The 41-Minute Sweep: How a Silent RNG Fallback Collapsed Coldcard's 128-Bit Security Into a $70 Million Machine

The 41-Minute Sweep: How a Silent RNG Fallback Collapsed Coldcard's 128-Bit Security Into a $70 Million Machine

Hook: The Numbers That Shouldn't Exist

On July 30, 2026, 1,196 Bitcoin wallets were emptied in exactly 41 minutes. Total haul: roughly $70 million. No phishing emails. No malicious contract approvals. No fake Ledger Live downloads. The victims were Coldcard owners, the self-described "paranoid class" of Bitcoin — the people who engrave seed phrases into stainless steel, who refuse to touch hot wallets, who built their entire security theology around one core promise: your private keys never leave this device.

I don't say this lightly: their devices kept that promise, and it didn't matter. They were robbed anyway.

Block and Galaxy Research's forensic teams have now reconstructed the full chain of events, and the technical reality is more disturbing than any headline you've read. The attackers never touched a single Coldcard. They never intercepted a transaction. They simply figured out the mathematical space where those wallets' private keys lived — a space so dramatically smaller than it should have been that a standard computer can now traverse it in minutes.

Early reports put the damage at $38 million. The real number is nearly double that. And here's the part that should genuinely scare anyone reading this: the root cause was a coding error from March 2021 that silently redirected a critical random number generation task to a weak fallback. That error ran, undetected, for roughly four years. It survived firmware updates, security audits, and the daily use of tens of thousands of Bitcoin's most security-obsessive users.

This is not a story about one Canadian hardware wallet company's bad luck. It is a story about a foundational assumption — that hardware wallets are mathematically impenetrable — cracking under the weight of a single, quiet regression.

Context: Why Coldcard Was Supposed to Be Different

To understand the weight of this failure, you need to understand what Coldcard is within Bitcoin culture. Coinkite, the company behind it, has built a device that is deliberately austere. No touchscreen. No Bluetooth. No wireless connectivity at all. Just a small OLED display, a numeric keypad, and a microSD slot. It is the wallet equivalent of a diesel truck — ugly, uncomfortable, and unstoppably functional.

Coldcard has been the default recommendation of Bitcoin educators, high-net-worth holders, and "maximalist" communities precisely because of its offline-first approach. It's designed to generate seeds and sign transactions in a fully air-gapped environment. The entire marketing thesis is that your private keys — the alphanumeric secrets from which every address and every signature derives — are generated on-device and never, ever leave it. This is the "not your keys, not your coins" doctrine achieved in its purest hardware form.

That doctrine rests, fundamentally, on one ingredient: the random number generator, or RNG. When your Coldcard creates a new wallet, it isn't inventing words out of thin air. It's producing a 128-bit (12 words) or 256-bit (24 words) entropy seed, per the BIP39 standard. The mathematical security of that seed — and therefore of every address that derives from it — is the collision-resistance of that entropy space. At 128 bits, there are roughly 3.4 × 10^38 possible seeds. Brute force is not merely impractical; it is physically impossible under known physics.

But that security is only as strong as the unpredictable "noise" your device feeds into the generator. And this is where Coldcard's 2021 error becomes fatal.

Core: The Math of Betrayal

Let me walk you through the mechanics, because this is where the story's stakes are actually defined.

In March 2021, a Coinkite software update introduced what appeared to be a minor change to the RNG task scheduling. What it actually did, according to the forensic reconstruction, was create a scenario where the device's RNG task could fail silently — and then, instead of stopping all operations, the firmware allowed operations to continue using a backup randomness source.

A backup RNG source, in principle, is not evil. It's a redundant safety net. The problem is what that fallback was: a deterministic combination of the device's serial number and its internal clock time.

I don't need to tell you how predictable these two inputs are. A serial number is a sequential production identifier. A clock is a frozen timestamp readable by anyone who has ever seen the device. Combined, they produce a seed space that is not 128 bits. Not 64 bits. Block's engineering team estimated the actual blast radius at roughly four billion possibilities — about 2^32.

Think about that number. The Bitcoin security model assumes, at minimum, 2^128 entropy. What was actually deployed for affected devices was 2^32. The gap between those two numbers is 2^96. That is not a linear difference or even a modest degradation. It is a difference measured in orders of magnitude that exceed every computational resource on Earth combined — going the other way. In other words, the difference between "impossible to brute force for the life of the universe" and "a single laptop can attempt every candidate in an afternoon."

