Coldcard's Entropy Betrayal: How a Software PRNG Unlocked $130 Million in Bitcoin

Fifteen attackers. Seventy-three confirmed victims. More than seven thousand exposed wallets. One hundred thirty million dollars in Bitcoin. The numbers have already moved since Galaxy Research published its tracking data, and they will keep moving. That's the defining feature of this event: it's not a post-mortem. It's a live drain. The first thefts happened hours before Coinkite's advisory went out. That timing isn't a coincidence. It's a forensic signature. Attackers scanned the Bitcoin blockchain, matched public keys to a low-entropy private-key space, and drained funds before the vendor could warn anyone. Coinkite's co-founder Rodolfo Novak published a public apology. Law enforcement agencies in multiple jurisdictions opened investigations. The hotfix shipped. The thefts continue. Galaxy has tracked at least fifteen distinct attackers, and the count is climbing. Coinkite's warning remains categorical: the threat is still active. Coldcard is not a consumer gadget. It's the security anchor of the most paranoid segment of the Bitcoin ecosystem. The buyers are the people who run their own nodes, engrave seed phrases into titanium plates, and treat exchange custody as a moral failure. The product's entire thesis rested on a single promise: this device generates keys with true hardware entropy inside a physically isolated environment, and that entropy is what makes self-custody safer than any alternative. That thesis collapsed overnight. The root cause is embarrassingly simple. Affected firmware routed seed generation through MicroPython's software pseudo-random number generator instead of the hardware true-random source. That's not a cryptographic break. It's an implementation regression. Mk2 and Mk3 units produced seeds with roughly 40 bits of entropy. Mk4 reached about 72 bits. The industry security target is 128 bits. Forty bits isn't slightly below spec; it's a rounding error against any adversary with GPUs. 2^40 represents about 1.1 trillion combinations. Modern cracking rigs push billions of guesses per second, which dissolves that search space in hours. Seventy-two bits is harder — roughly 4.7 quintillion possibilities — but still far below the threshold a professional hardware wallet should guarantee. The attacker doesn't need to break every wallet. Just the ones still holding money. There's a practical nuance about Bitcoin's address formats that matters here. Legacy and SegWit outputs expose only a hash of the public key — HASH160 — until the address first spends. That doesn't help. The attacker enumerates candidate private keys from the low-entropy space, derives each public key, hashes it, and compares against the entire address database. SHA256 and RIPEMD160 are cheap to compute in bulk. Taproot outputs are even more exposed: the scriptPubKey contains the tweaked public key directly. Bitcoin's transparency — the property that makes it a trustworthy ledger — is precisely what gives the attacker a free target list. The asymmetry is what makes this attack economically irrational to defend against. Bitcoin's ledger is public. Every public key is visible on-chain. An attacker generates candidate private keys from the low-entropy space, derives their corresponding public keys, and joins the two datasets. No physical access to the hardware. No malware on the user's machine. No supply-chain interception. Just arithmetic applied to public data. The cost of attack is a handful of GPU-days. The return is millions of dollars. With economics like that, the real surprise isn't that fifteen attackers showed up. It's that more haven't joined. This is a failure pattern I've seen before under a different label. In 2024, I spent three weeks penetration-testing an MPC custody architecture for a Shanghai-based institutional fund. The first boundary we probed wasn't the signing protocol. It was the entropy source. You can audit every signature scheme, every multiparty computation, every secure enclave — and if the random seed feeding key generation is weak, all of that becomes ornamental. Coldcard's case is the same principle in different packaging. The downstream cryptography was fine. The upstream randomness was broken. Institutional security frameworks treat this as a foundational axiom; the hardware wallet industry apparently didn't. Most commentary will miss the deeper architectural concern. A fallback to a software PRNG doesn't happen by accident. It implies the hardware TRNG was either never correctly integrated into the firmware path, or it was bypassed by a lazy abstraction that selected convenience over security. The device silently used a weaker entropy source without any user-visible indication. That's not a one-line bug. It's a separation failure between the hardware security layer and the application layer. Coldcard's firmware now needs a structural review — a full audit of every entropy consumer and boot path — not just a corrected seed-generation routine. Coinkite's response timeline matters, and it contains the most dangerous piece of this incident. The hotfix prevents newly generated seeds from inheriting the weak entropy. It does nothing for seeds already created. The company stated explicitly: updating firmware cannot fix wallets generated by the affected software versions. The only remediation is migrating funds to a new wallet with properly generated entropy. A user