Inside the Coldcard Seed Generation Flaw: A Bitcoin Heist That Even a Locked Safe Couldn't Stop

The whole point of a Coldcard is that your private key never has to touch the internet. Canadian entrepreneur Jonathan Goodman followed that rule to the letter: the Coldcard holding his private key never went online and was locked in a bank safe; his seed phrase was kept separately in a second safe, never shown to anyone. But on July 29, his wallet was still drained completely, costing him 18.25 bitcoin—worth over $1.17 million at the time. "Perhaps the hardest part is that I did everything right," he wrote on X on August 1.

Goodman wasn't alone. Research firm Galaxy Research says it has high confidence that roughly 1,596 bitcoin, worth over $100 million, were stolen from about 7,300 addresses in a series of attacks. Alex Thorn, the firm's head of research, estimated on August 4 that at least 15 different attacker groups exploited the same vulnerability—and none of them needed to physically touch the device.

The problem isn't the hardware—it's how the seed was generated in the first place

Block's investigation found that the crux of the issue wasn't that the Coldcard device itself was compromised, but that the seed phrase protecting the funds was flawed from the moment it was generated. The entropy of a bitcoin wallet determines how hard its seed is to guess—each additional bit doubles the number of possible combinations. Coldcard was supposed to draw entropy from the device's built-in hardware random number generator, but due to a configuration error, it instead fell back on a simpler software generator. That software relied on device information and timestamps, making it not truly random—and therefore possible to narrow down or even reproduce.

The impact wasn't uniform across devices. Mk2 and Mk3 devices got no secure entropy at all from this process; Mk4, Q, and Mk5 did receive some, but the software only retained a small fraction of it. Coinkite estimates that these newer devices actually produced just 72 bits of entropy—far short of the intended 128-bit target—shrinking the pool of possible seeds to less than 1 in 2^56 of what it should have been.

A bug hidden for four years, traced back to firmware 4.0.0

The flaw entered Coldcard on March 17, 2021, with firmware 4.0.0. Coinkite's release notes at the time read "All New Code, Same Great Features," and credited an account called "switck" for contributing a new source code library. Bitcoin developer James O'Beirne, during an audit, compared 58 code changes published under the "switck" account and found they carried the same cryptographic signature that Coinkite co-founder Peter Gray used when publishing under his real name—effectively identifying switck as Gray himself. The libngu library switck developed was integrated into the Coldcard firmware running on users' devices, and one of its jobs was helping generate the entropy needed to create a wallet.

O'Beirne says he raised questions about this process during his audit back in May, flagging a possible flaw to Coinkite—and was told that "if there really were a problem, it probably would have been found by now." Coinkite later stated that its own AI-assisted code review also failed to catch the bug before the incident; after the vulnerability came to light, testing with several leading AI models likewise failed to detect the issue.

Coinkite has released fixed firmware for all affected models and release tracks, but the fix only applies to seeds generated "going forward"—it can't retroactively repair old seeds that were already generated with the flawed software. Affected users must install the patched firmware, generate a brand-new seed, and move their bitcoin to new addresses. For users like Goodman, who locked his private key and seed phrase in separate safes, that approach guarded against physical theft—but it couldn't protect against a seed that was already insufficiently random the moment it was born.