{"id":"coldcard-weak-seed-theft-jul-2026","category":"patch","status":"closed","title":"Coldcard weak-seed flaw enables theft of more than 1,830 BTC","tldr":"A Coldcard firmware flaw let thieves recover keys from weak wallet seeds. Every affected model and track now has fixed firmware, but updating cannot protect an old affected seed: create a new seed on fixed firmware and carefully move the funds.","summary":"Attackers began stealing bitcoin on 30 July 2026 by recovering private keys from weak seeds generated by Coldcard hardware wallets. Coinkite says affected firmware covers Mk2, Mk3, Mk4, Mk5 and Q, including standard and Edge tracks. The devices themselves were not remotely taken over. Galaxy estimated losses near US$130 million by 4 August; its 16 October update counted more than 1,830 BTC from over 9,000 addresses. These remain estimates, and recovery or charges are not established by the sources reviewed as of 3 November. Released fixes cover every affected model and track, but cannot strengthen existing seeds. Owners must replace affected seeds and move funds unless Coinkite's precise independent-dice exception applies. Securely generated seeds imported from elsewhere are not weakened merely by import. A strong BIP-39 passphrase adds protection but does not remove the migration requirement. Coinkite's separate detailed technical postmortem remains pending.","action":"Install official firmware for your model and track: Mk2/Mk3 4.2.0, Mk4/Mk5 standard 5.6.3, Q standard 1.5.3Q, Mk4/Mk5 Edge 6.6.1X or Q Edge 6.6.1QX. If your seed was generated on affected firmware, follow Coinkite's migration guide to create and back up a new seed, verify its address on the device, test a small transfer, then move the remaining funds; keep the old backup until everything is confirmed. Never enter seed words into a website or send them to support.","product":"Coldcard Mk2, Mk3, Mk4, Mk5 and Q Bitcoin hardware wallets","audience":"both","severity":"critical","patch":"patched","exploited":true,"cves":[],"tags":["coinkite","coldcard","hardware-wallet","bitcoin","crypto-theft","weak-randomness"],"affected":["Coldcard Mk2/Mk3: seeds generated on firmware 4.0.1 through 4.1.9 inclusive","Coldcard Mk4/Mk5 standard: seeds generated before firmware 5.6.0","Coldcard Q standard: seeds generated before firmware 1.5.0Q","Coldcard Mk4/Mk5 Edge: seeds generated before firmware 6.6.0X","Coldcard Q Edge: seeds generated before firmware 6.6.0QX","Exception: final seeds incorporating at least 50 fair, independent dice rolls through Add Dice Rolls, with the sequence private and unrecorded, are not considered at risk from this flaw alone"],"fixed":["Coldcard Mk2/Mk3 4.2.0 or later","Coldcard Mk4/Mk5 standard 5.6.0 or later","Coldcard Q standard 1.5.0Q or later","Coldcard Mk4/Mk5 Edge 6.6.0X or later","Coldcard Q Edge 6.6.0QX or later"],"matches":[{"platform":"other","app":"Coldcard Mk2/Mk3","bundle":"","fixed":"4.2.0"},{"platform":"other","app":"Coldcard Mk4/Mk5 standard","bundle":"","fixed":"5.6.0"},{"platform":"other","app":"Coldcard Q standard","bundle":"","fixed":"1.5.0Q"},{"platform":"other","app":"Coldcard Mk4/Mk5 Edge","bundle":"","fixed":"6.6.0X"},{"platform":"other","app":"Coldcard Q Edge","bundle":"","fixed":"6.6.0QX"}],"sources":[{"kind":"advisory","title":"Coldcard Security Advisory","url":"https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/","by":"Coinkite","date":"2026-07-30"},{"kind":"advisory","title":"Current COLDCARD Security Status","url":"https://coldcard.com/security/status","by":"Coinkite","date":"2026-10-01"},{"kind":"advisory","title":"Migrate an Affected COLDCARD Seed","url":"https://coldcard.com/security/migrate","by":"Coinkite","date":"2026-08-30"},{"kind":"advisory","title":"COLDCARD All — Firmware Downloads","url":"https://coldcard.com/downloads/all","by":"Coinkite","date":"2026-09-30"},{"kind":"research","title":"Your Keys, Not Your Coins: Coldcard Wallets Hacked for $130m and