News · Security & Hacks
A weakened entropy bug introduced in March 2021 allowed attackers to brute-force keys and drain 1,816 BTC across four distinct waves.
Key point 1 of 3
01
Attackers drained roughly 1,816 BTC (~$116 million) from over 5,200 Coldcard addresses starting July 30, 2026 .
Key point 2 of 3
02
A March 2021 firmware defect reduced seed entropy from 128 bits to as low as 40 bits, permitting remote brute-force attacks .
Key point 3 of 3
03
Firmware updates do not remediate existing seeds, necessitating the migration of funds to newly generated wallets .
Context
A March 2021 build configuration error in Coldcard firmware 4.0.1 substituted hardware entropy with a flawed software random number generator, leaving seeds vulnerable to…
Why it matters
Holders using Coldcard seeds generated between March 2021 and the recent patch face complete loss of funds.
What to watch
On-chain monitoring of remaining pooled balances across attacker addresses, further victim reporting, and formal threat-actor attribution by blockchain forensic investigators.
Sources
Built from 1 primary source, machine-checked before publication.
Keep reading
Read the full story
AI-generated, source-verified. Sources, citations and live prices on the article page.