Coldcard Firmware PRNG Bug Linked to 1,367 BTC Losses Over Five Years, Galaxy Says

A vulnerability tied to pseudorandom number generation in Coldcard hardware wallet firmware, present since March 2021, has been linked to confirmed losses of 1,367 BTC across 4,585 addresses—worth roughly $86 million—based on on-chain mapping published by Galaxy Research as of August 2, 2026. Galaxy describes it as the largest hardware wallet compromise in Bitcoin history by confirmed losses, noting the thefts required no phishing, no physical access to devices, and no apparent user mistake. Galaxy said it has identified a third wave of suspected Coldcard-generated address drains totaling 207.7294 BTC, lifting its observed estimate to 1,367.05 BTC (about $88.6 million) across the same 4,585 addresses. The firm attributed the activity using on-chain heuristics and cautioned it has not reconstructed seeds on a per-address basis. The episode is framed as a broader lesson about self-custody security: the strength of any wallet setup ultimately depends on the entropy quality used during seed generation. Galaxy argued that even a single misconfigured preprocessor macro can quietly degrade that guarantee for years without an obvious alarm. Market conditions were volatile as the story spread. BTC-USD was down 1.4% on the day at $62,250, after sliding from above $65,000 over the prior week. 24-hour trading volume stood at $16.9 billion, down from more than $20 billion the previous day (TradingView). Block's engineering team traced the technical root cause to Coldcard's libngu library. Coinkite set a board macro to zero to disable MicroPython's RNG in favor of a hardware true random number generator (TRNG). The libngu guard reportedly checked only whether the macro was defined, allowing a value of zero to pass. That behavior led MicroPython to compile out the STM32 hardware RNG call and instead rely on Yasmarang, a software PRNG offering roughly 40 bits of effective entropy—far below the 128 bits expected for a BIP39 seed phrase. Later devices (Mk4, Mk5, Q) improved to an estimated 72 bits of effective entropy, still short of the intended level. The gap between 40 bits and 128 bits materially reduces the search space attackers must cover, increasing the feasibility of targeting weak seeds. Coinkite published a security notice on July 30, 2026, just hours before an attack that drained about 594 BTC from 500 addresses, according to the report. Two additional waves followed. By August 2, Galaxy's mapping showed 1,367.05 BTC stolen across 4,585 addresses. Most of the funds remain unspent, which Galaxy said could indicate the attacker is waiting before moving the bitcoin. The Coldcard incident also echoes earlier failures tied to insufficient randomness. Galaxy pointed to Android's 2013 SecureRandom issue that repeated ECDSA nonces and exposed keys, the 2022 Wintermute hack linked to the Profanity vanity address generator seeded with 32 bits of entropy (about $160 million drained), and the 2023 "Milk Sad" disclosure in which Libbitcoin Explorer's bx seed used a Mersenne Twister seeded by system time, reducing an expected 256-bit entropy level to roughly 32 and exposing more than 120,000 wallets. Ari Redbord, global head of policy at TRM Labs, said the case underscores how self-custody can transfer risk rather than eliminate it. TRM Labs' H1 2026 data shows infrastructure and key compromises represented 15% of incidents but accounted for 76% of total dollar losses across a record 207 hack events. Galaxy said it has shared roughly 600 suspected attacker-controlled addresses with federal investigators, compliance vendors, and cybersecurity firms. Source attribution: Galaxy Research on-chain mapping and related reporting; market data from TradingView.