ColdCard PRNG flaw: how a firmware bug led to a $70 million Bitcoin heist in 41 minutes

> In short: A firmware integration error introduced in March 2021 routed ColdCard's seed generation to a deterministic software pseudorandom number generator (PRNG) instead of the STM32 hardware random number generator (RNG). On July 30, 2026, an attacker exploited this to sweep 1,082.65 BTC (~$70 million) from 1,196 addresses in 41 minutes. Galaxy Research mapped the sweep. Coinkite shipped emergency firmware on July 31 for every affected model — but installing it does not repair an already-generated weak seed.

Why this matters to you

You probably don't sell hardware wallets. But this story is the cleanest 2026 illustration of a failure class that affects every SaaS product that generates secrets: the difference between a cryptographic random source and a deterministic one is the difference between a secret and a public value. The ColdCard bug is, at its root, the same class of flaw as using Math.random() for session tokens, seeding a PRNG from a predictable clock, or generating API keys from a non-CSPRNG. The SaaS version just doesn't make headlines because the theft is quieter.

If your product generates any kind of secret — API keys, session tokens, password reset links, signing keys — this case is your cautionary tale.

The flaw in two sentences

ColdCard is a Bitcoin-only hardware wallet made by Canadian firm Coinkite. It uses an STM32 microcontroller with a dedicated hardware RNG. In March 2021, a firmware integration error caused the seed-generation code path to call a deterministic software PRNG instead of the hardware RNG. The software PRNG's output could be reproduced offline if the attacker could determine or sufficiently constrain three values: the device UID, the timer state at generation time, and the prior RNG-call history.

Block (formerly Blockstream) demonstrated that candidate seeds can be generated offline and then checked by deriving their Bitcoin addresses and comparing them against public blockchain data. You don't need the physical device — you need the parameters that fed the PRNG, and then you can brute-force candidate seeds and check them against the public ledger.

The 41-minute sweep

On July 30, 2026, an attacker who had pre-computed vulnerable seeds drained 1,196 Bitcoin addresses in 41 minutes, taking 1,082.65 BTC. Galaxy Research mapped the transactions and tied them to the ColdCard PRNG flaw. The speed (41 minutes) indicates the attacker had done the offline computation in advance — the addresses were already identified, and the sweep was just execution.

This is the worst-case scenario for a seed-generation flaw: the attacker doesn't need to interact with any victim, doesn't need network access to the wallet, and doesn't leave a trace on the device. The funds simply move.

The response

Coinkite shipped emergency firmware on July 31 for every affected model and release track. But the critical detail: installing the patched firmware does not repair an existing seed. A seed generated on a vulnerable firmware version remains weak for the lifetime of that wallet. Coinkite tells affected owners to generate a new seed on patched firmware and migrate their funds.

The window of vulnerability is enormous: March 2021 to July 2026 — over five years of seeds generated on affected firmware versions.

The lesson for SaaS vendors

Three principles, directly portable from this case:

The broader pattern

ColdCard's PRNG flaw joins a lineage of randomness failures — from Debian OpenSSL (CVE-2008-0166, 2008) to the Android Secure Random vulnerability (2013) to Kubernetes API server predictable tokens. In every case, the code looked correct but silently used a non-critical entropy source. The defense is the same across all of them: verify your RNG, test the output, and rotate secrets when you discover the gap.