Coldcard Firmware Flaw Exposed: How a Seed Generation Bug Cost Users $100 Million

Woofun AI reports that the paradox of perfect security was laid bare when Jonathan Goodman, a Toronto entrepreneur, discovered his bitcoin holdings had been completely drained despite adhering to strict self-custody protocols. The incident, which unfolded on July 29, involved a Coldcard hardware wallet that had never connected to the internet and was stored in a safe deposit box, alongside a seed phrase kept in a separate secure location. Goodman reported losing 18.25 bitcoin, valued at just over $1.

17 million at the time of the attack, in an event he described as particularly devastating because he believed he had followed all security best practices. In an X post dated Aug 1, Goodman lamented, "Perhaps the hardest part about this is that I did everything right," highlighting the psychological shock of a breach that defied conventional security wisdom. This individual loss was not an isolated incident but rather a symptom of a systemic vulnerability affecting thousands of Coldcard users worldwide.

The scale of the heist was quantified by Galaxy Research, which stated it had high confidence that 1,596 bitcoin—worth over $100 million—had been stolen from approximately 7,300 addresses in a coordinated series of attacks. Galaxy research head Alex Thorn estimated on Aug. 4 that at least 15 different attackers were exploiting the flaw, demonstrating that physical access to the devices was not required for the theft. The attackers were able to compromise wallets that were entirely air-gapped, undermining the fundamental premise of hardware wallet security. This widespread exploitation revealed that the vulnerability was not in the physical device or its network isolation, but in the cryptographic process used to generate the secret passwords, or seed phrases, that protected users' coins. The sheer volume of stolen funds and the number of affected addresses underscored the severity of the defect.

The theoretical security of hardware wallets, often referred to as cold wallets, rests on the principle that private keys never leave the chip and are thus inaccessible to online hackers. This contrasts sharply with software wallets, or hot wallets, which run on internet-connected devices and are vulnerable if the host system is compromised. Historically, paper wallets represented an early form of cold storage, where users wrote down keys on physical media, offering protection from digital attacks but carrying significant risks of physical damage or loss. Hardware wallets like Coldcard occupy a middle ground, combining the security of offline storage with the convenience of digital management.

However, as Bobby Gray, founder of TEXITcoin, noted, 'Air-gapped systems help, but they are not a perfect fix.' Gray emphasized that security must begin with how keys are generated and continue through every part of the custody process, a point where Coldcard's implementation failed.

Coinkite, the Toronto-based company behind Coldcard, underwent a significant strategic pivot that shaped the wallet's development. In March 2016, Coinkite announced it was sunsetting its hosted hot wallet service, citing persistent floods of junk internet traffic aimed at knocking their services offline, along with mounting legal costs and regulatory complications. The company sought to build decentralized hardware and 'software-not-as-a-service,' a shift that occurred early in crypto's history, before Bitcoin's second halving, when one bitcoin traded slightly above $400. This pivot first produced Opendime in April 2016, a small USB stick that generated and concealed a private key, allowing bitcoin to be passed like a physical bearer instrument. Physically breaking the device's seal revealed the key, enabling funds to be spent. This focus on physical, offline security laid the groundwork for the Coldcard wallet.

Coinkite announced the Coldcard device in December 2017 under the headline 'The World Needs An Open, Cheap & Ultrasecure Hardware Wallet,' arguing that existing hardware wallets were too expensive and dependent on proprietary companion apps. The original design combined a numeric keypad, screen, secure element, and MicroSD slot, allowing users to move unsigned and signed transaction files between the Coldcard and a computer without establishing a live data connection.

The first units shipped in 2018, followed by a next model released in April 2019 that added more features. With every updated version, the Coldcard became more complex and theoretically more technologically sophisticated. This complexity was part of its appeal, catering to users willing to inspect transaction details, manage backups, and construct their own security model. Features such as duress PINs, encrypted MicroSD backups, multisignature support, and user-supplied dice rolls appealed to bitcoin holders who treated custody as an adversarial exercise.

