An attacker drained 1,196 Bitcoin addresses in 41 minutes, stealing $70.2 million. Galaxy Research traced it to a Coldcard firmware flaw from 2021 that compromised seed generation.
On July 30, something went very wrong in the world of Bitcoin. An attacker swept through 1,196 separate addresses in just 41 minutes, walking away with 1,082.65 BTC. At the time, that was worth roughly $70.2 million. Galaxy Research, a blockchain intelligence firm, traced the entire sweep and pinned the blame on a firmware flaw in Coldcard, the Bitcoin-only hardware wallet made by Canadian company Coinkite.
That's a lot of money to vanish in less than an hour. But the scariest part isn't the scale of the theft. It's how it happened. The attack didn't rely on someone physically stealing a device or guessing a password. It came down to a quiet software error that had been sitting there for years.
### The Root Cause: A Seed Generation Slip-Up
The problem traces back to a firmware integration error from March 2021. When Coldcard integrated a new software library, something went sideways. Instead of routing seed generation through the hardware's secure random number generator, the device fell back to a deterministic software pseudorandom number generator (PRNG).
If that sounds technical, here's the plain-English version. A hardware wallet's entire job is to create a seed phrase using true randomness. That seed becomes the master key to your funds. If the randomness is predictable, the keys become predictable too. And predictable keys are basically an open door for anyone who knows how to look.
### Why Deterministic PRNG Is So Dangerous
A deterministic PRNG doesn't generate true randomness. It starts from a known state and follows a fixed sequence. If an attacker can figure out the starting point, they can reproduce every key the device ever generated. It's like giving someone the master blueprint to your safe.
In this case, the attacker didn't need physical access to a single Coldcard. They just needed to identify which addresses were generated using the flawed firmware and then calculate the corresponding private keys. The 41-minute sweep suggests they had already done the math ahead of time. The actual theft was just the execution.
### What This Means for Coldcard Users
If you own a Coldcard, you're probably wondering if your funds are at risk. Here's what you should know:
- The flaw affects devices that generated seeds during a specific window after the March 2021 firmware update.
- Coldcard has released patches to address the issue, but any seed created during that vulnerable period could still be compromised.
- If you're not sure when your seed was generated, the safest move is to create a new wallet and transfer your funds immediately.
Galaxy Research's report doesn't name specific firmware versions in the public summary, but Coinkite has been transparent about the timeline. The company has also pushed out warnings to users who might have been affected.
### The Bigger Lesson: Hardware Wallets Aren't Magic
Here's the uncomfortable truth. Hardware wallets are supposed to be the gold standard for crypto security. They keep your private keys offline, away from hackers and malware. But this incident shows that even the best hardware can be undermined by a software bug.
A hardware wallet is only as strong as the code running on it. If that code has a flaw, the physical security becomes irrelevant. The attacker never touched a single device. They just exploited a weakness in the firmware's logic.
For everyday users, the takeaway is simple. Don't assume your hardware wallet is bulletproof. Keep your firmware updated. And if you ever hear about a vulnerability, don't wait for the official announcement. Move your funds first, ask questions later.
### A Quick Word on Randomness
Cryptography runs on randomness. True randomness is hard to achieve in a computer because computers are, by nature, deterministic machines. That's why hardware wallets use physical sensors or other entropy sources to generate seeds. When that process gets bypassed, even for a single update cycle, the entire security model collapses.
This case should be a wake-up call for the whole industry. One bad integration, one overlooked function, and years of trust can evaporate in 41 minutes. The $70.2 million is gone, but the lesson is still here for anyone willing to learn it. Check your devices. Update your firmware. And never assume your crypto is safe just because it's on a piece of hardware.
