COLD CARD: an RNG flaw in the firmware linked to the theft of $88 million in Bitcoin

A flaw in the random number generator of the COLDCARD hardware wallet could have allowed the derivation and draining of thousands of wallets—one of the largest documented thefts on "cold" hardware.

Facts

According to BleepingComputer (August 2, 2026), a vulnerability in the firmware of the COLDCARD hardware wallet (Coinkite) is likely responsible for the theft of ~$88.6 million in Bitcoin, drained from thousands of wallets whose seed (BIP39 mnemonic) was generated using a flawed pseudo-random number generator (PRNG). In practice, the seed was not truly random: it belonged to a significantly reduced space, allowing an attacker who knows the flaw to re-derive private keys from nothing more than the public address observed on the blockchain.

The hardware wallet is supposed to be the ultimate line of defense: the private key exists only inside the device, isolated from the internet, and entropy generation relies on the device's hardware. If the initial entropy is biased, everything else collapses—the physical isolation becomes worthless.

Analysis

The critical issue is not “someone hacked a COLDCARD”: it’s entropy generation. A poorly seeded or biased PRNG is invisible in use: the seeds it produces look like valid BIP39 sequences, decrypt normally, and the user literally cannot know their wallet is vulnerable. The disaster only strikes when a third party discovers and exploits the flaw. This turns the flaw into a de facto cryptographic backdoor, even if it stems from an unintentional bug.

For the crypto reader: this case echoes historical precedents on other wallets—the Java SecureRandom bug on Android (Bitcoin, 2013) and several incidents involving DIY air-gap scripts. The pattern is always the same: insufficient entropy at the generator → cold recovery by a third party → no on-chain trace until the final exfiltration.

What to Do Now

• COLDCARD users: immediately check Coinkite’s official advisories and verify whether your firmware/model and seed generation period fall within the affected window.
• If your seed is potentially compromised: do not rely on on-chain inactivity as reassurance. Generate a new seed on a healthy device and move all funds to new addresses.
• In general: when a hardware wallet asks you to accept the seed it generates, ensure the entropy source is dual—most modern devices let you mix your own entropy (dice rolls, extra words) with the device’s hardware generator. This reduces the risk of a biased PRNG to zero.

Key takeaway: in a hardware wallet, the weakest link is almost never the screen, button, or even the display firmware—it’s the entropy source. A serious crypto audit always starts there.