The Coldcard exploit

In plain words

A Seed phrase is only as strong as the randomness behind it. In March 2021 a build mistake routed Coldcard's seed generation to a software fallback generator instead of the hardware one: the code checked whether a setting existed, not whether it was on. The seeds looked ordinary. They were guessable. Five years later someone noticed, and in July 2026 attackers emptied thousands of wallets. Coinkite shipped fixed firmware the next day.

Why it matters

• Keys are only as good as the randomness that made them.
• Open source is necessary, not sufficient: this sat in public code for five years.
• New firmware cannot repair an old seed. Only a new seed, and moved coins, can.

Not to be confused with

• A stolen device — nothing was touched. The seeds were computed from afar.
• A Bitcoin flaw — the protocol did exactly its job. One vendor's build did not.

Go deeper

• Coinkite's advisory — affected versions and migration steps.
• Seed phrase
• Passphrases