something is telling you to move fast and hand over your words, slow down. That urgency is the scam.

Common questions