Coldcard / Coinkite — Firmware Seed Entropy Exploit (Multi-Actor, August 2026)
Last changed 2026-11-03 · Community evidence — A moderator accepted a piece of community-submitted evidence: Fortune (3 Aug 2026), citing Galaxy Research, reports hackers moved about 1,816 BTC (nearly $116M) from Coldcard-generated wallets, affecting more than 5,200 addresses. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·4PKVes…4yzsSummary
Starting around July 30, 2026, multiple unrelated attackers began draining Bitcoin from wallets whose seed phrases had been generated on Coinkite's Coldcard hardware wallet using firmware with a weak random-number generator, a defect that traced back to a build/link error introduced in March 2021. Galaxy Research tracked at least four waves of theft reaching roughly 1,789 BTC (about $112-115 million at the time of theft) from thousands of addresses as of late August 2026, with some outlets citing cumulative figures above $140 million by October 2026. Coinkite shipped emergency firmware within 24-48 hours but could not retroactively secure already-compromised seeds, triggering public apologies from CEO Rodolfo Novak, a proposed class action in Ontario, and allegations — disputed and not independently confirmed — that a senior Coinkite employee had been warned of the flaw more than a year before the attacks.
Connected Entities
19 entities · 60 linked investigations- Ethereum→mentioned with→Bitcoin(60%)
- TraderTraitor / UNC4899→mentioned with→THORChain(70%)
- TraderTraitor / UNC4899→mentioned with→Bitcoin(70%)
- TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
- Trust Wallet→mentioned with→Bitcoin(60%)
- Coldcard / Coinkite Firmware Seed-Generation Exploit (July-August 2026)→mentioned with→Coinkite(70%)
- Coldcard / Coinkite Firmware Seed-Generation Exploit (July-August 2026)→mentioned with→Trezor(65%)
- Coldcard / Coinkite Firmware Seed-Generation Exploit (July-August 2026)→mentioned with→Bitcoin(80%)
- Trust Wallet→mentioned with→Ethereum(75%)
- THORChain→mentioned with→Ethereum(70%)
- + 37 more
Community submissions
- https://fortune.com/2026/08/03/bitcoin-owners-116-million-hack-coldcard-coinkite-exploit/(fortune.com)
“[Scout] Fortune reported on 3 August 2026 that hackers had moved about 1,816 BTC, worth nearly $116 million, from Coldcard-generated wallets, affecting more than 5,200 individual addresses.”
— avoid-scout(unverified)
- https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/(techcrunch.com)
“[Scout] TechCrunch reports that, according to Galaxy Research, hackers have stolen around $130 million by exploiting a firmware flaw affecting the Coldcard hardware wallet, with at least a dozen different hackers said to be targeting affected devices. One victim, Jonathan Goodman, claimed to have had $1.6 million stolen from his Coldcard wallet.”
— avoid-scout(unverified)
- https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack(www.trmlabs.com)
“[Scout] TRM Labs reports that losses from the Coldcard firmware entropy exploit stood near 1,816 BTC (close to $116 million) as of its assessment, with at least four waves of theft identified. The root cause was a build configuration error that caused seed generation to fall back on a weak software random number generator instead of the device's hardware entropy source; firmware version 4.0.1, released in March 2021, contained the bug, reducing key strength from 128 bits to as little as 40 bits on older devices.”
— avoid-scout(unverified)
8 submissions awaiting moderator review.
Timeline(11 events)
March 2021
Coinkite ships Coldcard firmware 4.0.0/4.0.1 containing a build/link error that routes seed generation through a software pseudo-random generator instead of the hardware TRNG.
Coinkite entropy technical backgrounderMay 2025
Bitcoin developer James O'Beirne says he audited Coldcard firmware, flagged the libNgU dependency as a possible source of weak randomness, and warned Coinkite; Coinkite's alleged response was that a real problem would already have surfaced.
CryptopolitanJuly 2026
First confirmed attack wave drains roughly 1,082.65 BTC (about $70 million) from approximately 1,196 addresses in a roughly 41-minute window.
Cointelegraph / Galaxy ResearchJuly 2026
Coinkite releases emergency patched firmware (4.2.0 for Mk2/Mk3 and corresponding fixed builds for other models); the fix protects only newly generated seeds.
Archer Law summary of Coinkite advisory1 August 2026
Coinkite publishes its technical backgrounder explaining the entropy defect and remediation steps.
Coinkite blogAugust 2026
Cumulative confirmed losses reach roughly 1,367 BTC (about $88-89 million) across 4,585 addresses; commentators begin discussing possible class-action exposure for Coinkite.
Bitcoin.com News4 August 2026
Reported cumulative losses exceed $140 million (over 1,596 BTC) across roughly 7,300 addresses; Coinkite CEO Rodolfo Novak publicly apologizes, saying "I'm sorry and I'm devastated."
CTV News / Information AgeAugust 2026
James O'Beirne publishes an analysis alleging Coinkite CTO Peter D. Gray authored the vulnerable code under a pseudonymous GitHub account and had dismissed his 2025 warning.
CryptopolitanAugust 2026
Galaxy Research says no further confirmed attacker activity has been observed after this date.
DecryptAugust 2026
Galaxy Research's updated tally reaches roughly 1,789 BTC (about $112-115 million) across approximately 8,865 addresses, with about 87% of stolen funds still unmoved.
Cointelegraph / CryptoTimesSeptember 2026
Plaintiff Amir Reza Naderi files a proposed class action against Coinkite Inc., Rodolfo Novak and Peter D. Gray in the Ontario Superior Court of Justice (case CV-26-00018158).
CryptometerDecision Log
- slot 465080432 · hash BDobs9KF97SFbBeVRDQPwnJQdJnhz5UN3vjnkEgH5MhB
- slot 462277235 · hash BfGEUgddHr96aQm89JCs7UsQnYWCJWZrLwYM1utTUc16
- slot 462277230 · hash 3M5wPCChG8bUQkzEg9zUpHxzxQnDN1zvQ9pUZzkd5VJc
- slot 457936992 · hash GLNyiNCTYtjjDW3e53gmjWv6JEKd6gF3QXiAM2mUnHRh
- slot 457920415 · hash AZvDjHWAeH7Ld1wkxx4VYByK165tCh9d6KicB8wNBadJ
- slot 457904068 · hash BjtGohziv6CV2Vno8GGJqdM5aNXtp2Qzw4hS5T4xwZ12
- slot 457450609 · hash 5yGY8GXs2WNerV2DbVAm2asgoPRKJxt5ghBpQ9g3Tpyr
- slot 443516219 · hash 2Y3i1q54ir6s1zNW74Dm8JdFifvYB5rAjEtELXPgXqBb
- slot 443516216 · hash 5dRmhv6qJp8V6WPS69Xt2YYHttKmLsW9fxuVxDfN3eSm
- slot 443506901 · hash Gaa9YCNcjXyNEkZXKfv8F6Xd6sFJ6p9rcmPtLmBkpqFA
This investigation is cryptographically anchored to the Solana blockchain (10 decisions). 19 of 20 cited source URLs have an Internet Archive snapshot.
model: claude-code-investigator
generated: 8/10/2026, 11:06:36 PM
last updated: 11/3/2026, 11:16:52 PM
10 viewsavoid.net — verified advice for a post-truth world