how a build flag drained 116M in bitcoin

A single line of firmware shipped in March 2021 told every Coldcard hardware wallet to skip its dedicated randomness chip. For five years nobody noticed. Then an attacker brute-forced the weak seeds in 41 minutes, draining 1,816 BTC from more than 5,200 addresses across four attack waves. The incident is the largest hardware wallet exploit in crypto history, and it is forcing the entire bitcoin self-custody model to answer a question it has avoided since inception: who audits the code that generates your keys?

Nobody was phished. No device was stolen. No seed phrase was written on a sticky note. The Coldcard hardware wallet, the device that bitcoin maximalists recommended above all others for cold storage, generated weak private keys for five years because a single build flag told the firmware to skip its dedicated randomness chip. An attacker figured out how to guess the resulting seeds, and on July 30, 2026, began emptying wallets at a pace that left no time to react.

“Perhaps the hardest part about this is that I did everything right,” Canadian entrepreneur Jonathan Goodman wrote on X after losing 18.25 BTC, worth approximately C$1.6 million, from a Coldcard stored in a safety deposit box. His post has been viewed more than 7.6 million times. The sentiment captures the core of the crisis: the people who lost money were not careless. They were the most security-conscious bitcoin holders in the ecosystem, and they followed every recommended practice except one they could not have known about. The firmware that generated their keys was broken from the day it shipped.

The fallout extends far beyond the immediate losses. Bitcoin is flowing back to exchanges for the first time since FTX collapsed. Hardware wallet manufacturers face calls for independent audits of their seed generation code. ARK Invest’s director of digital asset research called the self-custodial hardware space “a disaster.” And Coinkite’s CEO suggested that artificial intelligence found the bug, raising the question of whether every open-source firmware repository is now an attack surface that AI can mine faster than human reviewers can defend.

The build flag: how one line of code broke everything

The technical failure is simple enough to explain in a single paragraph, which makes it more damaging, not less. Coldcard’s firmware defines a macro called MICROPY_HW_ENABLE_RNG and sets it to zero because Coinkite supplies its own hardware random number generator wrapper. A supporting cryptographic library called libngu checked whether the macro existed. It did not check whether the macro was enabled. Because the macro existed but was set to zero, libngu concluded that hardware randomness was unavailable and fell through to MicroPython’s Yasmarang software fallback. That fallback was initialized from the chip’s unique serial number and timer registers and collected no fresh entropy after initialization.

The consequence was a catastrophic reduction in key strength. A 12-word BIP-39 seed phrase is designed to encode 128 bits of entropy, a number so large that brute-forcing it would require more energy than the sun will produce in its lifetime. The Yasmarang fallback, seeded from a chip serial number and timer state, produced approximately 40 bits of effective entropy on the Mk3 and roughly 72 bits on the Mk4, Mk5, and Q. Block’s security research team, which published a detailed technical analysis, set conditional ceilings below 2^40.7 and 2^73.3 and warned that the latter figure is not equivalent to 73-bit cryptographic security.

Forty bits of entropy means approximately one trillion possible seeds. That is a large number by human intuition but a trivial number by computational standards. A modern GPU cluster can enumerate one trillion candidates in hours. The attacker did not need physical access to any device. The attacker did not need to intercept any communication. The attacker needed only to generate candidate seeds, derive their corresponding bitcoin addresses, and compare those addresses against the public blockchain. Every match was a wallet that could be emptied.

The flaw shipped in firmware version 4.0.1 in March 2021. It persisted through every subsequent firmware release until the emergency patch on July 31, 2026. Every Coldcard seed generated during that five-year window without the manual dice-roll option is potentially compromised. Coinkite estimates that the dice-roll option, where users physically roll dice at least 50 times and type in the results, bypasses the broken code entirely. The company also says a strong BIP-39 passphrase creates a separate wallet the seed words alone cannot reach. But as Casa CEO Nick Neuman pointed out: “You just cannot ask people to roll dice to be secure with your self-custody. It is a non-starter for 99% of people.”

The four waves: anatomy of a $116 million sweep

https://x.com/cryptodotnews/status/2081704401815900545

The attack unfolded in distinct waves, each larger than the last, suggesting either a single operator refining their approach or multiple attackers working from the same vulnerability.

