Coldcard Mk3 Seed Entropy Sweep

What happened

On 30 July 2026, bitcoin began draining out of Coldcard-generated addresses in waves, the first taking about 594 BTC from roughly 500 wallets in 25 minutes. TRM Labs' 5 August analysis puts the running total at about 1,816 BTC, roughly $116m, from more than 5,200 addresses across at least four waves, making it the largest hardware-wallet exploit of 2026 by TRM's accounting. Coinkite had disclosed the same day the draining began that a build flag set to zero in March 2021 replaced the hardware random number generator with a software fallback, cutting Mk3 seeds to roughly 40 bits of real randomness against a 128-bit target. No device was touched: the seeds were guessable.

A preprocessor guard tested whether MICROPY_HW_ENABLE_RNG was defined rather than whether it was set, so a value of zero satisfied it and the #error never fired. Coinkite puts the effective search space at about 40 bits on Mk3 and about 72 bits on Mk4, Mk5 and Q; 2^40 is roughly 1.1 trillion candidates, a search a computer can finish. Updating the firmware does not repair a seed that already exists. The attacker's signature is an identical hardcoded fee of about 30 sat/vB on every sweep, against a 0.4 to 1.0 median that week, though TRM notes transaction construction differs between waves, so there may be more than one attacker. Laundering has started at the margins: 64.9 BTC went into Wasabi and 200 ETH into Tornado Cash on 4 August, with the bulk still sitting in attacker addresses in public view. Coinkite destroyed its remaining vulnerable stock and halted shipments on 2 August, opened a permanent disclosure record on 4 August, and notes that AI-assisted review failed to catch the bug. It has not confirmed the theft was caused by its flaw. Figures are TRM's on-chain estimates and still moving.