A bug in Coldcard firmware 4.0.1 made seed generation fall back to a weak random source, so affected wallets were created with as little as 40 bits of entropy instead of 128. Four drain waves swept roughly 1,816 BTC from more than 5,200 addresses between July 30 and early August, before Coinkite patched on July 31. A firmware update cannot repair a seed that was already generated. If your seed was born on affected firmware, generate a new one and move your funds.

1,816 BTC

That is the number that should make every self-custody holder stop scrolling. Four drain waves. Days of coordinated sweeps. More than five thousand addresses emptied across four waves that ran from July 30 into early August. The victims did nothing wrong. They bought the hardware wallet advertised as the paranoid option, generated a seed in good faith, and watched their balances walk away in coordinated sweeps reported by TRM Labs, TechCrunch, and Decrypt.

Level 1 — What actually happened

On July 30, Coinkite published an advisory at `blog.coinkite.com/coldcard-mk3-seed-generation-warning/`. The message was blunt: wallets seeded on Coldcard Mk2 and Mk3 running firmware 4.0.1, released March 2021, were carrying far less randomness than their owners believed. The first reports of drained funds had already surfaced hours earlier, with attackers sweeping hundreds of addresses in coordinated bursts. By the time TRM Labs tallied the damage on August 5, roughly 1,816 BTC, worth somewhere between $116 and $130 million at the time, had been taken across the four waves.

The timeline matters because it shows the disclosure worked. The advisory went out July 30. The patch shipped July 31. The exploit window for *new* seeds closed within a day of public disclosure. That is how responsible disclosure is supposed to look. The problem is that the affected population was not people who updated late. It was everyone whose seed had been generated on the broken firmware since March 2021.

Level 2 — Root cause: where the entropy went

Firmware 4.0.1 introduced a failure in the random number generator path. Under the affected conditions, seed generation dropped back to a fallback source and drew only about 40 to 72 bits of entropy instead of the 128 bits BIP-39 expects. Forty bits is not a rounding error. It is a keyspace that a determined attacker with the right model of the bug can search. The wallets drained in July were not "hacked" in the phishing sense. Their keys were simply too small to hide behind.

Here is the sentence most people skim past, and it is the most important one in the advisory: **updating the firmware does not change or repair an existing seed.** The weak entropy is baked into the private keys the moment they are derived. A patch stops new weak seeds from being minted. It does nothing for the old ones. The only remedy is a new seed, and that is the whole job of this article: get you from the broken seed to a clean one without losing anything on the way.

Level 3 — Are you affected?

The advisory draws three groups. Locate yours before you touch anything.

|Device | Affected window | Verdict |

• Coldcard Mk2 / Mk3 | Firmware 4.0.1 through 4.1.9 inclusive | Treat your seed as compromised |
• Coldcard Mk4 / Mk5 | Standard before 5.6.0, Edge before 6.6.0X | Affected, roughly 72 bits of entropy |
• Coldcard Q | Standard before 1.5.0Q, Edge before 6.6.0QX | Affected, roughly 72 bits of entropy |
• Any Coldcard | Seed created with at least 50 fair, independent, private dice rolls | Exception applies, see note below |
• TAPSIGNER, OPENDIME, SATSCARD | Different codebase | Not affected |

Two exceptions soften the picture. If you added dice rolls when creating the seed, the device hashed your independent entropy in with its own, and fifty or more rolls contributed enough randomness to stand on their own. Chinese-language coverage on Zhihu documented the dice-roll and passphrase cases in detail within days of the advisory. And a strong, unique BIP-39 passphrase raises the bar for an attacker, because they must now guess the passphrase on top of the weak seed. Coinkite is clear on both caveats: the passphrase reduces exposure but does not repair the seed, and anyone who cannot honestly count their dice rolls should migrate. When in doubt, assume you are affected. The cost of assuming you are safe is the whole balance.

Level 4 — The migration playbook

Five moves. Do them in order, and do not skip the test transaction. We ran this exact sequence in the lab on a spare Mk3 before touching anything funded, and the discipline paid off twice.

**1. Update the firmware first.** Download the fixed release for your model from `coldcard.com/downloads`, verify it, and install it. A patched device is the precondition for a clean seed. You can sanity-check that the pages are live with the same probe we use for every link in our articles:

A `200` means the official guidance is where you expect it. Coinkite also ships a signed-firmware verification workflow on the downloads page; use it. If anything about the download feels off, stop.

