Staff Reports
A surprise confession from Coldcard maker Coinkite this week has shaken the crypto world: a bug in Coldcard firmware made seed phrases guessable, and attackers moved fast. Blockchain investigators are tracing waves of on‑chain sweeps that tie back to seeds generated on the flawed firmware. The company has pushed out fixed firmware, but for thousands of users the damage is already done and the lesson is ugly and plain — “offline” is not the same as “invincible.”
What actually broke: the RNG/entropy failure
Coinkite says a software change in past builds accidentally used a weak fallback random number generator instead of the device’s true hardware random source. That made some seed phrases far less random. In short: the math that makes your secret key secret was broken. Coinkite published an advisory and a technical write‑up, named the affected firmware ranges, and released corrected firmware that restores proper hardware entropy and adds build‑time checks so this mistake can’t slip back in. The fix helps going forward, but it does not “repair” any seed already created on the bad firmware.
How attackers exploited it and how big the hit looks
Because seeds were easier to guess, attackers could enumerate likely keys and sweep funds on‑chain without touching victims’ devices. Investigators tracking blockchain flows have linked many drains to the bug; estimates from on‑chain analysts put losses in the hundreds to thousands of Bitcoin — roughly a low‑hundreds‑million‑dollar problem as totals climbed while sweeps continued. Coinkite’s guidance is blunt: update your Coldcard firmware first, then generate a new seed on the fixed code and migrate funds after careful testing.
What you should do now — no drama, just steps
If you used a Coldcard for seed generation, assume exposure unless you added strong independent entropy (like 50+ dice rolls) or created the seed on fixed firmware. The safe play is simple: install the fixed firmware, create a new seed on the fixed device, move a small test amount, then migrate the rest. Use a strong BIP‑39 passphrase and, if you can, add physical dice entropy when you make the new seed. And yes, contact Coinkite support and consider filing a report with law enforcement — on‑chain tracking helps, and exchanges may freeze traced coins if authorities act.
The bigger picture: trust, accountability, and private property
This episode is a warning shot. Hardware wallets are marketed as the gold standard for cold storage, and many users stored life savings under that promise. A single engineering slip erased that promise for some people. The crypto industry needs stricter QA, outside audits, and clearer consumer protections. Users must still take sensible precautions, but companies that sell devices meant to guard private property should face real accountability when they fail. Expect heat, lawsuits, and calls for regulation — and expect users to be more skeptical about the word “offline” from now on.