This is why the attack was so fast. Once the attacker understood the derivation scheme — device serial number plus clock, fed through the wallet's seed derivation path — they did not need to break anything. They merely needed to recompute.

Here is how the execution path unfolded, as reconstructed by Galaxy and Block's teams:

1. The attacker identified the vulnerable seed generation logic from the firmware.
2. They enumerated the plausible serial number and timestamp combinations.
3. For each candidate, they derived the BIP39 mnemonic, then the master private key, then the corresponding Bitcoin addresses.
4. They indexed that generated address set into a searchable database.
5. They scanned the public Bitcoin ledger for addresses in that set with nonzero balances.
6. Everything that showed a balance got swept.

None of this required physical proximity. None of it required malware. It was, as I've called it elsewhere, an address-sweeping attack executed at industrial scale. And it took 41 minutes from the first transaction to the last.

Three intermediate blocks in the sweep contained no activity at all. That is a telling forensic detail. The attacker did not execute a streaming, continuous signature script. They deliberately batched their transactions, with pauses to match block confirmation cadence. That cadence was almost certainly intentional: it keeps the attacker's own transactions under exchange surveillance thresholds and avoids triggering pattern-based alerts at major custodians.

Let me be direct about how close this came to being even worse. Was the four-billion-candidate space the maximum possible exposure? No. It's the space for seed generation attempts under the specific weak fallback. But the same class of vulnerability may exist beyond the 1,196 wallets already identified. The surviving victims aren't the ones who have been drained; the ones we know about have already been hit. The more worrying population is the set of affected users who got a vulnerable seed, received no further incoming funds into those addresses, and therefore may never be swept — but are still carrying a key that an attacker could match against the next time they update their address database.

That is the quiet terror behind this incident: you cannot look at your wallet and know whether your seed is compromised.

This is where the fix becomes so deeply unsatisfactory. Coinkite has released patched firmware, and that patch prevents newly generated seeds from falling back to the weak source. But it does absolutely nothing for seeds that have already been generated on affected devices. A firmware update cannot "re-roll" the entropy of a seed that has already been exposed to the deterministic weak source. The only remedy is to create a completely new seed on a verified, patched device, transfer the funds, and permanently retire the old addresses.

And here is the point that deserves much more emphasis than it's getting: there is currently no home-based test that can determine whether a specific Coldcard seed is part of the vulnerable set. None. You cannot plug in your device, run a diagnostic, and learn whether you're the next account in the sweep queue. This informational blackout is the breeding ground for panic — and, worse, for complacency. Users who assume they're immune because they "bought their device after 2022" may find out otherwise only when their balance hits zero.

The disclosure gap compounds this. Coinkite's initial announcement did not cover all affected hardware models. Block researchers explicitly flagged the Mk2 series as also being at risk, a detail absent from the early public statements. If you own a Mk2 Coldcard and you have been waiting for official confirmation before moving funds, you are already gambling.

One more layer of the attack deserves attention: the attacker's use of a paid account on a major blockchain intelligence service to query address histories. This is the same surveillance infrastructure that compliance teams and law enforcement agencies use daily. The attacker used it for pre-attack intelligence gathering. That fact alone tells you the barrier to entry for this kind of operation is not sophisticated zero-day exploitation. It is math, plus a $40-per-month data subscription.

Contrarian: The Real Story Is the Broken Assumption, Not The Broken Firmware

The obvious narrative coming out of this is "Coldcard failed." That's true on the surface, but it's also a trap. If the story ends at Coinkite's bug, then the industry — and every other hardware wallet vendor — learns exactly the wrong lesson.

Let me be clear: any hardware wallet whose security model depends on a single entropy source with a silent fallback path is susceptible to this same class of failure. Ledger uses a secure element with a different RNG implementation. Trezor uses its own stack. Every one of them routes seed generation through their own mix of hardware and software, and every one of them can carry a regression like this one. The difference between Coldcard and its competitors is not immunity; it's simply the distribution of unluckiness.

The same logic applies to the market's reflex to pronounce "hardware wallets: dead" and pile into custodial exchanges. This is precisely the wrong time to capitulate on self-custody. But it is absolutely the right time to stop treating any single device as a complete security architecture.

Consider the unsung hero of this story: the BIP39 passphrase. For users who attached a strong, manually-entered passphrase on top of their BIP39 mnemonic, the compromised seed alone is insufficient to move funds. An attacker who derives the mnemonic still lacks the passphrase-derived extension that changes the root key. This is a genuinely massive mitigation that we are not talking about nearly enough. The forensic reports show that the swept wallets were predominantly those without such a passphrase layer.

