The Coldcard Entropy Collapse: 594 BTC, a Broken PRNG, and the End of Blind Hardware Trust

A Thursday in 2026. A cluster of old Bitcoin addresses, silent for years, each holding just over 0.15 BTC, starts moving at roughly the same time. Five hundred wallets. One consolidation address. 594 BTC, approximately 38 million dollars, leaving in a pattern that looks almost too clean. No exchange breach. No stolen API key. No malware. The private keys were not stolen. They were guessed. This is worse. The randomness inside thousands of Coldcard-generated seeds had collapsed from a hardware true-random source into a deterministic pseudo-random routine. A routine built from timer state, call history, and a known unique identifier. An enumerable field. A five-year-old regression that Block's Bitcoin Engineering and Security team identified only after the funds had already moved. Entropy wins. Always check the fees. The official story is short and devastating. Coldcard Mk3 firmware v4.0.0, released in 2021, swapped the hardware TRNG out of the seed-generation path. In its place, the firmware used a PRNG seeded by values an attacker could reproduce. Anyone with knowledge of the device identity and enough patience could enumerate the seed space. No physical access. No side-channel. Just arithmetic. Coinkite confirmed the report and acknowledged that the same build settings partially affected the Mk4, Q, and Mk5, while the Mk3 absorbed the full blow. Before this, Coldcard was the wallet for people who distrusted wallets. Airgapped, Bitcoin-only, Shamir-friendly, the kind of hardware that lives in a safe and gets handled with cotton gloves. It was the security-maxi choice. And because the vulnerability lived in the firmware update channel, the attacker did not need to defeat the safe or steal the device. The supply chain did the work for them. I have been inside enough firmware diffs to know how this happens. A "build setting" removes a hardware entropy call and replaces it with a software fallback. The fallback keeps the code compiling. It passes tests. It looks like a random function because it produces different numbers each time. But the seed space is no longer 256 bits of uniform randomness. It is a product of a few low-entropy variables. A timer is not a secret. A call count is not a secret. A serial number is not a secret. Let's model the attack surface. Suppose the timer is a millisecond value at boot, the call history is a monotonic counter, and the unique identifier is a device serial printed on the box. The joint space is not two to the power of 256. It is a modest product space. The timer can be bracketed by on-chain timestamps; the call counter is a small integer; the serial may be inferred from a stolen box or from a compromised shipping database. Even if only one of those values is unknown, the remaining space is trivial for a dedicated enumerator. The attacker does not need all three values. They need enough to reduce the search to a manageable set. This is a security regression to zero. The attacker does not need to compromise the device. They scan the blockchain for addresses that look like they were generated by this firmware, reconstruct candidate seeds for each device identifier and time window, derive the private keys, and sweep whatever exceeds the cost of the operation. That explains why the affected wallets were single-signature, held more than 0.15 BTC, and had been dormant for years. The attacker was not opportunistic. They were filtering by ROI. The worst part is permanence. Coinkite's later firmware updates do not repair seeds already created by the vulnerable routine. There is no patch that can add entropy to a private key that already exists. The only solution is to generate a new seed on an unaffected device, move every bitcoin to a new address, and abandon the old wallet like a biohazard bag. For a group of users who chose Coldcard precisely because they wanted to hold for years, this migration is not just a nuisance. It is a betrayal of the core promise. BIP-39 passphrases provide a temporary wall, but only if the user enabled one. The passphrase acts as extra entropy outside the vulnerable seed-generation process. It is not part of the exposed PRNG space. But most users never set a passphrase. And even with one, the seed itself is still compromised. The passphrase is a bandage on a broken leg. The leg still has to be replaced. Worse, the flawed routine did not limit itself to the master seed. The same weak entropy path fed paper wallet private keys, seed XOR masks, and device clone keys. These are not independent features. They are derivative categories of the same compromised source. A user who generated a paper backup on a Coldcard, or created a seed split for a vault, is carrying the same statistical weakness in every copy. The attack surface is not a single wallet. It is the entire archive of secrets that touched that firmware. The difference between the Mk3 and the Mk4/Q/Mk5 is telling. Coinkite said the other models were "not as severely affected, but still severe." Translation: on those models, the TRNG was not fully bypassed, but the entropy quality was degraded. A partially degraded entropy source is still a problem. It means the distribution of seeds is not uniform, so an attacker can prioritize likely candidates. The absence of full compromise is not the same as safety. What matters is that this was not discovered by a responsible-disclosure email or an independent audit. It was discovered through stolen funds. Block's security team appears to have observed the on-chain movement first and then traced backward to the generation logic. That is a forensic model, not a preventive one. The five-year window between release and exploitation means the attacker either found the