How a 2021 Firmware Bug Broke Bitcoin's Best-Known Cold Wallet and What it Means for the Future of Self Custody
Key takeaways A firmware regression introduced in March 2021 caused Coldcard hardware wallets to generate seed phrases using a predictable software fallback instead of the device's hardware random number generator, collapsing effective entropy to roughly 40 bits on Mk2 and Mk3 devices and about 72 bits on Mk4, Mk5 and Q, against an intended 128. Attackers reconstructed the resulting keys entirely offline, draining over 1,500 BTC across multiple waves beginning July 30, 2026. Updating firmware do