Most people don’t realize that an air-gapped Bitcoin wallet can keep a private key away from the internet for years and still be vulnerable from the moment its seed was created.
Coldcard’s newly disclosed random-number bug highlights the trap well. An affected wallet could hand you a perfectly ordinary 12- or 24-word recovery phrase, then let you lock it away and sign transactions offline. Underneath, the generator was dealing from a much smaller deck. An attacker could run through that deck on another machine and rebuild likely seeds. Bitcoin’s public ledger would show which guesses matched real addresses.
For me, a wallet’s fate is decided at the point of creation. Before the PIN, steel backup, tamper-evident bag or air gap can help, the seed has to begin with real randomness.
A sound modern random-number generator can supply enough entropy. However, if a bad actor knows the process by which the RNG was created it can be possible to backwards engineer the process.
A physical dice roll gives the owner a source of randomness that can be seen, controlled, and kept separate from the manufacturer’s code.
The seed was weak before the wallet went offline
CryptoSlate’s first report on the Coldcard flaw explained the recent attack path. Candidate seeds can be generated away from the device, converted into public addresses and checked against activity on Bitcoin’s public ledger.
The technical cause was almost painfully small. A March 1, 2021 code change moved Coldcard’s seed generation into a new library. Production firmware defined a setting called MICROPY_HW_ENABLE_RNG as zero, meaning disabled, while the integration checked only whether the setting existed. Its presence sent generation to MicroPython’s deterministic Yasmarang fallback in place of the intended hardware random-number generator. The affected path shipped in firmware 4.0.0 on March 17, according to Block’s coordinated analysis.
Ordinary-looking wallet output concealed the drastically reduced search space. Coinkite’s preliminary estimate puts affected Mk2 and Mk3 seeds at roughly 40 bits of effective search space and affected Mk4, Mk5, and Q seeds at roughly 72 bits.
Block identified a separate limit for later devices: at most 2^32 securely distinguished streams when the fallback state and call history were fixed. Coinkite’s figures estimate the effective space an attacker might search.
Both analyses place later pre-fix devices inside the affected range. Coinkite’s security advisory lists Mk4 and Mk5 firmware before standard 5.6.0 or Edge 6.6.0X, and Q firmware before standard 1.5.0Q or Edge 6.6.0QX. For Mk2 and Mk3, Coinkite lists versions 4.0.1 through 4.1.9, while Block says the path began in 4.0.0. I would treat that disputed boundary conservatively.
Updating to a fixed release protects future seed generation. However, all existing seeds keep the entropy it received at birth, and every address derived from it shares the same root secret.
Anyone who used an affected version should check the advisory and create an entirely new seed with fixed software and trustworthy entropy when the private-dice exception cannot be established. The funds then need to move to the new wallet. A new address from the old mnemonic preserves the weakness.
Bitcoin Optech reported an evolving estimate above 1,000 BTC on July 31. As of Aug. 2, Galaxy Research estimated a suspected 1,367 BTC across 4,585 addresses. An X user posting as Graham_Quantum also said 18.25245043 BTC left wallets on July 29.
The knock-on effect has also caused a much larger figure due to defensive movement. CryptoSlate’s second Coldcard report found that 77,402 BTC moved from older UTXO bands after the disclosure.
The total covers gross old-coin movement, including precautionary migration. It measures a wave of self-rescue, while Galaxy’s smaller figure is an evolving estimate of suspected loss.
| Figure | Classification | Scope | Important limit |
|---|---|---|---|
| 1,367.05 BTC | Suspected loss | Galaxy Research’s Aug. 2 estimate across 4,585 addresses | Evolving, attributed estimate with no finalized incident total |
| 77,402 BTC | Precautionary movement | Gross movement from older UTXO bands after disclosure | Includes defensive migration and is separate from theft or sales totals |
The security failure has created two shocks at once: theft and a much larger wave of rational migration.
What private dice change
Coldcard’s dice documentation calculates about 2.585 bits of entropy for each independent roll of a fair six-sided die. Fifty rolls provide about 129.25 bits of raw roll entropy, conventionally targeting 128-bit security. Ninety-nine provide about 255.91 bits, roughly the target for 256-bit security, before the wallet applies its documented conversion procedure.
Those numbers line up with BIP-39, the widely used mnemonic standard. A 12-word phrase encodes 128 bits of entropy plus a 4-bit checksum. A 24-word phrase encodes 256 bits plus an 8-bit checksum.
A checksum catches typos. Randomness comes from the material underneath. Hashing and tidy formatting can dress up weak input, while the pool of possible secrets stays just as small. Those twelve reassuring words may have been drawn from a very shallow well.
Physical rolls help only when the wallet’s documented procedure incorporates them correctly. The die must be suitable for the task, each roll must be genuine and independent, and the sequence must stay private. Reused patterns, photographs, cloud notes, and entry on a normal networked computer can undermine the rolls’ independence or secrecy.
For this Coldcard incident, Coinkite says migration may be unnecessary only when the user can establish that the final seed incorporated at least 50 fair, independent, and private dice rolls. Its advice for uncertainty is migration.
For me, dice matter because device-generated randomness asks the owner to trust the hardware, firmware, build process, and integration code as one chain.
A documented dice-entry flow adds owner-controlled entropy from outside that chain. Roughly 50 fair rolls target 128 bits and 99 target about 256 bits, but users should follow the device’s exact procedure instead of improvising a conversion.
Strong, unique BIP-39 passphrases can also change the attack in a different way. It adds an independent secret that an attacker must discover after finding the mnemonic. The mnemonic’s original entropy stays unchanged. Every passphrase, including a typo, derives a valid-looking wallet, so loss of the exact passphrase can strand the intended funds. A device PIN serves a different purpose.
A passphrase creates a genuine tradeoff. It can provide a powerful second barrier when the owner can reproduce and protect it. Poor backup turns the same feature into a way to lock oneself out.
Weak randomness keeps returning
The Coldcard incident is the current narrative, and the same root failure has appeared in very different wallets.
In 2023, Ledger Donjon disclosed that certain Trust Wallet browser-extension versions used a WebAssembly path seeded with a 32-bit Mersenne Twister value. The apparently normal mnemonics came from about four billion possible starting values. The affected scope was specific: browser-extension versions 0.0.172 through 0.0.182 using Trust Wallet Core before 3.1.1. The National Vulnerability Database records exploitation in December 2022 and March 2023.
The Milk Sad disclosure showed a more intuitive version of the same danger in Libbitcoin Explorer 3.x. Its bx seed command used a 32-bit, time-seeded Mersenne Twister and could produce the same mnemonic under the same clock conditions. Knowledge of the approximate creation time gave an attacker a much smaller range to search than the recovery words suggested.
Researchers found more than 2,600 actively used Bitcoin wallets in the affected ranges and estimated more than $900,000 in related theft across multiple chains at August 2023 prices. More than 2,550 of those wallets shared an automated pattern and may have belonged to one owner, and the researchers said some drains could have involved other weaknesses.
The flaw appeared through a different disguise each time. Coldcard slipped into a firmware fallback. Elsewhere, weak randomness crept through a browser extension and a command-line tool that trusted the clock. The resulting wallet secrets looked strong on the surface, though their real pool of possibilities was dangerously shallow.
Bitcoin custody advice often begins after the seed exists: keep it offline, use durable backups, separate responsibilities, and test recovery. All of that still matters. The Coldcard failure reminds us to move the starting line back one step.
An air gap protects the secret you give it. The randomness has to come first.