Woofun AI reports that the hidden flaw entered Coldcard during a major software change in 2021, specifically in firmware version 4.0.0, which Coinkite described as 'All New Code, Same Great Features.' This release replaced existing code with new equivalents, added reproducible builds, and thanked an account named 'switck' for the 'new source code library.' Bitcoin developer James O'Beirne identified the 'switck' account as belonging to Coinkite co-founder Peter Gray after finding 58 code changes published under that name carrying the same cryptographic signature Gray used on changes published under his own name.

Such signatures function like tamper-resistant digital autographs, showing that the same secret signing key approved both sets of work. Coinkite has not responded to the identity claim. Switck developed libngu, a collection of reusable code incorporated into the Coldcard firmware installed on customers' devices. One of its jobs was to help produce the randomness used when creating wallets, a critical component of seed generation.

O'Beirne questioned the randomness process while auditing Coldcard's code in May 2025. After tracing the source of the wallet's randomness to libngu, he raised the possibility of a defect with Coinkite. The company replied that a genuine problem would probably have been discovered already, according to O'Beirne. 'This is the same guy that shrugged off my report of the possibility of the defect in May 2025,' he later wrote of Peter Gray. This dismissal highlights a critical gap in the company's internal review processes. The failure to recognize the potential issue, despite external scrutiny, suggests a lack of rigorous validation of the new code library. The incident underscores the importance of independent audits and the dangers of relying solely on internal assurances of security, especially when dealing with complex cryptographic systems.

The technical root cause of the vulnerability was a failure in entropy and randomness generation. Randomness is critical because a new wallet must select a seed from an enormous number of possible values, with the unpredictability of that selection measured in bits of 'entropy.' Every additional bit doubles the number of possibilities, making a seed harder to guess. Coldcard was supposed to obtain that randomness from a dedicated hardware generator inside the device.

Instead, a configuration error sent the wallet to a simpler software generator that used information including device and timing data. That information isn't completely random, so it could be narrowed down or reproduced, sharply reducing the number of seeds an attacker needed to test. According to Block's Bitcoin engineering and security team, the error came down to how two pieces of software communicated to read a setting. Libngu checked only whether the setting existed, not whether it was on or off.

The firmware therefore built normally while using the wrong generator. Block said affected Mk2 and Mk3 devices received no secure randomness through that process. Mk4, Q and Mk5 devices received some, but the software kept only a small share. Coinkite estimates that those newer devices produced seeds with 72 bits of randomness instead of the intended 128. That left about 72 quadrillion times fewer possible seeds, making them susceptible to brute-force attacks.

The timeline of negligence reveals that the vulnerable code was traced to firmware version 4.0.0, released on March 17, 2021. Coinkite identifies version 4.0.1 as the first affected release for Mk2 and Mk3 users. The source code was publicly available, and the correct hardware generator was present in the finished firmware. Reviewers confirmed that the component existed but failed to follow the seed-generation process from beginning to end and determine which generator the device actually used. The company said AI-assisted reviews it ran before the theft also missed the error.

Tests using several leading AI models after the incident failed to identify it as well. This highlights a significant blind spot in both human and AI-assisted code review processes. The complexity of the code and the subtle nature of the configuration error allowed it to remain undetected for years, despite the availability of the source code and the presence of the correct components. The failure of AI models to identify the error further underscores the limitations of current automated security tools in detecting nuanced cryptographic vulnerabilities.

Coinkite has released fixed firmware for all affected Coldcard models and release tracks. The update fixes future seed generation but does not strengthen seeds already created with vulnerable software. Affected users must install the corrected firmware, generate a new seed, and move their bitcoin to addresses derived from it, according to Coinkite's advisory. The company has promised to publish a fuller account of the failure and is supporting affected customers directly, though it did not respond to requests for comment.

The incident does not restore confidence in an exchange or bank as counterparty, but it shows that self-custody substitutes a different dependency: Users hold the keys, but the wallet manufacturer still determines whether those keys were created safely. The key to Jonathan Goodman's million-dollar stash of bitcoin sat in a safe deposit box, inside a device that never went online. But, due to the flaw in Coldcard's seed generation software, Goodman's effort to physically protect his fortune made no difference. This marks a critical lesson in the limits of self-custody and the importance of rigorous code verification.