A software flaw in Coldcard hardware wallets may have exposed users to theft of more than $38 million in Bitcoin, highlighting how a single coding mistake can silently undermine an otherwise secure system. The wallet maker Coinkite discovered the bug on July 30, more than five years after it was accidentally introduced during a software update in 2021. The flaw affected wallets created on Coldcard Mk3 devices running firmware versions 4.0.1 through 4.1.9, as well as certain firmware versions on Mk4, Mk5, and Q models.

What Went Wrong Inside Coldcard's Code?

The problem was deceptively simple yet catastrophic: the wallet used the wrong source of randomness when generating recovery phrases, also called seed phrases. These phrases are the master keys to a Bitcoin wallet; anyone who obtains one can access all the funds inside. Randomness is what makes each phrase unique and impossible to guess. When the wallet creation process used weak randomness instead of strong randomness, it made the seed phrases predictable.

What made the bug particularly dangerous was that it remained hidden in plain sight. The correct security code was still present in the software, making it appear as though everything was working properly. In reality, the wallet creation process was using different code entirely. This meant security audits and code reviews could miss the flaw because they were looking at the right code, not the code that was actually running.

"This is a textbook example of how a single preprocessor misconfiguration can silently undermine an otherwise well-designed security architecture," said Yuannan Yang, audit partner at CertiK.

Yuannan Yang, Audit Partner at CertiK

Coinkite said the bug had the biggest impact on Mk3 devices. Later models used additional sources of randomness that reduced the risk, although the company said they were still affected. The company urged all affected users to create new recovery phrases on updated devices and move their Bitcoin to new wallets. The only exception was for users who added at least 50 private dice rolls when creating their wallet, which added enough randomness to protect them from this particular flaw.

How Does This Fit Into Crypto's Broader Security Crisis?

The Coldcard incident was the largest crypto security incident reported in July, according to blockchain security firm CertiK's research. It follows other major breaches like the roughly $24 million Ostium hack and the $1.34 million Cascade exploit. These incidents underscore a troubling trend: hackers are increasingly targeting the infrastructure that crypto projects rely on, rather than only exploiting flaws in smart contracts themselves.

In July alone, CertiK recorded 74 crypto security incidents with total losses of approximately $187.8 million. The breakdown reveals where the vulnerabilities lie:

• Software bugs: $68.4 million in losses, the largest category
• Compromised wallets: $42.4 million in losses
• Price manipulation: $34.9 million in losses
• Governance attacks: $20.1 million in losses
• Phishing: $19.7 million in losses

Why Do Security Audits Miss These Kinds of Bugs?

The Coldcard flaw exposes a critical blind spot in how crypto projects approach security. Even when the underlying cryptography is mathematically sound, the software that implements it can fail in ways that are difficult to detect. Yang emphasized that companies need to test not only their cryptography but also the software that connects everything together.

"It's easy to audit the parts that look important and miss the plumbing that quietly decides which implementation actually ships," Yang noted.

Yuannan Yang, Audit Partner at CertiK

This observation points to a systemic problem in crypto security: the focus on auditing the most visible and mathematically complex parts of a system can leave the less glamorous infrastructure vulnerable. A preprocessor misconfiguration, a configuration file, or a build process error might not seem as important as the cryptographic algorithm itself, but as Coldcard demonstrates, these "plumbing" issues can have consequences just as severe.

How to Protect Yourself From Similar Wallet Vulnerabilities

If you use a Coldcard wallet or any hardware wallet, there are practical steps to reduce your risk:

• Update immediately: Install the latest firmware on your device as soon as it becomes available, and check the manufacturer's website for security advisories specific to your model
• Create a new seed phrase: If you created a wallet on an affected firmware version, generate a new recovery phrase on the updated device and migrate your funds to the new wallet
• Verify firmware versions: Check which firmware version your device is running before creating a new wallet, and avoid using versions known to have security flaws
• Use additional randomness: If you created a wallet before the fix, consider adding manual randomness (such as dice rolls) to your seed phrase generation process for extra protection
• Monitor official channels: Follow the hardware wallet manufacturer's official social media accounts and website for security announcements rather than relying on third-party sources

Coinkite released security updates on July 31 for its Coldcard Edge devices and advised affected users to "update first, create a new seed (phrase), then migrate" their funds.

The Coldcard incident serves as a reminder that in crypto, security is only as strong as the weakest link in the entire system. A single misconfiguration in a build process, overlooked during code review, can expose millions of dollars to theft. As the industry matures, the focus on security must expand beyond cryptographic algorithms to include the entire software pipeline that brings those algorithms to life.