The attack took 25 minutes. Five hundred wallets. Nearly 594 Bitcoin — roughly $38 million — moved in a scripted, automated sweep that looked less like a hack and more like a vendor reconciliation. No fumbling. No hesitation. The attacker executed a pre-computed target list with the bureaucratic calm of someone running payroll.
That should terrify you more than the headline number.
I've been covering this industry since the noise of 2017, when I was parsing 45+ ICO whitepapers in parallel, watching projects die under their own weight, and learning the difference between a security incident and a security collapse. Coldcard is the latter. This isn't a bridge exploit or a leaked seed phrase. It's a systematic failure inside the one device category we collectively designated as untouchable: the open-source hardware wallet.
Coldcard was supposed to be the last clean room in Bitcoin. The open-source purist's device. The "if you can audit it, you can trust it" standard-bearer. That thesis just died in 25 minutes.
The ledger does not lie, but it rewards patience. This bug was patient for five years.
Context
Let's get the facts in order before we reach the uncomfortable parts. Coinkite, Coldcard's manufacturer, confirmed that Mk3 seed generation could produce non-random output. Block's Max Guise independently traced the root cause. Bitcoin Core developer Gregory Sanders reproduced the full attack. Affected UTXOs span from 2021 through 2026. And the initial impact assessment was wrong.
Here is the technical chain, stripped of unnecessary noise:
Coldcard firmware is supposed to draw entropy from the STM32 microcontroller's hardware true random number generator (TRNG). A compile-time check exists to verify that the RNG is functional before the firmware depends on it. That check was written incorrectly. Instead of using #if to evaluate the macro's value, the code used #ifdef to test only whether the macro was defined. So when MICROPY_HW_ENABLE_RNG was set to zero — RNG explicitly disabled — the check still passed.
The firmware proceeded anyway. At runtime, it silently fell back to MicroPython's built-in Yasmarang pseudo-random number generator.
Yasmarang is not cryptographically secure. Its internal state is small. Its output can be reconstructed from predictable inputs — including, as Sanders demonstrated, the number of times the user pressed the setup button during device initialization.
Think about that. A button counter became the root of a private key. The entire "cold storage" security model for a generation of Bitcoin holders was reduced to a tap count.
Core: The Attack Mechanics
Sanders' reproduction is the key artifact. He didn't speculate. He ran the exploit: press count as seed, Yasmarang as the generator, output keys mapped to known Coldcard-generated addresses. It worked.
This explains the 25-minute timeline perfectly. The attacker was not sitting at a terminal generating keys in real time. They pre-computed private keys offline, scanned the Bitcoin blockchain for addresses matching the low-entropy pattern, built a target list of about 500 wallets, and executed a batch transfer script. Five hundred addresses in 1,500 seconds. Three seconds per wallet. That's not hacking. That's invoice processing.
Now, the market-level analysis, because I know what everyone is asking: is this a Bitcoin price event?
The answer is no. The ledger, as always, tells a quieter story. 594 BTC is roughly 0.0003% of circulating supply. And 562 of those coins — about $36 million — were still sitting unmoved in the attacker's address at the time of reporting. Even a full liquidation would be a rounding error against the market's daily volume. The token-level impact is not the story.
The structural impact is.
Five hundred single-signature addresses, many dormant for years, were wiped in one operation. These were not active traders. These were the cold-storage-only crowd — the people who did everything right. They bought a dedicated hardware device. They generated keys offline. They hid their seed phrases in multiple locations. They waited.
And the device betrayed them.
This is where the vendor's response matters. Coinkite initially stated that only the Mk3 was affected. Block's Max Guise found the same defect across Mk2, Mk3, Mk4, and Mk5. Sanders confirmed Mk2/Mk3 and then flagged Mk4 as potentially exposed. The manufacturer's own understanding of its product line's blast radius was inferior to an external analyst's independent review.
Let me be direct: if Coinkite didn't know which of its own devices were shipping with a compromised RNG path, then the entire internal testing apparatus — the CI/CD pipelines, the QA gates, the "audited by the community" claims — deserves a hard re-examination.
I've done enough security post-mortems in this market to recognize a pattern: the first number a vendor releases is almost always wrong, and it's almost always too small. The difference here is that the correction arrived within days, not weeks, and it came from outside the company.
One more technical point buried in the reporting deserves emphasis: the exposure window is not closed. The affected firmware shipped across multiple hardware generations. Users who have not migrated funds or updated their devices remain theoretically exposed. The attacker's pre-computed address list may not be exhausted. Whether the remaining 562 BTC move tomorrow or next year, the operational lesson is identical: the gap between vulnerability introduction and vulnerability remediation was measured in years.
