A code flaw in Coldcard's hardware wallet has been pointed out in recent days as being linked to the large-scale theft of bitcoin. CoinDesk reported that Galaxy Research estimated that the attackers had stolen 1,596 bitcoins from approximately 7,300 addresses, over $100 million at the time of the incident.
This incident was cause for concern because Coldcard had been using offline signatures and open source codes as a selling point. Several users believe that even if the equipment is never connected and the notes are kept separately, the funds may be exposed to deficiencies in the seed chain.
More than a thousand bitcoins were affected.
According to reports, one of the victims, Jonathan Goodman, stated that he had lost all his wallet assets on 29 July, totalling 18.25 bitcoin, valued at approximately $1.17 million. On 4 August, Alex Thorn, Director of Galaxy Research Research, stated that at least 15 attackers were taking advantage of this defect and did not need to have access to the user device.
The security of the hardware wallet is premised on the fact that the private key or assistive word generation process is sufficiently random and that the secret does not leave the chip. If randomness is not sufficient, the attackers may narrow the range of guesses and volume out wallet seeds.
The problem is the random source of the seeds.
The report notes that the loophole is not in the Coldcard offline signing process itself, but is generated by random numbers when a wallet is created. Coldcard should have called the hardware random generator that is built in the device, but a configuration error led the system to use a weaker random source of software.
This source of software relies on inputs such as equipment information and time data, and is significantly less random than a dedicated hardware programme. As a result, the seed space that should have been almost impossible to run has been significantly reduced, and the attackers can try and restore wallet seeds in a smaller range.
The leak is said to have entered the system after a 2021 code change.
CoinDesk, citing the Bitcoin developer James O'Beirne, argues that the problem may have occurred after a large-scale rewriting of Coldcard 2021. Coninkite published version 4.0.0, called "New Code" and introduced a new source bank libngu.
O'Beirne states that he questioned the random number generation process when he audited the code in May 2025 and provided feedback on potential deficiencies to Coinkite. It was reported that the company had responded that if the problem existed, it would have been discovered in theory.
The researchers then continued to track the code path, arguing that Coldcard had a software communication error while reading the settings, leading to the continued call of weaker random sources that should have been closed. Because of the disclosure of the Coldcard code, this event also rekindled the market's discussion of “the open source is not as audited”.
In terms of industry impact, the incident weakened users' perception of the “naturally isolated network risk” of the hardware wallet. Even if the equipment remains offline, if the key generation chain is defective, the attackers may launch an attack without contact with the equipment.