Coldcard Releases Critical Firmware Patch Following $130 Million Bitcoin Theft

The patch substitutes SHA-256 Hash_DRBG for the prior Yasmarang PRNG and forces user-supplied randomness into every new seed. For yield operators and long-term holders running self-custody underneath staking, lending, or airdrop-farming strategies, this incident turns key generation into a recurring audit task rather than a one-time setup step.

The Attack Vector and Entropy Drop

The vulnerability traces to a firmware bug dating to 2021 that produced some wallet seeds with insufficient randomness. On affected devices, the practical entropy dropped from 128 bits to roughly 40 bits — enough to make private keys guessable without physical access to the hardware. The first wave drained 594 BTC, about $38 million, from roughly 500 wallets inside a 25-minute window. By early August, Galaxy Research tracked approximately $88.6 million stolen across 4,585 addresses and characterized the attacks as deliberate and programmatic. By August 14, losses had reached 1,778 BTC, roughly $112 million at the time, across three major waves and dozens of smaller incidents. The latest tally sits near $130 million.

Crypto Briefing places the total closer to $114 million across 1,816 BTC, reflecting a snapshot at the time of writing. Coinkite has stated that AI tooling — the company credited outside researchers and the Kimi model during its three-week review — may also have been used offensively to audit older open-source firmware builds. The operational signature is consistent with automated key derivation rather than manual targeting.

Firmware 5.6.1 — What Changed

Per the release notes summarized by Decrypt and Crypto Briefing, the fix spans five attack surfaces:

• Seed generation: mandatory user entropy. Users must supply at least 65 key presses, 50 dice rolls, or 128 coin flips, which the device combines with its own RNG. The old Yasmarang pseudo-random number generator is replaced with SHA-256 Hash_DRBG, and the firmware now self-tests the hardware RNG for failures.
• Transaction signing: the device re-checks a PSBT immediately before signing. A modified transaction triggers a "Transaction modified" warning and halts the signature path. Coinkite described the prior vulnerability as theoretical; no in-the-wild exploitation has been confirmed.
• USB data isolation: transfers are now restricted to recent device-generated results and require encrypted sessions, closing a path where a compromised host could swap transaction data after user approval.
• Delta Mode: functions that could leak seed-derived material have been blocked.
• Backups, passphrase wallets, multisig, and firmware-validation flows were reworked. A public security status page is now live.

Migration Checklist

1. Identify the device. Mk4, Mk5, and Q owners are in scope; older units are not.

2. Confirm the seed-creation window. Any seed generated between 2021 and July 2026 on affected firmware must be treated as compromised. Firmware version alone is not enough to rule out exposure.

3. Install firmware 5.6.1, or 1.5.1Q on the Q model. Verify the build hash on Coinkite's security status page before proceeding.

4. Generate a new seed on the updated firmware, supplying the user-entropy input. The device combines it with on-device RNG. This step is mandatory — the patch does not retroactively harden an existing seed.

5. Move all BTC to the new wallet address. Assume the old seed is observable to the attacker pool.

6. Document the backup procedure. Backup formats have changed; pre-patch backups do not retroactively gain entropy and should be destroyed once the new wallet is funded.

Common errors to avoid: assuming an up-to-date firmware version alone resolves exposure (it does not for seeds created earlier); migrating only the displayed balance while leaving derived addresses, change outputs, or passphrased wallets on the old seed; continuing to use a hardware wallet whose firmware downgrade path remains open to a tampered host.

Verdict: update now, treat every pre-patch seed as burned, and rebuild the key. The exploit window is closed on patched firmware, but only newly generated seeds inherit the hardened entropy — the device cannot self-repair a key that already left the secure element.