Wave one hit on July 30 at approximately 2:14 a.m. UTC. The attacker swept 594 BTC from roughly 500 addresses in 25 minutes, broadcasting transactions at a uniform 30 sat/vB fee rate with no change outputs. Galaxy Research noted that no other bitcoin transactions in the previous 30 days carried the same fee-rate-plus-no-change signature, making the operator identifiable even though they remained anonymous.

Wave two followed within 48 hours, lifting the cumulative total to 1,082 BTC from 1,196 addresses. The transaction construction matched Wave one closely enough for Galaxy to assess with high confidence that the same operator was responsible.

Wave three brought the confirmed total to 1,367 BTC from 4,585 addresses, worth approximately $89 million. Galaxy cautioned that Wave three should not be assumed to involve the same attacker, as the transaction patterns diverged from the first two waves. TRM Labs independently identified differences in transaction construction across waves that hint at multiple operators.

A suspected fourth wave ran throughout August 4, sweeping roughly 449 BTC from 709 addresses on Galaxy’s revised count. If confirmed, cumulative losses reach approximately 2,055 BTC, worth close to $130 million. Galaxy has reported roughly 600 suspected attacker-controlled addresses to federal investigators, compliance firms, and cybersecurity investigators.

The laundering has been minimal. TRM Labs found that most victim funds are pooling at a small number of attacker-controlled addresses with limited onward movement. As of August 4, the only confirmed laundering consisted of a single 64.9 BTC deposit to Wasabi Wallet’s coinjoin service and 200 ETH deposited to Tornado Cash. One opportunist posted an OP_RETURN message on the bitcoin blockchain offering to launder the stolen funds for a 7% fee. The relative inaction suggests the attackers have not yet determined how to move a sum large enough to attract attention wherever it lands.

The section a competitor could not write: what 40 bits of entropy actually means

Most coverage of the Coldcard hack describes the entropy reduction as a technical detail. It is the entire story, and the arithmetic reveals why the attack was inevitable rather than merely possible.

A 128-bit seed has 2^128 possible values, a number with 39 digits. Brute-forcing that space is not a matter of computing power or patience. It is physically impossible with any technology that obeys the laws of thermodynamics. This is why hardware wallets work at all: the security of a properly generated seed does not depend on the device remaining secret, the firmware remaining uncompromised, or the manufacturer remaining trustworthy. It depends on mathematics.

A 40-bit seed has 2^40 possible values: 1,099,511,627,776. One trillion. A single NVIDIA H100 GPU can compute roughly 10 billion SHA-256 hashes per second. Deriving a bitcoin address from a candidate seed requires several cryptographic operations beyond a single hash, but the order of magnitude holds. One trillion candidates can be exhausted in minutes to hours on a GPU cluster that costs a few thousand dollars to rent.

The Mk4, Mk5, and Q devices had roughly 72 bits of effective entropy. That is better than 40 bits but still catastrophically below 128 bits. Block’s analysis set the search space at approximately four billion possibilities under certain constraints, a number that runs on ordinary hardware. The distinction matters: Mk3 owners face near-certain compromise if their addresses are identified, while later-model owners face a probabilistic threat that depends on how much the attacker knows about their device’s unique ID, boot timing, and prior random number generator calls.

The critical insight is that the attacker does not need to know which addresses belong to Coldcard users. Every bitcoin address is public. The attacker generates candidate seeds, derives addresses, and checks them against the entire blockchain. Any match is a confirmed Coldcard wallet with a weak seed. The attack scales linearly with computing power and requires no intelligence about individual victims. Galaxy Research warned that “every vulnerable device will eventually be emptied” because the attacker can work through the entire search space at leisure.

This is fundamentally different from a phishing attack, an exchange hack, or a supply chain compromise. Those attacks require targeting specific victims. The Coldcard exploit targets mathematics. Every wallet generated on affected firmware is vulnerable regardless of how carefully the owner stored the device, protected the seed phrase, or followed security best practices. The only defense was an action the manufacturer never told users they needed to take: rolling physical dice.

The self-custody reversal: bitcoin flows back to exchanges

https://x.com/cryptodotnews/status/2080918976310452554

The Coldcard exploit is producing a behavioral shift that would have been unthinkable 18 months ago. Bitcoin is moving from self-custody wallets back to centralized exchanges, reversing a trend that began when FTX collapsed in November 2022 and accelerated through 2023 and 2024 as hardware wallet sales surged.