Counting","url":"https://www.galaxy.com/insights/research/your-keys-not-your-coins-coldcard-wallets-hacked-for-130m-and-counting","by":"Galaxy Research","date":"2026-08-07"},{"kind":"research","title":"The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack","by":"TRM Labs","date":"2026-08-05"},{"kind":"research","title":"Not Your Reseller, Not Your Coins","url":"https://www.galaxy.com/insights/research/ledger-cryptobilis-wallet-implant-theft","by":"Galaxy Research","date":"2026-10-16"},{"kind":"post","title":"Wallet and exchange security watch","url":"https://coldhardsats.com/security-status","by":"Cold Hard Sats","date":"2026-11-02"}],"started":"2026-07-30","closed":"2026-10-16","created":"2026-11-03T20:04:33.136Z","updated":"2026-11-03T20:04:33.136Z","cve_notes":[],"timeline":[{"at":"2026-10-16","added":"2026-11-03T20:02:18.575Z","kind":"other","text":"Galaxy's later tally exceeded 1,830 BTC swept from more than 9,000 addresses, worth about US$150 million at that day's prices. This was a later estimate, rather than confirmation of a final loss total.","url":"https://www.galaxy.com/insights/research/ledger-cryptobilis-wallet-implant-theft","by":"Galaxy Research","patch":null},{"at":"2026-10-01","added":"2026-11-03T20:02:18.575Z","kind":"vendor-revised","text":"Coinkite updated its recommended standard firmware to Mk4/Mk5 5.6.3 and Q 1.5.3Q. Its status page confirmed fixes for every affected track, while a separate detailed technical postmortem remained in preparation.","url":"https://coldcard.com/security/status","by":"Coinkite","patch":null},{"at":"2026-08-30","added":"2026-11-03T20:02:18.575Z","kind":"vendor-revised","text":"Coinkite's migration guide explained how to replace affected seeds, including passphrase wallets, derived child wallets and multisignature arrangements. Copying or restoring the old seed does not resolve the problem.","url":"https://coldcard.com/security/migrate","by":"Coinkite","patch":null},{"at":"2026-08-05","added":"2026-11-03T20:02:18.575Z","kind":"other","text":"TRM Labs reported a different preliminary tally of approximately 1,816 BTC, valued at US$116 million, from more than 5,200 addresses. It had not attributed the thefts to a particular group.","url":"https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack","by":"TRM Labs","patch":null},{"at":"2026-08-04","added":"2026-11-03T20:02:18.575Z","kind":"wider-attacks","text":"Galaxy Research tracked losses near US$130 million by this date. Its report estimated that at least 15 attackers were independently exploiting the flaw.","url":"https://www.galaxy.com/insights/research/your-keys-not-your-coins-coldcard-wallets-hacked-for-130m-and-counting","by":"Galaxy Research","patch":null},{"at":"2026-08-01","added":"2026-11-03T20:02:18.575Z","kind":"vendor-revised","text":"Coinkite clarified that at least 50 fair, independent, private dice rolls added during seed creation protect against this particular flaw. A strong, unique BIP-39 passphrase adds protection but does not repair an affected seed.","url":"https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/","by":"Coinkite","patch":null},{"at":"2026-07-31","added":"2026-11-03T20:02:18.575Z","kind":"new-fix","text":"Coinkite released fixes across all affected tracks: Mk2/Mk3 4.2.0, Mk4/Mk5 standard 5.6.0, Q standard 1.5.0Q, Mk4/Mk5 Edge 6.6.0X and Q Edge 6.6.0QX. These correct new seed generation; existing affected seeds still require replacement.","url":"https://coldcard.com/downloads/all","by":"Coinkite","patch":"patched"},{"at":"2026-07-30","added":"2026-11-03T20:02:18.575Z","kind":"disclosed","text":"Coinkite published a warning about weak seed generation in Coldcard firmware. Attackers regenerated private keys from affected seeds and stole bitcoin without taking over the devices.","url":"https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/","by":"Coinkite","patch":"none"}],"url":"https://hard.fyi/live/coldcard-weak-seed-theft-jul-2026/","json":"https://hard.fyi/api/live?id=coldcard-weak-seed-theft-jul-2026"}