who read the advisory, applied the hotfix, and concluded their funds were safe — is wrong. The patch protects the future. The existing seeds remain exposed, and the clock resets for every new attacker joining the operation. The migration burden falls hardest on exactly the demographic least equipped to move quickly. Coldcard's core users are long-term holders. Many haven't touched their devices in years. Some don't remember where their wallet files live. Galaxy Research has received 73 victim reports and estimates the actual figure could reach into the thousands. That gap — between confirmed victims and exposed wallets — is the single most volatile statistic in this story. Every day of inaction shrinks the window for remediation. The 'update your firmware' messaging, while technically accurate, creates a false sense of safety that will cost more users money. Migration itself carries operational risk. Users who rush can make fatal mistakes: typing addresses manually, clicking phishing links that mimic wallet tools, or generating replacement seeds on a compromised computer. The safe path is mechanical. Obtain a new hardware device from the manufacturer's official channel. Verify its authenticity. Generate a fresh seed. Record it offline. Send a small test transaction. Confirm settlement. Then move the full balance. None of that is intuitive. It must be written down and followed exactly. In my institutional work, we rehearsed these migrations under time pressure before the real event. Individual users get one shot. Now the contrarian angle, because the obvious lesson is the wrong one. The expected reaction: move to regulated custody. That conclusion inverts reality. The Bitcoin chain performed exactly as designed. The signature schemes held. The failure was confined to a single vendor's firmware implementation. The lesson isn't that self-custody is broken. It's that self-custody depends on a manufacturing and firmware supply chain that has been treated as a black box. And the custody alternative doesn't escape the problem; it relocates it. Every custodian ultimately relies on hardware to generate entropy — inside HSMs, key management servers, and cloud providers. You're not eliminating trust. You're just trading one trust anchor for another. Traditional finance learned this lesson the expensive way. FIPS 140-2 and Common Criteria certifications require entropy sources to be tested, monitored, and documented on a schedule. Institutions don't assume a random number generator works; they audit it. Coldcard's users had no way to verify it. That verification gap is the actual systemic vulnerability. The second blind spot is the 90% of stolen funds that have barely moved. The superficial reading: patience. Attackers waiting for deeper liquidity or cleaner laundering channels. There's a more disciplined possibility. The attackers know their wallets are tagged. Every blockchain surveillance desk on the planet has them watchlisted. Moving those coins through a compliant exchange would trigger AML freezes and expose operators to tracing. So the funds sit. That's not a market stability problem — $130 million is noise against Bitcoin's daily volume — but it's a legal and reputational time bomb. If those coins ever surface at a regulated venue, the damage to the hardware wallet category's 'security narrative' extends far beyond the initial theft. There's also a competitive dimension that pricing hasn't absorbed. Ledger and Trezor will spend the next quarter advertising certified TRNG chips. That's marketing, not security. The chip was never the weak link. The firmware path that called it — or failed to call it — was. A secure element certification doesn't validate the code that decides when to use the secure element. The industry's actual response needs to be auditable entropy handling: on-device logs for every seed generation, verifiable by users and independent auditors. That capability doesn't exist across the market today. It's not a product feature; it's a missing safety regulation. What happens next depends on whether the ecosystem treats this as a vendor incident or a category lesson. If the former, Coinkite bleeds users and nothing changes systemically. If the latter, hardware wallet design will be forced to expose entropy sources to public scrutiny. Devices will need to prove randomness rather than claim it. Class-action litigation and regulatory attention will accelerate that shift. Coinkite has already conceded the core technical fact. The industry hasn't yet processed the implications. The market will price this in slowly. Bitcoin's price barely reacts to $130 million in theft. But the pricing of trust — which custodian to use, which device to buy, which protocol to rely on — recalibrates around events like this. And that recalibration tends to overshoot. The chain didn't fail. The private key did. The math didn't lie; the random number generator did. A patch stops new infections; it never cures the exposed ones. The next generation of hardware wallets will be defined not by which chip they embed, but by whether their entropy path can survive a forensic audit. Ask your wallet vendor whether they can prove their randomness. The answer will tell you something. Fifteen attackers now. If the industry treats this as a one-off, the next low-entropy batch won't be measured in hundreds of millions. It will be measured in billions. Are you sure your seed can't be guessed?