Highlights

Coinkite says a build error caused Coldcard hardware wallets to use a software fallback for seed generation instead of the intended hardware random generator, making seeds far more guessable. This oversight reduced effective seed strength dramatically, enabling a rapid exploit that drained roughly 594 BTC (~$38M). The company suspects attackers leveraged AI to analyze its open-source firmware, while its own AI review weeks earlier found no problem. Firmware updates patch the bug but cannot recover funds from seeds already created.

Sentiment Analysis

• 
  The overall sentiment is mixed-to-negative. Technical details reveal a critical implementation error with serious financial consequences for users. The breach generated urgent concern and criticism of development and review practices. There is also some mitigation: Coinkite released emergency firmware updates and migration guidance, which offers a constructive path forward.
  
  
  

  
  65%
  

  
  
  
  The 65% reflects significant negative impact tempered by active remediation and clear communication.
  

Article Text

Coinkite, the maker of Coldcard hardware wallets, announced that a flaw in its firmware led to the compromise of seeds created on affected devices. The company says a build-time error allowed seed generation to rely on a software fallback random generator — inherited from MicroPython — rather than the device's intended hardware random number generator. As a result, wallet seeds produced on affected models were far more predictable than designed, and attackers exploited the weakness to steal an estimated 594 BTC, roughly $38 million.

The issue stems from two implementations of a randomness-fetching function existing in the codebase with identical interfaces: one implemented by Coinkite to use the hardware random source, and another software fallback. A preprocessor check verified only the presence of a configuration symbol instead of its value, so builds could complete using the fallback implementation without triggering an error. According to Coinkite, the fallback has been in use for seed generation since a migration in March 2021.

Coinkite reports that all current models are affected to some degree. The company estimates that an Mk3 seed's effective entropy was reduced to about 40 bits, far below the intended 128-bit strength. Later models (Mk4, Q and Mk5) include extra entropy from secure elements, raising their effective entropy to about 72 bits — an improvement but still short of the target. Other devices that use different codebases, such as Tapsigner, Opendime and Satscard, are not affected.

The company believes an attacker used AI tools to scan its open-source firmware and locate the flaw. Coinkite noted it had run a strong AI model over the same code weeks earlier and that the model had failed to identify the bug. "Attackers and defenders have the same tools," the company wrote, "but this time it did not help us, and only helped the bad guys." This raises questions about limitations of automated code review and the need for layered human oversight in security-critical systems.

The exploit unfolded quickly: funds were drained from roughly 500 wallets within about 25 minutes and later consolidated into a single address. Because firmware updates cannot retroactively strengthen seeds already generated on compromised firmware, affected users must create new seeds on patched hardware and migrate funds. Coinkite released emergency hotfixes — version 5.6.0 for Mk4 and Mk5, and 1.5.0Q for the Q — and advised users to generate new seeds only after updating and to protect them with strong BIP-39 passphrases or substantial physical entropy (for example, at least 99 dice rolls). Mk3 owners, whose model is out of support, are directed to a separate migration path.

Industry reaction emphasized urgency for users to move funds. Rival wallet maker Trezor said its own devices are not affected and reminded users to secure funds promptly if exposed. Block published an independent analysis and confirmed its products were not impacted; its hardware lead urged any exposed users to transfer funds as soon as they can safely do so. A recovered or restored seed created on affected Coldcard firmware remains weak even after being imported into another brand's device, so migration to a new, securely generated seed is necessary.

The incident underscores several broader lessons: first, even well-regarded open-source projects can harbor subtle build or configuration errors with major consequences. Second, while AI-assisted code analysis can be valuable, it is not a panacea and may miss flaws or, as alleged here, be used by malicious parties to find vulnerabilities faster than defenders can remediate them. This event highlights the need for rigorous build verification, deterministic build environments, and multiple layers of review — automated and human — for cryptographic code.

For affected users, the immediate priorities are to update patched firmware on supported models, generate a new seed on patched hardware, adopt recommended passphrase protections or high-entropy generation methods, and migrate funds without delay. For manufacturers and the broader community, the episode is a prompt to re-evaluate development workflows, threat models that include AI-assisted attackers, and the adequacy of auditing practices for wallet firmware.

Key Insights Table