What the Coldcard Incident Actually Broke, and What It Left Standing

A line of firmware written in 2021 emptied thousands of Bitcoin wallets this summer. Cold storage worked exactly as designed. The failure happened earlier, in the quietest layer of the system.

On the evening of July 29, Jonathan Goodman was at his cottage when he heard that a hardware wallet had a problem. He assumed it was somebody else’s problem. His Bitcoin sat behind keys generated on a device that lived in a safety deposit box and had never been connected to the internet.

He opened his wallet software anyway. The screen showed a column of red withdrawals. Between 9:36 and 9:43 pm, every wallet he had was emptied of 18.25245043 BTC, roughly $1.6 million Canadian.

“Perhaps the hardest part about this is that I did everything right,” he wrote afterward.

He had. That is what makes this worth understanding properly rather than emotionally.

What actually happened

A hardware wallet’s most consequential job takes about a second. During setup, it asks a chip for random numbers and uses them to generate your recovery phrase. Every address and every signature you will ever have descends from that moment.

In the Coldcard firmware released in March 2021, a build-flag check within a cryptography library tested whether a setting existed rather than whether it was enabled. The build compiled cleanly, and seed generation quietly fell through to a software generator seeded from the chip’s serial number and timer state. Coinkite’s own technical backgrounder puts the resulting entropy at roughly 40 bits on the Mk3, against the 128 bits a standard seed should carry. At 128 bits, guessing is physically impossible. At 40, guessing is an afternoon with rented hardware. Block’s engineering team published a line-by-line analysis of how the fallback was reached.

So nobody hacked a device. The attacker reconstructed the flawed generator, enumerated the small set of seeds it could produce, derived the addresses each seed implied, and then checked them against the public blockchain. Matches wasted and swept. Galaxy Research documented 1,367.05 BTC transferred from 4,58 and 5 addresses, worth about $88.6 million at the time. The average address had been dormant for 3.18 years, which tells you who was hit.

Coinkite published an advisory, shipped a fix within days, and co-founder Rodolfo Novak said publicly that the company takes responsibility. He also said the sentence that matters most: the update removes the faulty path, but it cannot repair a seed already born from it.

What this is not

It is not a break in Bitcoin. The cryptography securing the network was never touched.

It is not evidence that air-gapping is theater. The air gap held. Goodman’s device never leaked anything, because the attacker needed nothing from it. The compromise happened upstream, at the birth of the key, and no isolation downstream an correct a starting point that was predictable.

It is also not a case against hardware wallets, and treating it that way would be a mistake. Userspredictable  who supplied h dice rolls sat outside the blast radius entirely, as did users with a strong passphrase. Multisig setups did not appear in the first wave of on-chain analysis at all. The failure was specific, disclosed, and patched by a company that owned it in public.

The industry has seen this shape before

This is at least the fifth appearance of the same failure in different clothes. In 2013, a flaw in Android’s random number generator drained bitcoin from mobile wallets. Between 2011 and 2015, a widely reused JavaScript library leaned on browser randomness never built for key generation. In 2022, a browser extension generated recovery phrases from a 32-bit seed, and a command-line tool did nearly the same thing a year later.

None of these were failures of locks. All were failures in the factory that made the keys, and in every case the code was open and available to read. Open source is a precondition for verification rather than verification itself. Somebody has to look, and the least interesting function in a codebase is nobody’s favorite Tuesday.

“Randomness is the least glamorous line in any crypto product, and it is the only one that cannot be fixed later. The industry pours its attention into the parts users can see. The parts they never see are where the money actually lives.”

— Stefan Lauer, Head of Infrastructure, SimpleSwap

Kraken security chief Nick Percoco made the structural point afterward. Certification confirms that an approved component is present, but buyers get no independent check that “the approved entropy path is the one actually executing,” as he put it. Closing that gap looks unglamorous, which is precisely why it keeps not happening.

If you hold a Coldcard

The question is not which firmware your device runs today. It is the firmware that generated your seed. If that seed came from an Mk3 on firmware 4.0.1 through 4.1.9 without dice rolls or a strong passphrase, treat it as compromised rather than as merely at risk. Update the device, generate a fresh seed, verify the backup, send a small test transaction, then move the balance. The weakness travels with the words, so restoring the old phrase elsewhere solves nothing.

Take the hour it deserves, because a rushed migration can cost more than the bug. And ignore anyone arriving in your messages offering recovery services. No legitimate party will ever ask for a recovery phrase, and the people asking are the second wave of this incident.

Where this leaves the second decade

Ownership was settled years ago by Mt. Gox, and by 2022. Hold your own keys. Almost nobody serious disputes it now.

July was a reminder that winning that argument was the first step, not the last. A key can be yours and still be badly made. An asset can be safely stored and still travel a careless route the moment you move it. Both questions live in layers users never see, and both are answered by companies rather than by philosophy.

SimpleSwap works on the second layer. Funds move wallet-to-wallet; no long-term customer balance sits on the platform, and routing across liquidity sources happens in the background. We have no view into how a device generated a seed five years ago, and any platform claiming it could have prevented this would be selling something. What we can say is that the standard this incident sets applies to us as much as to anyone shipping hardware. The default users never inspect carry the same obligation as those on a landing page.

Boring infrastructure is not a modest ambition. It only announces itself when it fails.

“Users do not owe us their trust. They lend it, one transaction at a time, and we are supposed to earn it in the parts they never look at.”

— Stefan Lauer, Head of Infrastructure, SimpleSwap