The net transfer of bitcoin from self-custody wallets to exchange addresses has been positive every day since July 31, according to on-chain flow data. OKX reported record exchange inflows in the days following the exploit. The exchange’s chief compliance officer Jonathan Brockmeier said customer behavior changed “noticeably” as users moved assets away from self-custody.

The flow reversal is not limited to panicking retail holders. Institutional allocators who previously cited self-custody as a risk-management advantage are reassessing. Bitcoin ETF inflows reached $211.5 million on August 5, led by BlackRock’s IBIT and Fidelity’s FBTC, suggesting that at least some capital is rotating from direct bitcoin holdings into regulated wrappers that eliminate seed-management risk entirely.

Bloomberg senior ETF analyst Eric Balchunas argued that spot bitcoin ETFs remove the seed-management problem for investors who want price exposure without operational risk. “An ETF fixes this,” he wrote. On-chain analyst Willy Woo pushed back, arguing that self-custody remains the only path to genuinely sovereign bitcoin ownership and that ETF wrappers introduce counterparty risk that the bitcoin network was designed to eliminate.

The data tells a more specific story than either side acknowledges. The addresses moving bitcoin back to exchanges skew toward single-signature wallets holding between 0.5 and 10 BTC, the range most likely to represent individual holders who used a single Coldcard as their primary storage. Multisignature wallets and addresses associated with institutional custodians have shown no comparable movement. The panic is concentrated among the exact user profile the Coldcard was designed for: technically literate individuals who chose self-custody over exchanges and relied on a single hardware device as their sole security layer. The irony is precise. The users who trusted the hardware most are the ones most exposed, while users who distributed trust across multiple devices and key generation methods are unaffected.

The tension is real but the framing is incomplete. The Coldcard hack did not expose a flaw in self-custody as a concept. It exposed a flaw in one manufacturer’s implementation of seed generation. Vincent Bouzon, a cybersecurity expert at Ledger, drew the distinction explicitly: “Every wallet ultimately depends on a root secret generated from high-quality entropy. That generation must be anchored in secure hardware, with an architecture that cannot silently downgrade to an untrusted software-based source.” He called the alternatives worse, describing software wallets on non-secure hardware as riskier and centralized exchange custody as “not ownership, it is an IOU.”

The AI question: did a model find this bug?

Coinkite’s response to the exploit included a claim that has divided the security community. CEO Rodolfo Novak, known as NVK, suggested that the attacker used AI to discover the firmware flaw, and that Coinkite’s own AI-assisted code review of the same repository weeks earlier had found nothing.

“To every other developer: we believe this is a sober reality of the new AI paradigm,” Novak wrote. “AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry’s most seasoned experts.” He added: “If your firmware is open-source or has ever been public, assume it is already being read by attackers and defenders alike.”

Security researchers have pushed back on this framing. A build flag that disables a hardware random number generator is a human engineering error, they argue, and conventional code review should have caught it years before any language model read the repository. Andrew Lazutkin, chief technology officer at Tangem, drew a different conclusion: “This incident is a good example of why open-source firmware should not automatically be equated with better security.”

The AI attribution matters less than the structural question it raises. Whether the attacker used AI, conventional static analysis, or manual review, the result is the same: a bug that sat in plain sight for five years in an open-source repository was found and weaponized. If AI tools can systematically scan firmware repositories for entropy flaws, randomness downgrade paths, and build configuration errors, then every hardware wallet manufacturer with public code faces an expanded attack surface. The question is not whether AI was involved in this specific attack. The question is whether AI makes this class of attack reproducible at scale.

The timeline supports the concern regardless of the mechanism. Coldcard’s firmware has been open source since its inception. The MICROPY_HW_ENABLE_RNG macro and its zero assignment were visible in a public GitHub repository for five years. Multiple security researchers, firmware auditors, and the broader Bitcoin development community had access to the code throughout that period. None of them caught the flaw. The Coinspect research group published its Ill Bloom findings on weak PRNG flaws in older software wallets in early July 2026, a separate but thematically identical vulnerability that drained more than $5 million from addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon. The clustering of entropy-related exploits within a single month suggests either coordinated research or a shared analytical approach that is surfacing this class of bug faster than it has been found historically.

