A critical flaw in Coldcard’s random number generation has already led to millions of dollars in stolen bitcoin. Learn which wallets are affected, who is safe, and what you should do immediately.
Picture this: 600 bitcoin. Gone in 15 minutes. Not from an exchange hack. Not from a phishing email. But from hardware wallets sitting safely in drawers, protected by PIN codes and air-gapped security. Bitcoin that had sat untouched for years disappeared in a 25-minute sweep that left the community stunned.
The culprit? A silent bug in the Coldcard MK3’s Random Number Generator that had been hiding since March 2021.
The 32-Bit Catastrophe
Security researchers traced the exploit to a coding oversight so subtle it went undetected for over five years. The vulnerability sat in the `libngu` library, Coldcard’s cryptographic backbone. Here’s what went wrong: the code was supposed to pull genuine randomness from the STM32 hardware chip’s True Random Number Generator. It never did.
A fallback function in the library silently activated when the intended hardware RNG failed to connect properly. No error message. No warning light. Just a quiet handoff to a software-based pseudo-random number generator called Yasmarang. The result? Your supposedly unbreakable 128-bit or 256-bit seed became 32 bits. That’s it. Just 32 bits of entropy.
Think about what 32 bits means in real terms. The vulnerable implementation could generate only about 4.2 billion possible seeds. That sounds like a big number until you realize a standard laptop running the right script can enumerate every single one of those combinations in about an hour. These weren’t wallets. They were welcome mats.
The Low-Hanging Fruit Disappears First
The initial wave targeted the easiest pickings. Coldcard MK3 devices that didn’t use the ‘roll ‘n dice’ feature, multisig protections, or strong BIP-39 passphrases. These wallets fell first because an attacker could pre-compute the entire key space, then simply sweep matching addresses.
The mechanics were devastatingly simple. Knowing the limited seed space, attackers generated brute-force scripts — tools that virtually anyone could create using a Large Language Model. The vulnerable seeds weren’t just weak. They were effectively “lying in the street.” Galaxy Research mapped the carnage: approximately 1,367 BTC worth $88.6 million drained across 4,585 addresses, with earlier estimates showing roughly 594 BTC from 500 wallets vanishing in that initial 25-minute window.
The Silence Was the Killer
What makes this exploit particularly cruel? The silence. Due to the fallback function in the library Coldcard used, no error was generated when the hardware RNG failed. The system simply… continued. Users creating wallets believed they were generating cryptographically secure 12 or 24-word seeds. They weren’t. They were drawing from a pool so small that determined attackers could map it completely remote, without ever touching a physical device.
The bug traces back to March 2021 when firmware version 4.0.0 introduced a change that routed seed generation away from the hardware RNG. Every seed generated on MK3 devices running firmware 4.0.1 through 5.0.3 without dice rolls or passphrases carries this weakness. If that’s you, your funds are exposed right now.
MK4 and Beyond: You’re Not Safe Either
Here’s where it gets worse. Newer Coldcard models reportedly contain the same underlying flaw in their code. They gather additional randomness from other entropy sources, achieving approximately 50–70 bits of entropy instead of the catastrophic 32 bits. That’s substantially better than the MK3. But “better” doesn’t mean “secure.”
Those 50–70 bits are still vulnerable to brute-force attacks using sufficiently large CPU farms. The expectation? These newer wallets will also be drained in the coming days, weeks or months as attackers scale their operations from low-hanging fruit to harder targets. If you have one of those devices, the clock is ticking, get your funds off now!
The Dice That Saved
Not every Coldcard user was caught in this net. The “roll ‘n dice” seed generation function follows a completely different code path than the vulnerable RNG. Users who manually entered entropy from physical dice rolls created seeds immune to this specific vulnerability. That physical randomness overwrote the compromised software path. If you rolled dice for your seed, breathe easier. You avoided the trap. It is still considered good practice to move your coins to another device, but you don’t have to rush.
Multisig Has a Catch
Perhaps you thought multisig protected you. Here’s the uncomfortable truth: multisig is only secure when the number of Coldcards in your quorum is less than the threshold required to sign transactions. If your setup uses enough Coldcards to meet the signing threshold, an attacker who has compromised enough keys from brute-forcing can assemble a capable signing set. Even if they don’t have your complete wallet descriptor, the risk extends to transaction publication.
Don’t broadcast vulnerable transactions to the public mempool. Doing so exposes your public keys, allowing an attacker to craft a Replace-By-Fee (RBF) transaction with a higher fee and redirect your funds to their wallet. Instead, use Mara Slipstream to submit transactions directly to a large miner, keeping your wallet details private until confirmation.
Where to Run: Your Emergency Options
If you have a vulnerable Coldcard with a seed created without dice rolls and lacking a strong passphrase, move your funds immediately. Every minute increases exposure.
Where should you send your coins? If you own another hardware wallet from a different manufacturer, that’s your destination. Other options include a mobile wallet, a reputable exchange, or a Coldcard with a new seed generated using dice rolls. Alternatively, you can add a strong passphrase to your existing seed — but this emergency passphrase must have the strength of at least six random BIP39 words from the official word list. Anything weaker offers insufficient protection against determined attackers.
Contact anyone you know who uses Coldcard. This isn’t the time for polite waiting. Speed matters.
The AI That Found What Humans Missed
The Coldcard exploit was discovered mere days after the launch of Kimi K3, Moonshot AI’s latest large language model. According to reports, Kimi K3 was the only LLM capable of identifying this bug when presented with the relevant source code. Other models with stricter “cyber guardrails” refused to analyze the code or missed the vulnerability entirely.
A large group of Bitcoin developers is now auditing wallet code using Kimi K3. Bitcoin users are donating AI credits to support these large-scale code reviews. The impact extends beyond Coldcard. A critical vulnerability has already been found in Bitkey during these AI-assisted audits. The expectation is that this Bitkey flaw will be patched before causing real-world damage.
More vulnerabilities are expected in the coming days as additional wallet code is analyzed. Don’t be surprised when more bugs surface in wallet software over the coming weeks. The difference now? These discoveries will likely happen before exploits do, giving developers time to patch before users get hurt. Stay on top of updates and never transact with outdated wallet software.
The New Security Landscape
This incident marks a paradigm shift. AI-assisted code auditing is no longer theoretical — it’s actively dissecting Bitcoin infrastructure and finding flaws that survived years of human review. The broader implication reaches far beyond cryptocurrency. AI-assisted code auditing could significantly affect the security of other critical systems across society.
If you generated a Coldcard seed using native setup between March 2021 and now, without dice rolls or a strong passphrase, your bitcoin is at risk. Move it today. Not tomorrow. Not after breakfast. Today. Because while you’re reading this, attackers are still sweeping, and they’ve only just begun working through the 4.2 billion possibilities.