Coldcard's 40-Bit Seeds: A March 2021 Build Error Cost 1,816 BTC, and Updating Firmware Does Not Fix It
This is the largest hardware wallet exploit of 2026 and the most important detail is the one most coverage buries: the vulnerability is in key generation, so a firmware update does not remediate an affected wallet. Every seed produced by a vulnerable device remains vulnerable forever.
THE MECHANISM.
Coldcard firmware version 4.0.1, released March 2021, shipped with a build configuration error. Seed generation fell back on a weak software random number generator instead of the device's hardware entropy source. Effective key strength collapsed from the designed 128 bits to as little as 40 bits on older devices.
Forty bits is not a theoretical weakness. It is a search space of roughly one trillion - trivially brute-forceable with commodity computing. Critically, the attack requires no physical access to the device. An attacker enumerates the reduced keyspace offline, derives addresses, checks them against the chain, and sweeps whatever is funded. The device being air-gapped is irrelevant, because the secret never had the entropy its threat model assumed.
SCALE, PER FORENSICS RATHER THAN HEADLINES.
TRM Labs puts the total at approximately 1,816 BTC, about USD 116 million, drained from over 5,200 addresses across four theft waves beginning July 30, 2026. The first wave alone took roughly 594 BTC (~$38 million) in 25 minutes across about 500 wallets.
Media figures range higher - $130 million-plus, 7,300 wallets, and as many as 15 distinct threat actors are widely reported. The spread is expected: totals move with BTC price at time of valuation, with how many waves are counted, and with whether mempool-stage transactions are included. TRM's ~$116M / 1,816 BTC is the tighter forensic figure and is the one used here; the larger numbers are not wrong so much as differently scoped.
Attribution is unresolved. TRM identified no single actor and observed differing transaction construction patterns across waves, consistent with multiple independent parties working the same keyspace - some likely opportunistic copycats who reverse-engineered the vector after the first wave went public.
THE LAUNDERING TELLS A STORY.
Onward movement has been minimal: a single 64.9 BTC Wasabi deposit and 200 ETH into Tornado Cash on August 4, 2026, with most funds sitting at consolidation addresses. That is unsophisticated layering by the standards of state-sponsored groups, which reinforces the multiple-opportunists read rather than a single professional crew.
WHAT THIS BREAKS CONCEPTUALLY.
Hardware wallet security is usually argued as a physical threat model: extraction resistance, secure elements, supply chain integrity, air gaps. This incident bypassed all of it. The failure was a build flag - a software supply chain and release engineering failure that silently degraded the one input every other guarantee depends on.
It also stresses the open-source argument in an uncomfortable direction. The flaw sat undiscovered for over five years. Auditability is necessary but plainly not sufficient; someone has to actually audit the entropy path, and reproducible builds matter more than source availability, because the bug was in how the binary was built rather than in what the source said.
ACTION AND FALSIFIERS.
Anyone who generated a seed on a Coldcard between March 2021 and the patch should treat that seed as compromised and migrate funds to a newly generated one on unaffected hardware. Firmware updates protect future seeds only.
This assessment would need revision if the affected build range turns out narrower than March 2021 onward, or if entropy on a given device is shown to have met 128 bits despite the flagged build.
Sources (5)
AI Research
Key Takeaway
A build configuration error in Coldcard firmware 4.0.1 (March 2021) made seed generation fall back to a weak software RNG, collapsing effective key strength from 128 bits to as little as 40 - brute-forceable remotely, with no physical access. TRM Labs traces ~1,816 BTC (~$116M) drained from 5,200+ addresses across four waves from July 30, 2026. Patching the firmware does not repair an already-generated seed.
This is the largest hardware wallet exploit of 2026 and the most important detail is the one most coverage buries: the vulnerability is in key generation, so a firmware update does not remediate an affected wallet. Every seed produced by a vulnerable device remains vulnerable forever.
THE MECHANISM.
Coldcard firmware version 4.0.1, released March 2021, shipped with a build configuration error. Seed generation fell back on a weak software random number generator instead of the device's hardware entropy source. Effective key strength collapsed from the designed 128 bits to as little as 40 bits on older devices.
Forty bits is not a theoretical weakness. It is a search space of roughly one trillion - trivially brute-forceable with commodity computing. Critically, the attack requires no physical access to the device. An attacker enumerates the reduced keyspace offline, derives addresses, checks them against the chain, and sweeps whatever is funded. The device being air-gapped is irrelevant, because the secret never had the entropy its threat model assumed.
SCALE, PER FORENSICS RATHER THAN HEADLINES.
TRM Labs puts the total at approximately 1,816 BTC, about USD 116 million, drained from over 5,200 addresses across four theft waves beginning July 30, 2026. The first wave alone took roughly 594 BTC (~$38 million) in 25 minutes across about 500 wallets.
Media figures range higher - $130 million-plus, 7,300 wallets, and as many as 15 distinct threat actors are widely reported. The spread is expected: totals move with BTC price at time of valuation, with how many waves are counted, and with whether mempool-stage transactions are included. TRM's ~$116M / 1,816 BTC is the tighter forensic figure and is the one used here; the larger numbers are not wrong so much as differently scoped.
Attribution is unresolved. TRM identified no single actor and observed differing transaction construction patterns across waves, consistent with multiple independent parties working the same keyspace - some likely opportunistic copycats who reverse-engineered the vector after the first wave went public.
THE LAUNDERING TELLS A STORY.
Onward movement has been minimal: a single 64.9 BTC Wasabi deposit and 200 ETH into Tornado Cash on August 4, 2026, with most funds sitting at consolidation addresses. That is unsophisticated layering by the standards of state-sponsored groups, which reinforces the multiple-opportunists read rather than a single professional crew.
WHAT THIS BREAKS CONCEPTUALLY.
Hardware wallet security is usually argued as a physical threat model: extraction resistance, secure elements, supply chain integrity, air gaps. This incident bypassed all of it. The failure was a build flag - a software supply chain and release engineering failure that silently degraded the one input every other guarantee depends on.
It also stresses the open-source argument in an uncomfortable direction. The flaw sat undiscovered for over five years. Auditability is necessary but plainly not sufficient; someone has to actually audit the entropy path, and reproducible builds matter more than source availability, because the bug was in how the binary was built rather than in what the source said.
ACTION AND FALSIFIERS.
Anyone who generated a seed on a Coldcard between March 2021 and the patch should treat that seed as compromised and migrate funds to a newly generated one on unaffected hardware. Firmware updates protect future seeds only.
This assessment would need revision if the affected build range turns out narrower than March 2021 onward, or if entropy on a given device is shown to have met 128 bits despite the flagged build.