Five days after Coinkite’s first Mk3 security advisory, the Coldcard entropy exploit has grown from a suspicious $38 million sweep into what researchers now call the largest self-custody breach on record.
Galaxy Research revealed Saturday it had identified a third wave of thefts, bringing its tracked total to roughly 1,367 BTC across 4,585 addresses. The firm said it has flagged around 600 suspected attacker addresses to federal investigators and compliance firms.
Galaxy’s head of research, Alex Thorn, posted on X that the situation was still unfolding:
“THE ATTACK IS ONGOING — move your funds off Coldcard-generated addresses immediately if you have not done so.”
According to Thorn, “it’s absolutely true that every single-sig Coldcard address generated after firmware upgrade in march 2021 will eventually be drained,” which now is “only a matter of time.”
Thorn added that coins had sat untouched for an average of over three years before being swept, meaning that victims were overwhelmingly long-term holders who “were saving their money the way bitcoiners have taught them to do for years.”
An independent tracker built by pseudonymous researcher Kevin Kelbie puts the figure at 1,431.97 BTC, or just below $90 million at current prices) across 5,415 addresses and nine separate sweep waves between July 30 and August 2, reconstructed transaction-by-transaction from public chain data. The tracker flags its own limits, describing itself as “AI-compiled” and “not independently fact-checked,” though its wave totals line up closely with figures Block and Galaxy Research have separately published.
The Bug in Plain Terms
The underlying flaw traces back to firmware changes Coinkite made in 2021 while removing GPL-licensed code from its stack. An analysis published by developer Dustin Dettmer (“Dusty Daemon”) on bitcoin++’s Insider Edition walks through the actual commit history.
A seed phrase—the string of words that acts as the master key to a Bitcoin wallet—is supposed to be generated using a hardware random number generator (RNG), a chip designed to produce genuinely unpredictable numbers. Dettmer’s research shows that Coldcard developers, while trying to fix an unrelated code conflict, disabled that hardware RNG with a single configuration flag and left an inline comment reading:
“We have our own version of this code.”
The fix, however, didn’t work as intended. The override applied to a function the wallet’s seed-generation code never actually called. Instead, seed creation silently fell through to MicroPython’s built-in software fallback generator—a much weaker source of randomness originally meant only for devices with no hardware RNG at all. The commit that introduced this was just one word long: “runs.”
Dettmer went on to stress that developers touching code this critical need a far higher bar for review, and “you must understand the code you are shipping.”
💥Coinkite has warned users of its #Coldcard Mk3 signing device to move their funds after identifying a potential flaw in how certain firmware versions generated wallet seed phrases.https://t.co/ng7xP0EfcR
— BitcoinEventsHQ (@BitcoinEventsHQ) July 31, 2026
Coinkite’s own technical backgrounder, published July 31, estimates the resulting entropy—the effective randomness of a generated seed—at roughly 40 bits on Mk2 and Mk3 devices and 72 bits on Mk4, Q and Mk5, both far short of the 128-bit minimum a 12-word BIP-39 seed is supposed to guarantee. A 40-bit search space is small enough for ordinary hardware to work through in hours or days whereas 128 bits would take longer than the age of the universe to brute-force.
Notably, Coinkite also claimed that a recent AI-assisted code review of its own firmware had failed to catch the bug.
Passphrases Are Being Cracked Too
Until this weekend, Coinkite’s guidance held that a Coldcard seed protected with a BIP-39 passphrase—an optional extra word added on top of a seed to create a separate hidden wallet—faced only “minimal risk,” even if the underlying seed itself was compromised.
That assumption is now in question. Bitcoin educator BTCsessions reported what he described as the first confirmed loss involving a Mk3 protected by a two-word passphrase, drained at 2pm Australia time on Sunday, August 2. The passphrase reportedly was two ordinary words, “nothing super complex.”
IMPORTANT UPDATE: We just had our first confirmed loss of a Mk3 + 2 Word Passphrase.