Core: The Ecosystem Shockwave
The competitive landscape is the under-told part of this story. Coldcard occupies a specific niche: Bitcoin maxi-hardened, privacy-respecting cold storage. Its users are not casual market participants. They are the most security-conscious cohort in crypto. When that cohort loses faith, the damage ripples outward.
Expect migration pressure. Some of that flow will move to Ledger, though Ledger carries its own recovery-service baggage. Some will move to Trezor and other legacy brands. A meaningful slice may retreat into more exotic setups — multisig, air-gapped machines, or paper wallets generated by verified entropy sources.
But the broader casualty is the narrative itself. "Hardware wallet" was shorthand for "secure by construction." This event converts that shorthand into a question. If a five-year-old compile-time typo in an open-source firmware can produce thousands of enumerable private keys, then the entire category's safety assumption is now a due-diligence item rather than a given.
The ecosystem response, to be fair, was exemplary. Coinkite confirmed within hours. Block performed independent forensic analysis. Bitcoin Core developers reproduced the exploit and pushed warnings. This is the crypto community's unique strength: multi-party verification under stress. But it came with a cost — contradictory initial assessments created exactly the kind of confusion that lets incomplete information harden into panic.
Core: The AI Asymmetry
Now the AI question, and I'll handle it with the skepticism it requires.
Coinkite speculated that the attacker "may have used AI." That's an inference, not evidence. Meanwhile, a researcher named DeLorme claimed to have discovered the vulnerability after the fact using Claude Opus 5 against a cloned repository. No third party has verified that claim. Both statements should be treated as unconfirmed.
But the underlying shift is real, and this is the insight most coverage is missing: the cost curve of vulnerability discovery in public code has bent sharply downward. Whether or not AI was used in this specific theft, the existence of capable model-assisted code analysis means that every open-source firmware repository is now a target-rich environment for automated exploitation.
The asymmetry is the real story. Attackers can run thousands of AI-assisted audit iterations on public firmware and keep only the results that matter. Defenders, by and large, are still relying on volunteer reviewers and periodic paid audits. Speed runs require foresight, not just reaction — and right now, the attackers are the ones displaying foresight.
Contrarian: The Unreported Angles
Here's what the vendor post-mortem won't tell you.
First, the open-source community audit model has failed — not partially, but structurally. This was a low-complexity bug. Any competent C developer could identify it in minutes. Yet it survived five years of public code, community scrutiny, and multiple product releases. "Source available" is not a security posture. It's a display case. Without systematic, professional, continuous auditing, open source is just a way to show your enemies exactly where to look.
Second, the 500 wallets are a floor, not a ceiling. If the Yasmarang seed space is as low-entropy as the reproduction suggests, then every private key generated by affected firmware — across all devices, all years, all users — lives in an enumerable keyspace. The attacker identified and drained 500 addresses. There may be thousands more sitting in wallets whose owners haven't checked. The existing UTXO set from 2021 to 2026 is a waiting list.
Third, the victim profile deserves attention. Five hundred dormant, single-signature addresses, generated over years, all swept in one automated operation. That pattern is not typical of scattered retail hobbyists. It suggests batch generation — small funds, mining operations, or institutional custody reserves. If institutional holders are among the victims, they are likely silent about it. And silence is how the next wave of exposure happens.
The ledger does not lie, but it rewards patience. The full accounting of this event is far from complete.
Takeaway
So what now?
Every hardware wallet manufacturer using open-source firmware frameworks needs to audit its RNG fallback paths today. Not next quarter. Today. If Coldcard's compile-time check could be wrong, the assumption that competitors are immune is not diligence — it's denial.
The industry's trust model needs to change. The standard must move from "code is public" to "security is independently, continuously, and professionally verified." The era of the benevolent hobbyist auditor is over. The stakes are too high, and the tools of offense — including AI-assisted discovery — have outrun the tools of volunteer defense.
And for the self-custody maximalist reading this: your trust in open source is necessary but not sufficient. You can read the code. But can you verify the behavior? Can you prove the randomness is real? Can you distinguish between "the code is visible" and "the code is secure"?
From the noise of 2017 to the signal of today, Bitcoin has survived exchange collapses, protocol hacks, and regulatory wars. It will survive this. But the era of assumed hardware trust is over. Every wallet is a due-diligence project now.
Speed runs require foresight, not just reaction. The attackers are already showing it. The question is whether the defenders can learn that lesson before the next 25-minute window opens.