The deeper systemic gap, however, is that when the mobile wallet ecosystem overwhelmingly fails to support BIP39 passphrases, users are tacitly discouraged from setting them up. That's not a Coldcard issue. That's an industry-wide interface failure. And it matters precisely because the passphrase is the cheapest, most accessible defense-in-depth tool available.

I'll go further. The real failure this incident exposes is not RNG math. It's the absence of independent verification mechanisms in the hardware wallet industry. Four years of silent operation means nobody — not security researchers, not the vendor's own audit partners, not any third-party testing service — was routinely checking that the RNG path was consistently generating full-entropy samples across the entire device lifecycle. In software engineering, this is called a "canary test," and the fact that it didn't exist for a security-critical product in Bitcoin's highest-trust enclave is itself the story.

My own experience tracking similar incidents reinforces this view. During the 2020 DeFi liquidity freeze, I watched block-by-block as Yearn vault withdrawals clogged under gas wars. The immediate operational failure was congestion — but the deeper failure was a protocol that had never load-tested its own withdrawal path under adversarial conditions. This is the same pattern: we build on assumptions of "good behavior" without simulating the "bad path." We don't test what happens when the RNG fails, because we don't believe the RNG can fail. Coldcard just bought us a $70 million lesson in why that belief is untenable.

And here's the blind spot most analysts will miss entirely. If this causes a meaningful migration from self-custody hardware wallets to custodial exchange accounts, the actual consequence could be a centralization event. Bitcoin's on-chain balance consolidation at major custodians increases, chain surveillance gets more concentrated, and the very "trustlessness" that attracted these users to self-custody in the first place gets quietly eroded. The solution to a broken security model is not to hand your keys to a company. It's to stop trusting a single point of failure.

That's a conclusion no one from Coinkite or its competitors will articulate. But it's the one that matters most.

The Aftermath: What Do You Actually Do Now?

Facts first. If you own any Coldcard — especially a Mk2 or an earlier model — generated your seed at any point from March 2021 onward, and have not already migrated, you need to act as though your seed is exposed. This is not fear-mongering. It's the only rational response to a vulnerability whose exposure status cannot be verified at home.

Move the funds. Create a new seed on a device with patched firmware, and preferably using a wallet that generates entropy from multiple independent sources. Add a BIP39 passphrase. If you can't confirm the integrity of your existing device, treat it as compromised until proven otherwise.

Do not wait for Coinkite to publish a "complete" list of affected models. The Mk2 discovery proved their disclosures lag. If the data block on exposure is a Mk2, it should already be on your list.

Also pay attention to the chain and to the four known attacker addresses: bc1qq85..., bc1qx76..., bc1q8jy..., and bc1qnk4.... As long as those addresses hold unswept balances, the attack campaign remains in progress. A shift toward exchange deposit addresses would signal intent to cash out — which is the moment this story moves from security incident to macro price narrative.

But I don't want you to close this article focused only on Coldcard. I want you to focus on the structural lesson: no single device, no single vendor, and no single commitment to "offline paranoia" is a substitute for defense in depth. The architecture that survives over long time horizons is one that layers independent mechanisms — a hardware wallet, a strong passphrase, a multi-signature setup, and a secondary backup route — so that any single failure leaves you with a second wall to hide behind.

One last thing to watch: the 2026 record for crypto theft was broken before this incident even landed. The market has, admittedly, become numb. But numbness isn't maturity. As I wrote after Terra/Luna, treating losses as routine is how you eventually become someone else's liquidity.

Takeaway: The Question That Should Shape the Next Five Years

This entire incident reduces to a single question every hardware wallet vendor — and every self-custody user — must now confront: Who is test-driving the failure modes of your entropy source?

Coinkite shipped a silent fallback because it didn't simulate the RNG failing. Four years passed because no external party had the tooling to detect the degradation. The exploit was executed cheaply because 2^32 candidates is smaller than the number of phishing emails sent daily.

I don't know whether the remaining 4 addresses' funds will ever move or whether the attacker will strike again in 48 hours. I know the industry has a window, right now, to build something it has never had — public, auditable RNG validation tools that verify seed entropy as a routine extension of the wallet initialization process. Devices that genuinely want to claim "gold standard" status will make that test part of their standard operating procedure.

The ones that don't are telling you everything you need to know about their willingness to honor the word "security."

Do with that information what they did with their math: sweep it up, and act.