The opposing case at full strength

https://x.com/cryptodotnews/status/2083357545108746288

The narrative writes itself: self-custody is broken, hardware wallets cannot be trusted, move your bitcoin to an exchange or an ETF. The opposing case requires examining what the Coldcard hack actually proved and what it did not.

First, this was not a failure of self-custody. It was a failure of one company’s firmware engineering. The bitcoin protocol worked exactly as designed. The cryptography worked exactly as designed. The vulnerability existed in Coinkite’s build configuration, not in the security model of hardware wallets as a category. Ledger, Trezor, and Block have confirmed their devices are unaffected. The lesson is that seed generation must be verified independently, not that seed generation is inherently unreliable.

Second, the exchange alternative carries its own catastrophic risks. FTX lost $8 billion in customer funds. Mt. Gox lost 850,000 BTC. Celsius, Voyager, and BlockFi collectively lost billions more. The Coldcard exploit drained $116 million across 5,200 addresses over five days. FTX drained $8 billion from millions of users in a single night. The scale comparison favors self-custody even in its worst failure mode.

Third, multisignature configurations would have prevented every theft in this exploit. A multisig wallet requires multiple independent keys to authorize a transaction. If even one key was generated on a non-Coldcard device, the attacker could not have completed the sweep. Casa, Unchained, and other multisig providers have reported zero customer losses from the Coldcard exploit because their architectures distribute key generation across independently designed devices from different manufacturers. A 2-of-3 multisig wallet using one Coldcard, one Ledger, and one Trezor would have been immune to this attack even if the Coldcard key was fully compromised, because the attacker would still need to independently compromise one of the other two keys. The Coldcard hack is an argument for multisig, not an argument against self-custody.

Fourth, the bitcoin price reaction undermines the catastrophic framing. Bitcoin traded near $64,300 through all four attack waves and has not broken below $63,800 since the exploit became public. The market is pricing the Coldcard hack as a company-specific event, not a systemic threat to bitcoin’s security model. If the market believed self-custody was fundamentally broken, the price response would have been severe. It was not.

What would invalidate the self-custody thesis: if multiple hardware wallet manufacturers were found to have the same class of entropy flaw simultaneously, suggesting a systemic rather than idiosyncratic failure. If the attack surface expands to include devices with hardware random number generators that pass all existing tests but contain subtle biases. Or if the operational burden of key management proves permanently beyond the capacity of individual users, making professional custody the only viable option for most bitcoin holders regardless of the theoretical security advantages of self-custody.

What to watch

• Galaxy Research’s final loss tally after Wave four confirmation. The gap between 1,596 BTC (confirmed) and 2,055 BTC (estimated) represents roughly $30 million in unverified losses. If the fourth wave is confirmed and additional waves follow, the total could exceed $150 million and push the incident past Bybit’s 2025 blind-signing exploit in impact.
• On-chain movement of attacker-controlled bitcoin. Roughly 90% of stolen funds remain unmoved. When the attacker begins laundering, the chosen method (mixing, cross-chain bridges, OTC desks) will indicate sophistication level and potentially enable attribution. TRM Labs is monitoring in real time.
• Exchange inflow trends over the next 30 days. The post-Coldcard flow reversal could be a temporary panic response or the beginning of a structural shift. If net flows back to exchanges persist beyond August, it suggests a durable change in how bitcoin holders weigh self-custody risk against counterparty risk.
• Independent audit adoption by hardware wallet manufacturers. Kraken CSO Nick Percoco called for independent testing of seed generation in production firmware. If Ledger, Trezor, and other manufacturers adopt third-party entropy audits as standard practice, it validates the systemic concern. If they do not, the industry is betting the same class of bug will not appear elsewhere.
• Regulatory response to the self-custody failure. The SEC and CFTC have not commented on the Coldcard exploit. If regulators use the incident to argue that self-custody is unsuitable for retail investors, it could accelerate the push toward mandatory custodial frameworks for digital assets.

Frequently asked questions

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Hardware wallet security incidents carry significant risk of permanent fund loss. Past security performance of any device does not guarantee future security. Published August 5, 2026.