The Coldcard seed vulnerability and what the advisory says

Q: What did the dice rolls actually do?

Coldcard devices allow a user to add their own randomness by entering dice rolls during setup. Coinkite's advisory states that a seed created with at least 50 independent, private dice rolls carried at least 128 bits of entropy and was not affected by the flaw, because that randomness came from outside the faulty code path. The advisory states that funds were at risk only where a seed had neither 50 or more dice rolls nor a strong, unique BIP-39 passphrase.

On 30 July 2026, bitcoin began draining out of Coldcard wallets. The first wave lasted about 41 minutes; over the following days the total climbed, wave after wave, past 116 million dollars as of publication and was still rising. Coinkite, which makes the Coldcard hardware wallet, has published an advisory explaining why. A build error meant some devices drew recovery phrases from a far smaller pool of possibilities than intended, and the error had been shipping in firmware since March 2021. What follows is what the advisory says, which devices and versions it names, and the detail most coverage buried.

Short Answer

A build error sent recovery-phrase generation through a software random number generator instead of the hardware one, so phrases created on affected firmware were far easier to guess than intended. Coinkite has released fixed firmware. Its advisory is explicit that installing the update does not repair a phrase that already exists. That single point separates the people who have dealt with this from the people who believe they have. This article reports what the advisory says. It is not a recommendation about what any individual should do.

Five dice, one orange, beside a card showing twelve blank word lines — Fifty dice rolls entered at setup supplied randomness from outside the faulty code. Coinkite states those phrases were not affected.

What actually broke

Not a break-in

Nobody picked the lock. The locks were built with too few combinations

No attacker got inside a device, and no one needed physical access. The devices produced phrases that could be guessed, and eventually someone guessed them at scale.

A Coldcard is meant to draw your recovery phrase from a hardware random number generator, a dedicated component whose only job is to produce numbers nothing can predict. Coinkite’s advisory describes a build error that quietly routed that job elsewhere, to a software fallback in the device’s programming language. The phrase still looked normal. Twelve or twenty-four ordinary words, no warning, nothing a user could see.

What changed was the size of the pool it was drawn from. A recovery phrase is supposed to carry 128 bits of randomness, which is a number about thirty-nine digits long. Coinkite’s advisory states that Mk4, Mk5, and Q devices produced around 72 bits, because their secure elements were contributing randomness of their own. Mk2 and Mk3, without that component, dropped much lower; analysts reviewing the flaw put them near 40 bits, a number about thirteen digits long. All three numbers are unimaginable to a person. Only one of them is unimaginable to a machine.

The error entered shipping firmware in March 2021 and sat there for five years.

Which devices and versions the advisory names

Coinkite first published a warning covering Mk3 and expanded it on 1 August 2026 to the other product lines. The version list is the part most likely to change, so the advisory itself is the reference worth checking rather than any summary of it.

Device line	Versions the advisory names	Randomness in the phrase
Mk2 and Mk3	4.0.1 through 4.1.9	about 40 bits (per reporting)
Mk4 and Mk5	before 5.6.0 (Edge before 6.6.0X)	about 72 bits (advisory)
Q	before 1.5.0Q (Edge before 6.6.0QX)	about 72 bits (advisory)

The 72-bit figure for Mk4, Mk5, and Q is stated in Coinkite’s advisory. The advisory does not put a bit figure on Mk2 and Mk3; the roughly 40-bit number comes from analysts reviewing the flaw, not from Coinkite. Coinkite released corrected firmware on 31 July, roughly a day after the first wave of thefts. The fixed builds are Mk2 and Mk3 version 4.2.0 or later, Mk4 and Mk5 version 5.6.0 or later, and Q version 1.5.0Q or later, with the corresponding Edge builds 6.6.0X and 6.6.0QX. Coinkite states that TAPSIGNER, OPENDIME, and SATSCARD are not affected, because they run different codebases. Public reporting on which device lines were actually drained has concentrated on Mk3, though the advisory’s scope is wider. We are not in a position to say what the attacker targeted, and neither is anyone else who has published so far.

The part most coverage buried

The detail that matters

An update fixes the next phrase, not the one you already have

Coinkite’s advisory puts it plainly. Updating the firmware does not change or repair an existing seed. A phrase drawn from the smaller pool stays drawn from the smaller pool.

A recovery phrase is not a setting the device keeps adjusting. It is a number drawn once, at the moment the wallet was created, and then written down and lived with for years. Correcting the machinery that drew it does not reach back and draw it again.

This is why a great many people have installed the update, seen a confirmation, and reasonably concluded the matter is closed. Coinkite’s advisory says otherwise. The advisory’s stated remediation is to generate a fresh phrase on corrected firmware and move funds across, with a test transaction first. That is the manufacturer’s stated position, and anyone acting on it is better off reading it from the manufacturer than from us.

What the advisory says protected people

Coinkite states that funds were at risk only where a phrase had neither of two things. The first is at least 50 independent, private dice rolls entered during setup, which the advisory says produced a phrase carrying at least 128 bits of entropy and left it untouched by the flaw. The second is a strong, unique BIP-39 passphrase, the extra word or sentence that turns one recovery phrase into a different wallet entirely.

