A critical flaw in COLDCARD hardware wallet firmware, discovered in late July 2026, exposed a dangerous gap in how wallet security is tested and validated. The bug, which shipped in 2021 and went undetected for five years, allowed attackers to recover private keys from affected devices by exploiting a build-configuration error that silently routed seed generation through a weak software random number generator instead of the intended hardware-based system. The confirmed losses total approximately 1,370 Bitcoin, worth roughly $88 million at the time of the exploit, with private reports suggesting the actual figure could reach as high as 2,055 Bitcoin, or about $130 million.

What Is a Hardware Wallet Seed, and Why Does Randomness Matter?

A hardware wallet's security rests on two fundamental properties of its seed, the master secret from which all private keys are derived. First, the seed must remain secret. Second, it must be unpredictable when generated. Hardware wallets like COLDCARD exist primarily to protect the first property by keeping private keys isolated from internet-connected computers. The COLDCARD incident represents a catastrophic failure of the second property.

When a wallet generates a seed, it relies on randomness to create a value that cannot be guessed or reproduced. A true random number generator (TRNG) on a secure microcontroller produces genuinely unpredictable output. A software pseudo-random generator (PRNG), by contrast, is deterministic; given its internal state and call history, its output can be replayed exactly. If an attacker knows or can infer the PRNG's state, they can enumerate all possible seed values and match them against public wallet data such as an address or public key. This transforms seed recovery from a cryptographically infeasible problem into an offline search that can be completed in hours or days.

How Did a Build Error Disable Hardware Randomness?

COLDCARD's firmware exposed two separate random number generator surfaces. MicroPython, the embedded Python framework used in the wallet, shipped an STM32 platform layer that exposed a global symbol called rng_get(), which the wallet's crypto library expected to call. COLDCARD also maintained its own board-local hardware random number generator wrapper. Both were intended to supply hardware entropy, but a configuration error routed the seed generation process onto a software fallback instead.

The root cause was a build-and-integration error around the MICROPY_HW_ENABLE_RNG configuration macro. COLDCARD's production board configuration set this macro to 0, because the firmware intended to use its own board-local hardware random number generator rather than MicroPython's implementation. However, the wallet's seed-generation path had been migrated to call ngu.random.bytes(32), and the crypto library's STM32 path ultimately depended on the global rng_get() symbol resolved by MicroPython.

The crypto library checked only whether the MICROPY_HW_ENABLE_RNG macro existed before calling rng_get(), not whether it was enabled. A macro defined as 0 is still defined, so the build guard passed and the firmware compiled successfully. Because MicroPython selects its random number generator implementation by the macro's value rather than its existence, setting MICROPY_HW_ENABLE_RNG to 0 routed rng_get() onto the software fallback branch, a deterministic generator called Yasmarang, instead of COLDCARD's board-local hardware wrapper.

Steps to Understand the Security Implications of This Flaw

• Seed Predictability: For COLDCARD Mk2 and Mk3 devices running firmware versions 4.0.1 through 4.1.9, no cryptographic entropy was added to the random number generator, making wallet generation deterministic once the fallback state and call history were known.
• Reduced Entropy: For Mk4, Q, and Mk5 devices, secure-element material was hashed but only four bytes were passed into the random number generator's reseed function, limiting the secure reseed to a single 32-bit state word, far less effective search space than users expected.
• Offline Recovery: The flaw turned seed recovery from a cryptographically infeasible problem into an offline search, allowing attackers to enumerate candidate seeds and match them against public wallet addresses or extended public keys without ever touching the hardware wallet itself.
• Silent Failure: The build guard that checked only for macro existence rather than macro value is the kind of integration error that functional testing cannot catch, because the firmware compiled and ran without errors.

When Did the Exploit Begin, and How Were Wallets Compromised?

The COLDCARD flaw shipped in 2021 but was not exploited at scale until late July 2026. Beginning on July 30, 2026, affected wallets were swept in a series of on-chain waves as attackers recovered private keys and transferred Bitcoin to their own addresses. The publicly verifiable on-chain minimum loss stands at approximately 1,370 Bitcoin, worth roughly $88 million at the $64,099 price on August 5, 2026. However, private-channel reconciliation conducted by Galaxy Research, based on correspondence with 73 victims, puts the figure higher at roughly 1,596 Bitcoin, with suspected-but-unconfirmed drains potentially reaching as high as 2,055 Bitcoin, or approximately $130 million.

The exploit did not require physical access to the hardware wallets. Instead, attackers used the known weakness in seed generation to perform an offline search, recovering private keys from public wallet data. Once they had the private keys, they could spend the Bitcoin without ever touching the physical device.

What Does This Reveal About Hardware Wallet Security Testing?

The COLDCARD incident exposes a critical gap in how wallet security is validated before launch. Functional testing, the standard approach of running the firmware and confirming it behaves as expected, cannot catch silent integration errors where a macro is defined but disabled. The build guard that checked only for macro existence rather than macro value passed all standard tests because the firmware compiled and ran without errors.

Security experts emphasize that build guards for cryptographic entropy must check both macro value and fail closed, meaning they must halt the build process if the intended hardware random number generator is not confirmed to be active. Off-chain signing and key-generation components warrant equally rigorous security review, because a flaw in these areas can undermine the entire security model of a self-custody wallet.

The five-year gap between the flaw's introduction in 2021 and its exploitation in July 2026 underscores another lesson: security vulnerabilities in widely-used hardware can remain dormant for years before attackers develop the tools and motivation to exploit them at scale. This makes pre-launch validation and post-launch monitoring equally critical for protecting user funds.

What Other Security Incidents Occurred During This Period?

The COLDCARD exploit was not the only significant security incident during the week of July 27 through August 2, 2026. A separate business-logic flaw in a BNB Chain token called LULA resulted in approximately $578,000 in losses on July 29, 2026. The LULA flaw involved a privileged token function that could move an automated market maker (AMM) pair's balances and force a reserve resynchronization, which attackers exploited through price manipulation to drain liquidity from a PancakeSwap V2 pair.

While the LULA incident was significant, the COLDCARD flaw accounted for more than 99 percent of the total losses during the period, highlighting the outsized impact of a single hardware wallet entropy failure on the broader ecosystem.