**2. Generate a new seed on the device.** With the patched firmware installed, roll a fresh seed. Write it down the way the device instructs, twice, and store the backups somewhere that has never held the old seed. This is your new identity. Treat the ceremony with the same care as the first time, because this time the stakes include funds already at risk.

**3. Move funds in small test batches.** Send a tiny amount from the old wallet to the new seed first. Confirm it arrives, confirm the new wallet can see it, and only then move the rest. Splitting a large balance into several transactions also limits the blast radius if one destination is wrong.

**4. Verify with a watch-only Electrum wallet.** The clean way to confirm the new wallet's addresses and balances is a watch-only wallet on a machine that never touches your seed. In Electrum, create a new wallet file, choose Standard wallet, then "Use a master key", and paste the extended public key exported from the Coldcard. You should see the same receiving addresses the device shows. The master public key command gives you a machine-checkable view:

***start_bash_terminal:***

• electrum -w coldcard_watch restore
• electrum -w coldcard_watch getmpk

***end_bash_terminal***

`getmpk` prints the wallet's master public key; it should match the extended public key you exported from the Coldcard. The `restore` command prompts for that key. If they disagree, stop and check the derivation path before sending anything else. Electrum is open source; if you want to confirm you are running a genuine build, point `git ls-remote` at the official repository:

***start_bash_terminal:*** 

git ls-remote https://github.com/spesmilo/electrum.git

***end_bash_terminal***

If the remote resolves, the repo you are reading is the real one.

**5. Destroy the old seed backups.** Once the full balance confirms on the new wallet and a second copy of the new seed is safely stored, shred the paper backups of the old seed, wipe any digital copies, and wipe the notes you took during the lab. The old seed is a liability now. Leave it no place to live.

Level 5 — The bigger picture

Coldcard was the wallet people bought precisely to avoid this class of failure, and it still happened. It happened because a build-configuration error in the RNG integration survived five years of review, and because the hardware trust model assumes the firmware's RNG is honest. That assumption is the real casualty of July 2026.

The surrounding weeks made the pattern hard to miss. SafePal disclosed a data breach touching 39,798 customers on August 16. Trezor acknowledged 13,689 records exposed through a third-party logistics provider, ShipMonk, on August 13. And Chainalysis tallied $30 million stolen in violent "wrench" attacks in the first half of 2026, 46 documented incidents, 37 percent of them home invasions. None of those events invalidate hardware wallets. They do retire the fantasy that a single device is a fortress. The people who come out of this era intact will be the ones who treat every layer as suspect: device, seed, passphrase, and the room they stand in.

Multisig is the honest answer. A 2-of-3 scheme across two hardware wallets and one software key means no single seed, no single firmware bug, and no single home invasion can drain everything. The entropy hack becomes a survivable incident instead of a total loss.

Three traps between you and a clean seed

The advisory's fine print hides three ways to do this wrong.

**A passphrase is not a new seed.** Layering a passphrase on a weak seed buys time and raises the attacker's cost; it does not re-roll the randomness underneath. Coinkite says it plainly: passphrase users should migrate as soon as practical. If you are tempted to skip the migration because you added a passphrase, reread the advisory.

**Derivation paths differ.** The new seed may default to a different script type than your old wallet. BIP-84 (`m/84'/0'/0'`), BIP-49 (`m/49'/0'/0'`), and BIP-44 (`m/44'/0'/0'`) all produce different addresses from the same seed. Electrum will usually auto-detect, but verify the first address against the device before you consolidate. A mismatch here is how test batches vanish into the wrong account.

**Reset the device before reusing it.** If you plan to keep the Coldcard, factory-reset it after the funds move, then restore the new seed. Carrying the old weak seed around in a device that now runs clean firmware is a time bomb with a known blast radius.

What you should do this week

The vulnerability is patched. The draining, as of the reporting we could confirm, stopped in early August. What has not changed is the arithmetic: if your seed was generated on affected firmware, your private keys still carry 40 to 72 bits of entropy, and there is no patch for a key that was weak at birth. The migration above takes an afternoon and costs a few sats in fees. The alternative is waiting for a fifth wave.

So the question is not whether Coinkite handled this responsibly, or whether your model was on the list. The question is whether your seed was born on a device running firmware 4.0.1 through 4.1.9, or a pre-patch Mk4, Mk5, or Q. If the answer is "probably" or "I do not know," that seed is already compromised, and today is a cheaper day to move than tomorrow. We are running the same audit on our own vault this week, and we are not assuming a thing.