Either one was enough. Both work for the same reason, which is that they inject randomness from outside the faulty code path, so a broken generator never gets to decide the outcome on its own.

Worth noticing

The dice option has been mocked for years. On this occasion it was the difference

Rolling dice fifty times to set up a wallet has long been treated as security theatre for obsessives, and as evidence that self-custody asks too much of ordinary people. That second criticism has not gone away, and it deserves a real answer. But on the narrow question of who kept their bitcoin through 30 July, the people who took the extra step are the people whose phrases were never guessable.

The choices in front of people who hold one

Four courses are being weighed publicly. We are setting them out rather than ranking them, because the right answer depends on holdings, jurisdiction, technical confidence, and appetite for risk, none of which we know. The order they appear in is descriptive, not a recommendation.

Course	What it involves	What it costs or risks
Do nothing	Accept the exposure and keep the existing phrase	The exposure does not expire. An affected phrase stays guessable for as long as it holds funds
Follow the manufacturer’s remediation	New phrase on corrected firmware, funds moved across	Possible taxable event in many places, on-chain fees, and the real risk of error during any transfer
Change vendor or add signers	Move to a different device, or a multi-signature arrangement spreading keys across makers	Cost, a steeper learning curve, and the same transfer risk
Get qualified help	Take it to a security or tax professional who knows your situation	Cost, and the need to find someone competent in this particular area

One warning applies to every course that involves moving funds, and it is the reason we publish no walkthrough. Transfers are when people lose bitcoin. Mistyped addresses, skipped test transactions, and most of all the wave of fake recovery assistance that follows every incident of this kind. Anyone offering to help you move funds after reading about this is a stranger with an interest in where your bitcoin goes.

What is not established

Reporting has suggested that AI-assisted code review found the flaw, and Coinkite’s founder has been quoted saying such review now surfaces latent bugs faster than experienced human reviewers can. That is a claim about the technique, not evidence about this attacker. No public record shows what was actually used. It is suspected, it is plausible, and it is not established.

A harder point belongs next to it. Coldcard’s firmware is open-source, and the argument for open-source security is that flaws get caught because anyone can look. In this instance a critical flaw shipped in March 2021 and went uncaught for five years. The argument still holds in general. This incident is a serious challenge to it.

A device can be open-source, independently reviewed, and still carry a flaw that waits five years. That is not an argument against holding your own keys. It is an argument against treating any single thing as beyond checking.

All Roads Lead to Bitcoin

The wider question

Whether custody belongs with you or with a company is the older argument underneath all of this, and it has evidence on both sides. We make the case for holding your own keys in why self-custody matters to the Bitcoin vision.

Is your bitcoin yours on an exchange?

Prefer to watch?

This report is also a short video. It walks through the same evidence in a few minutes: what actually went wrong with the Coldcard seeds, why installing the fixed firmware does not repair a phrase that already exists, and what protected the people whose funds survived.

Common questions

Which Coldcard models and firmware versions does the advisory name?

Coinkite’s advisory names Mk2 and Mk3 running versions 4.0.1 through 4.1.9, Mk4 and Mk5 before version 5.6.0 (Edge builds before 6.6.0X), and Q before version 1.5.0Q (Edge builds before 6.6.0QX). The advisory initially covered Mk3 and was expanded to the other lines on 1 August 2026. Anyone checking their own device is better served by the advisory itself than by any summary of it, because the version list is the detail most likely to be updated.

Does updating the firmware fix the problem?

Not for a recovery phrase that already exists. Coinkite’s advisory states that updating the firmware does not change or repair an existing seed. The fix corrects how new phrases are generated from that point on. A phrase created on an affected version was drawn from a smaller pool of possibilities at the moment it was created, and no later update reaches back and redraws it. This is the detail most early coverage left out.

What did the dice rolls actually do?

Coldcard devices let a user add their own randomness by entering dice rolls during setup. Coinkite’s advisory states that a phrase created with at least 50 independent, private dice rolls carried at least 128 bits of entropy and was not affected by the flaw, because that randomness came from outside the faulty code path. The advisory states that funds were at risk only where a phrase had neither 50 or more dice rolls nor a strong, unique BIP-39 passphrase.

How much bitcoin was taken?

The theft came in waves. The first wave, on 30 July 2026, moved several hundred bitcoin in a matter of minutes, worth tens of millions of dollars. As later waves were tracked over the following days, reporting put the running total past 116 million dollars, drawn from more than five thousand addresses. The figure was still climbing as this was written, so treat any total as a snapshot as of publication rather than a settled number.

Was artificial intelligence used to find the flaw?

It is suspected and it is not established. Industry figures have suggested AI-assisted code review is now finding latent bugs faster than experienced human reviewers, and Coinkite’s own founder has been quoted to that effect. No public evidence shows what the attacker actually used. Anyone stating flatly that AI found the bug is going beyond what the record supports.

Every figure here is a snapshot, as of publication in the first week of August 2026. Totals changed while this was being written and may have moved again since. The version list and the remediation come from Coinkite directly, and that is where anyone checking their own device will get the current answer rather than a summary of one.