How a bug in Coldcard’s code went unnoticed for years, leading to $100 million in hacked funds

Jonathan Goodman followed the rules for keeping his bitcoin safe.

The hardware wallet holding his keys, a Coldcard, had never been connected to the internet. He kept it stored in a safe deposit box. The seed phrase, which he’d never shared with anyone, was stored in a second safe deposit box. But on July 29, Goodman said, every wallet he had was emptied, every last satoshi stolen. The Toronto entrepreneur reported losing 18.25 bitcoin, worth just over $1.17 million at the time of the attack.

“Perhaps the hardest part about this is that I did everything right,” he wrote in an Aug 1 X post.

Goodman’s loss was part of a much larger hack impacting thousands of Coldcard users. Galaxy Research said it had high confidence that 1,596 bitcoin — worth over $100 million — had been stolen from about 7,300 addresses in a series of attacks. Galaxy research head Alex Thorn estimated on Aug. 4 that at least 15 different attackers were exploiting the flaw. None of them needed physical access to a device.

A hardware wallet’s entire security premise is that its secrets never leave the chip. With no internet connection, there’s no way in beyond physical access to the device. Though the physicality of a hardware wallet carries its own risks for users — as banal as misplacing the device and as frightening as a wrench attack — their major selling point is that they are safe from hackers and other online bogeymen.

But, in the case of Coldcard, this security promise fell short. The vulnerability was not in the wallet itself — it was in how the secret password, or seed phrase, protecting users’ coins was generated.

Bitcoin wallets can come in different forms. Software wallets, also called “hot wallets,” run on an internet-connected device, making them easy to use but exposed if the device is compromised.

Hardware wallets, or “cold wallets,” such as Coldcard keep the keys on a separate device that’s not connected to the internet. One of the earliest forms of cold wallets were so-called “paper wallets,” where users wrote down the keys needed to access their wallets on a piece of paper. Though safe from hackers, these wallets carried an enormous risk of being damaged or lost.

Hardware wallets are somewhere in between a paper wallet and a browser-based hot wallet. They’re harder to hack than software, harder to lose than paper, but they’re not infallible. They can be lost or stolen, and users need to be able to trust the device to create their keys properly in the first place.

“Air-gapped systems help, but they are not a perfect fix,” Bobby Gray, founder of TEXITcoin, told CoinDesk. “Security has to begin with how the keys are generated and continue through every part of the custody process.”

This is, unfortunately, where things went wrong for Coinkite, the maker of the Coldcard wallet.

In March 2016, the Toronto-based bitcoin company told customers it was sunsetting its hosted hot wallet. Running an online financial services company had brought persistent floods of junk internet traffic aimed at knocking their services offline, along with mounting legal costs and regulatory complications.

Instead, Coinkite said it wanted to try something different. It wanted to build decentralized hardware and “software-not-as-a-service.” That was early in crypto’s history, before Bitcoin’s second halving, when one entire bitcoin was trading slightly above the $400 mark.

Coinkite’s pivot first produced Opendime in April 2016. The small USB stick generated and concealed a private key, allowing bitcoin to be passed from one person to another like a physical bearer instrument. Physically breaking the device’s seal revealed the key and allowed the funds to be spent.

Coldcard soon followed. Coinkite announced the device in December 2017 under the headline “The World Needs An Open, Cheap & Ultrasecure Hardware Wallet.” In it, the firm argued that existing hardware wallets were too expensive and dependent on proprietary companion apps.

The original design combined a numeric keypad, screen, secure element and MicroSD slot. Users could move unsigned and signed transaction files between Coldcard and a computer without establishing a live data connection. They didn’t need a Coinkite account or desktop application to use the wallet.

The first units shipped in 2018. The next model, released in April 2019, added more bells and whistles. With every updated version, the Coldcard got more complex and, theoretically, more technologically sophisticated.

Coldcard’s complexity was part of its appeal. It was built for users willing to inspect transaction details, manage backups and construct their own security model.

A host of features including duress PINs, encrypted MicroSD backups, multisignature support and user-supplied dice rolls catered to bitcoin holders who treated custody as an adversarial exercise.