weakness early and waited for wallets to fatten, or stumbled onto a pattern while scanning for other vulnerabilities. Either scenario is ugly. If the attacker waited, then the 594 BTC is only the portion that cleared their threshold. There may be more wallets with weaker balances or stronger passphrases that remain unexploited — not safe, just below the minimum cut. Those keys still exist in the same enumerable space. They are still measurable risk. The fact that Block published on the same day as the theft suggests a defensive retro-engineering, not a coordinated disclosure. The attacker may still hold the master key to a much larger trove of weak seeds. The source quality here is medium-high, not excellent. We have the first-party report from Block, a confirmation from Coinkite, and on-chain evidence of 594 BTC moving. What we do not have is an independent third-party audit that isolates the exact code path. That absence matters. A security incident of this magnitude should trigger a public forensic review, not a press release. Without independent verification, every conclusion about the seed space remains an inference from the victim side. The absence of a public firmware diff or a signed advisory with a cryptographic proof of the vulnerable code path leaves room for alternative explanations, though none are plausible. From a market perspective, the 594 BTC is a rounding error. Bitcoin will not reprice because a hardware wallet stumbled. The economic weight is in the damaged trust layer. Approximately 500 high-net-worth HODLers — the exact population that hardware wallets are designed to protect — just learned that a firmware update can silently degrade key generation. That lesson will not show up in a price candle. It will show up in the slow migration from single-signature hardware wallets to multisig configurations, from one vendor to another, and from self-custody hardware to MPC solutions. There is also a compliance angle. The attacker consolidated 562 BTC into a single address, a typical first step in a laundering process. Expect chain-analysis firms to tag these outputs. If any portion touches a regulated exchange, the KYC/AML systems will likely flag it. The operator is now a high-value target for IRS-CI, FinCEN, and Canadian authorities. But this is small comfort for the victims. The coins are gone, and the forensic path is long. Law enforcement may have to race against mixers, but the amount is large enough to create a chain of dirty outputs that will be studied for years. This is where the usual industry narratives fail. The first instinct is to call it a Coldcard problem and move on. It is not. It is a supply-chain trust problem. Every hardware wallet vendor assumes that a firmware update can change security properties without breaking the device's fundamental promise. That assumption is now invalid. The difference between a hardware wallet and a paper wallet is not the metal case; it is the integrity of the random number generator. If the firmware replaces that integrity with a deterministic function, the hardware has become a false idol. 2017 vibes. Proceed with skepticism. The second narrative is "not your keys, not your coins." That blame-shifting phrase should not apply here. These users held their own keys. They followed the script. They bought a dedicated device, kept the firmware current, stored backups in a safe. The failure occurred before the keys even existed. The wallet was a delivery mechanism for a weak secret. When the RNG is predictable, self-custody becomes self-deception. The third mistake is to assume the damage will reveal itself in price action. It will not. The damage is to the narrative of "security through dedicated hardware." That damage is priced slowly, in customer migration, in the rise of multisig and MPC wallets, and in the cold silence of a support ticket that says "we recommend you migrate all funds." The broader ecosystem should read this as a warning about hardware wallets as a category. Earlier in the same window, the Zilliqa network paused trading after a Ledger signing-application vulnerability exposed private keys from reconstructed seed phrases. That incident was about a hardware wallet becoming a source of entropy leakage. This Coldcard event is the same disease with a different symptom. The industry is collecting security incidents, not solving the underlying problem: key generation is only as strong as the entropy source, and entropy sources are code. Code gets changed. Code decays. In my own audits, I have learned to ask one question first: where does the entropy come from, and can the firmware change that source without a mandatory user acknowledgment? Most products cannot answer. The Coldcard incident is what happens when the answer is "yes, silently." The takeaway is not to throw away hardware wallets. It is to stop treating them as black boxes. The security of a key depends on the entropy source that created it, not on the shape of the metal surrounding it. A firmware update is a security event. Every user should be able to know what changed. Every vendor should be required to prove the change did not degrade key-generation math. Every auditor should be checking for the absence of TRNG calls, not just the presence of a lock icon. Impermanent loss is real. Do your math. This time, the math was on the supply chain. The next time, it may be on the "secure" element itself. Entropy wins. Always check the fees — the fee of trust is vigilance. The next major vulnerability will not be announced by a team finding a bug. It will be discovered by an attacker enumerating a seed space that was supposed to be infinite. The question is not whether it happens again. The question is whether you know the entropy source of the keys you are still holding.