Drained at 2pm Aug 2nd Australia Time – Roughly 17hrs ago.
— BTC Sessions 😎 (@BTCsessions) August 2, 2026
The implication, if the report holds up under further scrutiny, is that attackers have moved beyond scanning for bare low-entropy seeds and are now also brute-forcing weak or short passphrases layered on top of them. That aligns with an earlier warning from Ledger CTO Charles Guillemet, who argued that while the larger 72-bit entropy space on newer Coldcards wasn’t worth attacking at scale, there was “large room for optimization” for a motivated attacker.
At the time of this writing, Coinkite has not yet issued formal guidance addressing passphrase brute-forcing specifically. The firm’s latest security update published Sunday stresses, among other things, that its “patched firmware prevents this issue from affecting any new seed generated going forward.”
“It does not repair or restore security to a seed that was already generated on vulnerable firmware,” said the manufacturer. “A new seed must be created, and funds moved to it to be secure.”
Coinkite’s engineering failure here is compounded by a communications failure. The company’s founder Rodolfo ‘NVK’ Novak initially dismissed early user reports as “FUD” before reversing course within hours once independent researchers demonstrated the RNG flaw directly—a sequence of events that, regardless of intent, cost affected users time they didn’t have to move funds. A five-year-old bug in code responsible for generating the single most sensitive piece of data a hardware wallet produces should not have shipped on a five-character commit message, and it should not have taken public pressure from outside researchers to get a full technical accounting.
Safeguarding your funds
If you generated a seed on a Coldcard Mk3, Mk4, Q or Mk5 without at least 50 private, independently rolled dice as your entropy source, treat that wallet as compromised—passphrase or not—and migrate funds to a freshly generated seed on updated firmware. Do not restore an old seed onto a new or patched device; the weakness lives in how the seed was originally created, not in the device you’re using now. Do not skip the test-transaction step before moving a full balance.
This guide from AnchorWatch’s Rob Hamilton could be helpful: https://x.com/Rob1Ham/status/2083936334511538368
Additionally, one practical mitigation has emerged for a specific subset of affected users: those migrating funds out of a multisig setup where a Coldcard is one of several signing devices.
Slipstream, a transaction-broadcast service MARA first launched in February 2024, lets users submit a transaction directly to the company’s own mining pool rather than relying on the standard peer-to-peer network to relay it. It was originally built to solve a different problem: Bitcoin nodes frequently decline to relay large or non-standard transactions even when those transactions fully comply with network consensus rules, leaving complex multisig or batched transactions stuck. Slipstream lets such transactions reach a miner directly instead of getting stranded.
In context of the Coldcard situation that matters because a multisig wallet with a compromised Coldcard as one signer is vulnerable to what’s known as an RBF hijack. Replace-By-Fee (RBF) is a standard Bitcoin feature that lets an unconfirmed transaction be replaced with a new version paying a higher fee. If an attacker holds the same compromised key material, they could theoretically spot a victim’s migration transaction sitting in the public mempool and race it with their own higher-fee replacement, redirecting the funds before the legitimate transaction confirms. Broadcasting through Slipstream instead of the open mempool closes that window.
🚨@MARA Slipstream is now available as a permissionless public good with no client code requirement.
Please be careful and conservative with fees to avoid transactions getting stuck in the Slipstream mempool in the event that competitive rates spike.
For the foreseeable…
— MARA Foundation (@MARAFoundation_) August 3, 2026
MARA said Slipstream is now available to anyone, without requiring users to run any special client software:
“Slipstream is now available as a permissionless public good with no client code requirement.”
The foundation added that it is not currently charging extra fees for the service, though users still pay standard Bitcoin network fees, and it cautioned users to set conservative fee rates to avoid transactions stalling in Slipstream’s own queue if network fees spike. For anyone migrating a multisig wallet that hasn’t been spent from routing that transaction through Slipstream is a relatively simple extra safeguard.