Coldcard Bitcoin Exploit Explained: Entropy, How Keys Are Generated, and Why Bits Matter

Somebody has been emptying Bitcoin wallets that were never supposed to be reachable.

The coins sat on Coldcard devices—hardware wallets from Canadian manufacturer Coinkite, the kind that never touch the internet. No phishing link. No malware. No stolen laptop. The attackers simply worked out what the private keys were.

Galaxy Research has now tracked more than 1,596 BTC stolen across three confirmed waves, with a suspected fourth wave that would lift the total to roughly 2,055 BTC—about $130 million at current prices. One sweep moved $70 million in 41 minutes. Coinkite says at least 15 separate attackers have piled in.

The company published a technical backgrounder on August 1 explaining what went wrong. It is an unusually candid document, and the short version is that the wallet was rolling loaded dice for eight years without anyone noticing.

Zero is still something

In 2021, Coinkite moved Coldcard’s cryptography onto libsecp256k1, the same library Bitcoin Core uses. Sound decision. The integration is where it fell apart.

The migration quietly rerouted seed generation away from Coldcard’s own hardware random number generator and onto MicroPython’s software fallback—a small algorithm called Yasmarang that exists for devices with no randomness chip at all.

Coldcard has a randomness chip. It just stopped being asked.

The reason is almost too small to believe. A build guard used #ifndef, which checks whether a setting exists rather than whether it’s switched on. Coinkite had defined that setting as zero, meaning “off.” Because zero still counts as defined, the safety check passed and the build completed. Both versions of the function had identical signatures, so nothing looked wrong.

“The bulk of randomness on the COLDCARD was coming from a PRNG that I didn’t know was actually in the source code base,” Coinkite wrote, referring to a pseudo-random number generator—software that produces numbers that look random but follow a fixed recipe from a starting value.

Feed the recipe the same starting value and you get the same output. Every time.

On Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, that starting value came from the chip’s serial number and its clock. Coinkite estimates the resulting search space at about 40 bits. Newer models mixed in a little secure-element entropy, lifting them to roughly 72 bits.

Neither is 128, the target.

The gap matters more than it looks. Bits are exponents. A 128-bit search space holds more combinations than there are atoms in the observable universe, and nobody is searching it. Forty bits is about a trillion—a number a decent laptop can chew through. Each bit you lose halves the work.

Block’s engineering team, which published its own analysis, put the newer devices’ effective secure-element search space at 2^32 candidates, averaging around 2^31 trials. Their assessment for the older boards is blunter: for a known device ID, timer state and call history, wallet generation is deterministic.

And deterministic is the opposite of random, which is essential to cryptography.

Not “weak.” Predictable.

Coinkite suspects it was found by machine. “We have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue,” the company wrote, adding that it had recently run one of the best available AI models over the same code and turned up nothing. “Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.”

Fixed firmware is out for every affected model. It does not repair existing seeds; those wallets have to be regenerated and the funds moved. Decrypt has covered how air-gapped storage changes after an exploit like this and tracked the losses climbing past $114 million.

What entropy actually is

Entropy is the measure of how much an attacker doesn’t know.

In other words, it’s basically uncertainty, counted in bits. One bit is one coin flip: two outcomes, and a guesser gets it right half the time. Ten bits is 1,024 outcomes. Each bit doubles the guesser’s workload.

A Bitcoin wallet is a very large number kept secret. The address people send coins to is derived from it mathematically, and the derivation runs one way only—you can go from key to address, but never back.

So the security of every wallet rests on one question: How many numbers would an attacker have to try?

If the number was picked with 128 bits of entropy, the answer is “more than physics permits.” If it was picked with 40, the answer is “give me some time.”

This is the same property that makes the quantum computing threat worth arguing about—a quantum machine would attack the math that links key to address. The Coldcard bug never needed to. It made the keys guessable before that math got involved.

This is where the vocabulary gets slippery. A pseudo-random generator produces output that passes statistical tests for randomness, so basically nothing a spreadsheet would flag. That output is still fully determined by its seed value. It looks random but isn’t.

Statistical randomness and cryptographic unpredictability are different properties, and Coldcard’s output would have sailed through the first test while failing the second completely.

True randomness has to come from physical noise: electrical jitter in a circuit, thermal fluctuation, radioactive decay. That’s what the hardware chip on the Coldcard was for. That’s the chip the build flag disconnected.

Then Luke Dashjr brought up the dice

As users scrambled to regenerate seeds, many reached for the obvious low-tech fix. Coldcards let you roll physical dice and feed the results in as entropy. Coinkite’s own guidance treats seeds made with at least 50 independent, private dice rolls as not at risk from the bug.

It may sound stupid, but the company actually sells a bag with “100 cute and tiny little dice” to make the whole process easier for you.

On July 31, Bitcoin Core developer Luke Dashjr posted a warning: “Quite a few people suggesting/using dice to mitigate the Coldcard vulnerability. Note that common dice are not designed to be cryptographically secure. If you are going to do this, you probably should buy precision casino dice. And even then, have another source of entropy.”

Bitcoin Twitter did not take it calmly.

“lol now you can’t even roll dice,” one user wrote. “Self custody is done for…” Another asked whether he should hire someone with Parkinson’s to throw them. (Not nice.)

Probably the most useful reply came with arithmetic. Developer Justin Sharp ran the numbers on exactly how much a bad die costs you:

“Overkill. A perfect d6 gives 2.585 bits per roll. A noticeably biased die, e.g. with one face landing 20% of the time instead of 16.7%, still gives about 2.55 bits. Across 99 rolls that’s the difference between ~256 bits and ~252 bits of entropy.”

Four bits out of 256. That’s the whole penalty for a visibly unfair die.

Dashjr isn’t wrong that cheap dice have measurable bias—injection-molded pips remove slightly different amounts of plastic from each face, which is precisely why casinos use flush-filled precision dice. He’s right about the physics and wrong about the stakes. Losing four bits from 256 leaves you at 252. Coldcard’s bug left users at 40.

There’s a sharper argument buried in his advice, though, and it isn’t about manufacturing tolerance. It’s about not trusting any single source. Coldcard’s failure wasn’t that its entropy was slightly biased—it was that one component silently stopped contributing and nothing caught it.

What to do about it

If you generated a seed on an affected Coldcard without dice rolls (really) or a strong BIP-39 passphrase, that seed is compromised.

Update the firmware, generate a new seed, verify the fingerprint, send a test transaction, then move everything. Coinkite’s advisory walks through it model by model. Exported seeds carry the flaw with them—moving a bad seed into a different wallet app doesn’t solve anything.

For everyone else, the takeaway isn’t that hardware wallets are broken or that dice are a trap.

It’s that “random” is a claim, and claims need checking. Coldcard’s source code was public the entire time. The intended hardware RNG was sitting right there in the binary. Reviewers confirmed it existed and never confirmed the seed generator actually called it.

Eight years of audits looked at the right code. Nobody checked whether it ran.