Key Takeaways:
- Multiple wallet models were found to contain a critical entropy flaw by COLDCARD.
- Security researchers traced it back to the theft of approximately 594 BTC that currently represent about $40 million in total value.
- Users are encouraged to create new seeds and move funds as soon as they perform firmware software updates.
Resolution into this flaw in Bitcoin’s wallet seed generation algorithm has stirred a serious security dilemma for the community of self-custodial bitcoin wallets led by COLDCARD. It follows news last weekend that around 594 BTC worth of nearly $40M had been swiped from wallets possibly associated with the weakness.
COLDCARD Reveals Critical Seed Generation Flaw
Coinkite, the company behind COLDCARD hardware wallets, issued an urgent security advisory warning that seeds generated on the Mk3 device running firmware version 4.0.1 or later may be vulnerable.
COLDCARD Mk3 Security Advisory
If you generated a seed on a Mk3 after firmware 4.0.1, your funds may be at risk.
Mk4, Q and Mk5 are not affected based on our early analysis.
Read the advisory and migrate carefully:https://t.co/3vgPHOjMS7
— COLDCARD (@COLDCARDwallet) July 30, 2026
The company explained that due to a chain of software flaws, the hardware random number generator was not able to contribute the anticipated amount of entropy when creating the wallet. Rather, some aspects of the production of the seeds involved a less robust randomization scheme based on software. It wasn’t just the Mk3.
Later Coinkite confirmed the seeds that had been generated prior to the newly released firmware updates would be affected too, but the estimated security impact on their specific devices would be very low.
The users who managed to create wallets that contained 50 or more private dice rolls during their initial setup were relatively safe since they used their own entropy source and not the faulty device to produce dice rolls.
Read More: South Korea Busts $9M XRP Scam After Fake Staking Site Traps 71 Investors in Just 7 Days
Nearly $40 Million in Bitcoin Linked to the Incident
The disclosure gained immediate attention after reports surfaced that roughly 594 BTC had been stolen from affected wallets. At current market prices, that amount represents close to $40 million in Bitcoin.
AI Emerges as a Possible Factor
Coinkite indicated that if attackers succeeded in exploiting the weakness, it could have been done with sophisticated AI algorithms, examining publicly released source code. The company said COLDCARD’s firmware is always open source, and it admits that threat actors might have exploited state-of-the-art artificial intelligence tools to uncover vulnerabilities that older methods of review didn’t catch.
Interestingly, Coinkite adds it had recently conducted a thorough audit of its own code base with one of the most popular AI models in the industry and still found the error. The company noted that its investigation was ongoing and preliminary estimates of how the attacks were carried out.
Users Told to Migrate Funds Immediately
Coinkite has already released emergency firmware updates for current-generation devices, including version 5.6.0 for Mk4 and Mk5 models and version 1.5.0Q for the Q device.
The company said, though, that current software will not be sufficient to remedy wallets that were already created via previous hard forks. Users are responsible to create a new seed after the update and to move their money to the new wallet.
Read More: Verus Bridge Hack Drains $11.6M as Hacker Exploits Tiny $10 Cross-Chain Flaw