Coldcard’s source code was also public. Users could inspect the firmware, reproduce a build and compare it with Coinkite’s release. That visibility reinforced the central ethos of the Bitcoin ecosystem – “don’t trust, verify.”

Though users were able to inspect Coldcard’s code, they didn’t really look too closely. The seed-generation failure entered Coldcard during a major 2021 software change and went unnoticed for years.

Coinkite described firmware version 4.0.0 as “All New Code, Same Great Features.” The release replaced its code with new equivalents, added reproducible builds and thanked an account named “switck” for the “new source code library.”

Bitcoin developer James O’Beirne identified the “switck” account as belonging to Coinkite co-founder Peter Gray after finding 58 code changes published under that name carrying the same cryptographic signature Gray used on changes published under his own name.

Such signatures function like tamper-resistant digital autographs, showing that the same secret signing key approved both sets of work. Coinkite has not responded to the identity claim.

Switck developed libngu, a collection of reusable code incorporated into the Coldcard firmware installed on customers’ devices. One of its jobs was to help produce the randomness used when creating wallets.

O’Beirne said he questioned that process while auditing Coldcard’s code in May 2025. After tracing the source of the wallet’s randomness to libngu, he raised the possibility of a defect with Coinkite.

The company replied that a genuine problem would probably have been discovered already, according to O’Beirne. “This is the same guy that shrugged off my report of the possibility of the defect in May 2025,” he later wrote of Peter Gray.

Randomness is critical because a new wallet must select a seed from an enormous number of possible values. The unpredictability of that selection is measured in bits of “entropy,” used to refer to a lack of predictability. Every additional bit doubles the number of possibilities, making a seed harder to guess.

Coldcard was supposed to obtain that randomness from a dedicated hardware generator inside the device. Instead, a configuration error sent the wallet to a simpler software generator that used information including device and timing data.

That information isn’t completely random, so it could be narrowed down or reproduced, sharply reducing the number of seeds an attacker needed to test.

Put simply, Coldcard’s code was supposed to pick each wallet’s secret from a pool of possibilities so vast that no computer could ever try them all. Instead, a wiring error sent it to a smaller, weaker source that shrank the pool enough for an attacker to work through it.

The error came down to how two pieces of software communicated to read a setting, according to Block’s Bitcoin engineering and security team.

The setting was meant to turn off one source of random numbers after Coldcard added another. Libngu checked only whether the setting existed, not whether it was on or off. The firmware therefore built normally while using the wrong generator.

Block said affected Mk2 and Mk3 devices received no secure randomness through that process. Mk4, Q and Mk5 devices received some, but the software kept only a small share.

Coinkite estimates that those newer devices produced seeds with 72 bits of randomness instead of the intended 128. That left about 72 quadrillion times fewer possible seeds.

Block traced the vulnerable code to firmware version 4.0.0, released on March 17, 2021. Coinkite identifies version 4.0.1 as the first affected release for Mk2 and Mk3 users.

The source code was publicly available, and the correct hardware generator was present in the finished firmware. Reviewers confirmed that the component existed but failed to follow the seed-generation process from beginning to end and determine which generator the device actually used.

The company said AI-assisted reviews it ran before the theft also missed the error. Tests using several leading AI models after the incident failed to identify it as well.

Coinkite has promised to publish a fuller account of the failure. It has said it is supporting affected customers directly.

The company did not respond to CoinDesk’s request for comment.

Coinkite has released fixed firmware for all affected Coldcard models and release tracks. The update fixes future seed generation but does not strengthen seeds already created with vulnerable software.

Affected users must install the corrected firmware, generate a new seed and move their bitcoin to addresses derived from it, according to Coinkite’s advisory.

Coldcard was built on the idea that Bitcoiners could remove custodians and reduce the number of parties they needed to trust. The incident does not restore confidence in an exchange or bank as counterparty. It shows that self-custody substitutes a different dependency: Users hold the keys, but the wallet manufacturer still determines whether those keys were created safely.

The key to Jonathan Goodman’s million-dollar stash of bitcoin sat in a safe deposit box, inside a device that never went online. But, due to the flaw in Coldcard’s seed generation software, Goodman’s effort to physically protect his fortune made no difference.