Coldcard Forces User-Supplied Entropy After $130M Bitcoin Seed Exploit

When your threat model is math, “good enough” randomness isn’t good enough. Coinkite has shipped a sweeping Coldcard firmware update after a seed-generation weakness dating to 2021 enabled coordinated thefts totaling roughly $130 million in Bitcoin from air‑gapped devices. The fix centers on one idea: put humans back in the entropy loop—then harden everything around it.

The update, firmware 5.6.1 for Mk4 and Mk5 and 1.5.1Q for Coldcard Q, follows a three‑week review that involved external security researchers and AI models, including Kimi. Coinkite urged all Mk4, Mk5, and Q users to upgrade immediately, particularly anyone who created seeds between 2021 and July 2026. Those users need to generate a new seed with the patched firmware and move funds.

What went wrong was not a typical key‑exfiltration bug. On some affected devices, the flaw reduced effective entropy from the expected 128 bits to roughly 40 bits—still large by human standards, but within precomputation range for a determined adversary. In July, attackers began emptying Bitcoin from Coldcard wallets, with the first observed hit draining 594 BTC—about $38 million—across roughly 500 wallets in 25 minutes. By early August, Galaxy Research estimated $88.6 million stolen across 4,585 addresses, later revising the tally above 1,778 BTC—about $112 million at the time—through three major waves and dozens of smaller incidents. Total losses are now near $130 million. Coinkite suggested adversaries may have used AI to analyze historical, open‑source firmware and surface the weak path—programmatic, scalable, and fast.

The headline change: seed creation now requires user‑provided randomness that the device mixes with its own. Coldcard will not proceed without at least one of the following: 65 key presses, 50 dice rolls, or 128 coin flips. Under the hood, the backup pseudo‑random number generator (Yasmarang) has been replaced with SHA‑256 Hash_DRBG, and new checks aim to catch hardware RNG failures. Beyond entropy, Coinkite patched areas implicated in transaction integrity, USB handling, firmware validation, Delta Mode, and backups.

One quiet but meaningful guardrail lands at the moment of finality. The device now re‑validates a PSBT immediately before signing; if anything has changed since the user review—say, a compromised computer attempts a last‑millisecond swap—the signing halts with a warning. Coinkite framed this as a theoretical vector, not observed in the wild, but it tightens an edge case that attackers love: time‑of‑check vs. time‑of‑use.

The security story here isn’t simply “add more bits.” It’s about entropy provenance and accountability. User‑in‑the‑loop randomness is messy—humans are pattern‑prone and often overconfident about what “random” looks like—but it meaningfully raises the bar when combined with a sound DRBG and robust health checks. For high‑stakes cold storage, the cognitive friction of dice or key‑presses acts like two‑factor for entropy: machine plus human, mixed irreversibly. The trade‑off is product experience. Some users will find 50 dice rolls tedious; a subset will shortcut the process. That’s where the device’s mixing function and minimum thresholds matter, and why the choice of a well‑studied construction like SHA‑256 Hash_DRBG is sensible.

The broader environment is shifting, too. AI is accelerating both discovery and remediation. Coinkite leaned on models in review; at the same time, the attackers likely leveraged large language models to mine version histories and stitch together an exploit path. Ledger CTO Charles Guillemet captured the moment plainly: “We’re treating this as a serious reminder of how the whole security model of a hardware wallet lives or dies on randomness. Cryptography is hard and implementing it securely is harder. This week’s Coldcard incident made that visible in the most expensive way possible.” Elsewhere, swap service Boltz paused operations after saying AI‑assisted attackers were finding bugs faster than its developers could patch, and a volunteer Bitcoin Red Team used AI agents to surface thousands of potential issues across hundreds of Bitcoin projects.

From a business trust lens, Coinkite’s response pushes in the right direction: force stronger defaults, add defense‑in‑depth around signing and USB surfaces, and replace brittle components. Still, requiring manual entropy subtly shifts some responsibility back to users. That’s acceptable only if the device makes it hard to do the wrong thing and easy to verify the right thing—precisely what the new thresholds, DRBG swap, RNG health checks, and PSBT pre‑sign validation attempt to enforce.

Investigations remain active. Coinkite said law enforcement is working to identify those responsible and that the company continues to assist customers migrating to new wallets. The fixes won’t rewind losses, but they do reset the model toward something more resilient: assume code will be read by machines, minimize trust in any single RNG, and verify the transaction that actually gets signed—not merely the one the user thought they approved.