The Coldcard exploit drained 594 BTC from about 500 wallets early on Thursday, and the running total has since climbed past 1,000 BTC. Almost every prominent voice now calling self-custody a failed experiment sells a substitute for it. What broke was one input inside the device, and the safeguards that held were themselves self-custody techniques.
| What you need to know |
|---|
| 1594.5 BTC left roughly 500 single-signature wallets between 01:31 and 01:56 UTC on Thursday 30 July, inside a three-block window. |
| 2Bitcoin Magazine put the running tally at 1,082.65 BTC by Friday, worth about 68 million dollars at 63,010 dollars per coin (CoinGecko, 20:40 CET, 31 July). |
| 3Mk3 seeds carried roughly 40 bits of entropy against the 128 intended. Mk4, Q and Mk5 carried about 72. |
| 4Coinkite's first advisory cleared Mk4, Q and Mk5. Thirteen hours later it told those owners to update and migrate as well. |
The chain says Thursday
Start with the timestamp, because a lot of coverage has it wrong. CoinDesk’s account of the 25-minute sweep places it on Friday. The blocks disagree. The four blocks that carried the transactions, heights 960188 through 960191 on mempool.space, were mined between 01:36:08 and 01:51:26 UTC on Thursday 30 July. Block 960330 did not arrive until 00:58 UTC on Friday, about 140 blocks later.
The distinction matters to anyone auditing their own addresses, because they are looking for movement on a specific morning and a day’s error sends them to the wrong window. Bitcoin Magazine’s reporting, which separates a Thursday theft of 594.5 BTC from a Friday total near 1,082 BTC, matches what the chain shows.
Inside those 25 minutes an attacker moved 1,324 unspent outputs across 500 transactions, all from single-signature wallets, and parked 562 BTC in one address that has not moved since. Many of the drained addresses had been dormant since 2021, which is when the flawed firmware started shipping. Our Dutch desk covered the mechanics of the theft and the Dutch supervisory picture earlier on Friday.
Coinkite’s advisory grew overnight
The most useful thing to know tonight is that the scope changed while people slept. At 22:50 UTC on Thursday, Coinkite told its followers that “Mk4, Q and Mk5 are not affected based on our early analysis.” That sentence is the reason several reports still describe the newer devices as clear. By 11:37 UTC on Friday the company had revised it, and the current advisory covers the whole product line.
Which firmware, and what counts as safe
Per Coinkite’s own security advisory, seeds are affected on Mk3 firmware 4.0.1 through 4.1.9, on Mk4 and Mk5 below 5.6.0, and on Q below 1.5.0Q. The fixes are 4.2.0 for the Mk3, 5.6.0 for Mk4 and Mk5, 1.5.0Q for the Q, plus 6.6.0X and 6.6.0QX for the Edge builds. One line in the advisory does the heavy lifting: “Updating the firmware does not change or repair an existing seed.”
A seed survives this if it was generated with at least 50 fair, independent and private dice rolls, or sits behind a BIP-39 passphrase. Everything else generated on affected firmware needs replacing and the funds need moving, which is slow, manual work for anyone holding coins across several addresses.
The AI review that found nothing
The story circulating about this Coldcard exploit is that AI code review found a five-year-old bug faster than human experts could. Coinkite’s technical backgrounder on the entropy failure tells a less flattering version. The company had run a frontier model over the same code weeks before the sweep.
Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.
Coinkite, entropy technical backgrounder
Its own review, the company writes, used “one of the best available AI models to review our code for security issues, and it did not find this bug or anything serious.” The lesson runs the other way from the headline: the same class of tool produced nothing for the defender and, apparently, a working attack for whoever pointed it at public firmware. Anthropic reported a comparable asymmetry this week when its own model breached three companies in a controlled security test.
The underlying mistake was small and very old. During a 2021 migration to Bitcoin Core’s libsecp256k1 library, a build flag named MICROPY_HW_ENABLE_RNG was set to zero on the assumption that this switched off both random number generators. The preprocessor guard tested whether the macro existed rather than what it was set to, so the hardware generator quietly dropped out and MicroPython’s software fallback took over seed generation. The company now estimates the result at roughly 40 bits of effective entropy on the Mk3, against the 128 bits a twelve-word recovery phrase is supposed to carry, and about 72 bits on the Mk4, Q and Mk5, where material from the secure elements was mixed in. A 40-bit search space is small enough to grind through on rented hardware, which is why the coins left in a single sitting. Audits confirmed the correct code was in the binary. As Coinkite puts it, they “did not verify end-to-end symbol resolution and call reachability from wallet seed generation.”
Who is telling you self-custody is over
Within hours the incident stopped being a firmware story and became an argument about whether ordinary holders should keep their own keys at all. It is worth reading that argument with the speakers’ business models in view.
The sharpest push came from Lorenzo Valente, director of digital asset research at ARK Invest, who told CoinDesk that “consumers have traded counterparty risk for software risk, hardware risk, supply-chain risk, phishing risk, backup risk” and concluded that “you are better off today holding funds across several publicly-traded exchanges or ETFs.” ARK co-sponsors the ARK 21Shares Bitcoin ETF, one of the largest spot bitcoin funds in the United States. The recommendation and the product are the same thing.
Nick Neuman, chief executive of the paid multisig service Casa, dismissed the dice-roll mitigation with “You just can’t ask people to roll dice to be secure.” Kevin Loaec, chief executive of Wizardsardine, which builds the rival Liana wallet, warned that “every single mnemonic generated [via a Coldcard] since 2021 will be public in the next few days.” Trezor, a direct hardware competitor, told its customers their funds were safe while noting that a weak Coldcard seed stays weak after being restored onto any other brand’s device. Each of those points is technically fair. Each also comes from a firm selling the remedy.
The line that carried furthest came from someone with nothing to sell. Bitcoin commentator Guy Swann called it “the worst hit in bitcoin history to the most knowledgeable and ‘properly secured’ bitcoiners,” and that is the part worth sitting with. These were people who read the documentation, bought the recommended device and kept their keys offline. CoinDesk’s roundup of the reaction collects the rest.
What the Coldcard exploit actually broke
Strip the incident down and one component broke: the randomness the device produced at the moment a seed was created. Air-gapping was irrelevant, because the device never needed to be online for the attack to work. The seed was guessable from birth.
What held up is the more interesting list. Seeds built with dice rolls survived, as did anything sitting behind a BIP-39 passphrase, and multisig was never touched because every drained wallet was single-signature. Those are all self-custody practices, which makes the leap from this bug to a regulated fund a larger jump than it first appears. Neuman’s objection still lands, though: a defence that only works when the user performs 50 manual dice rolls is not a defence most people will ever use.
For European readers there is no compensation route here. MiCA governs crypto service providers that hold or trade assets for clients, and a hardware wallet maker sits outside that perimeter, so nobody is obliged to make these holders whole. Markets, meanwhile, treated the whole thing as a footnote. Bitcoin traded at 63,010 dollars on Friday evening, down 2.65 percent over 24 hours (CoinGecko, 20:40 CET), a move well inside the range that has framed recent options positioning around the 60,000 dollar level.
The durable change is smaller than the eulogies suggest and harder to dismiss. A hardware wallet’s randomness used to be the one part nobody checked, because checking it was impossible from the outside. After this week, the entropy behind a seed becomes something a serious holder verifies, through dice, through a passphrase, or through spreading a key across devices from more than one manufacturer.
