15 Attackers Are Draining $130M in Coldcard Wallets — Coinkite's Hotfix Cannot Save the Seed

15 attackers yesterday. More today. The count is climbing as a wave of low-entropy Coldcard wallets gets pillaged on-chain. Liquidity gone. Run. Galaxy Research has now connected the dots: over 7,300 wallets, more than $130 million in bitcoin, and a private-key weakness that exposes users to brute-force attacks. Trust bridge crossed. Crash imminent. Coinkite has pushed a firmware hotfix, but the company was blunt about its limits: updating firmware cannot repair seeds generated by vulnerable firmware. Those seeds are permanently weak. Anyone with a GPU and a blockchain explorer can join the hunt. Some already have. Coldcard is not a beginner's toy. It's the bare-metal hardware wallet from Coinkite, built for bitcoin users who want maximal distance from connected devices and cloud infrastructure. It has no Bluetooth. No camera. The whole design philosophy is "leave no attack surface." For years, it carried a reputation as one of the most secure ways to store bitcoin you actually control. This incident strikes at the heart of that reputation. Floor price broken. Truth verified. The vulnerable devices span the Coldcard Mk2, Mk3, and Mk4. During firmware-based seed generation, the code routed entropy through MicroPython's software PRNG instead of a true random source. The result is not a subtle edge case; it's a catastrophic drop in entropy. The Mk2 and Mk3 produce roughly 40 bits of entropy. The Mk4 reaches roughly 72 bits. Industry best practice expects at least 128 bits, and bitcoin's own private keys ideally use the full 256-bit curve. There's a deeper architectural problem hidden here. MicroPython is common in embedded prototyping, but its random module was never built for cryptographic key generation. A hardware wallet carries a secure element precisely because it has a real random number generator. The firmware should have used that hardware TRNG, and if it failed, it should have stopped the boot process. Instead, the code silently fell back to a software PRNG and continued exactly as if nothing were wrong. That is not a random bug; it is a failure of design. Coinkite may need to rebuild its firmware trust layer, not just release a patch. Coinkite's co-founder Rodolfo Novak apologized publicly and urged users to take immediate action. But the apology cannot add randomness to a key that was born weak. Let's translate those numbers into plain language. A 40-bit key space contains about 1.1 trillion possibilities. That is small enough for serious brute-force work on modern hardware. The 72-bit range on Mk4 wallets is harder, but still far below the 128-bit threshold that cryptographic security guides treat as the absolute floor. Any key generated by the affected firmware is a lottery ticket waiting to be matched. The attacker doesn't need to know which wallets are weak. They only need to scan bitcoin's public ledger and test the keys that circulate there. The entry barrier is terrifyingly low. Most large-scale attacks require insider access, stolen credentials, or expensive zero-day exploits. This one only requires the ability to read the blockchain and enough compute to check probable keys. The first wave of thefts happened hours before Coinkite's public announcement. Attackers are already expanding. And the wider the pool of vulnerable wallets, the more attackers want to join. It is like a bank vault with its combination written on a public wall. Everyone is trying the door. That changes how I read this event. I've written about wallet thefts before, but the typical hack is personal: a compromised computer, a phishing seed, a SIM swap. This one is industrial. Multiple attackers are scanning the same public dataset, comparing the exposed addresses against the low-entropy key space. When a match hits, the balance is drained in minutes. Bitcoin's base layer doesn't ask whether the private key was generated with enough randomness. It only checks the math. Weak math looks exactly like strong math until the moment someone else produces the same signature. Galaxy's findings should be read as a floor, not a ceiling. Researchers have collected reports from 73 victims, but the report stresses that the real number could be in the thousands. Many long-term holders haven't moved their funds in years, and some may not even know their device generation uses vulnerable firmware. The $130 million estimate covers the sampled wallets, not every risky wallet in the wild. The public nature of the attack means the cost function is simple: no need to contact the owner, hack a server, or pass any KYC. Just find a weak key and move what sits behind it. This is where my own audit instincts kick in. Back in 2021, I spent two days alongside a small developer team checking suspicious wallet clusters around NFT mints. We wrote a Python script that flagged wash-trading patterns and unusual address groupings, processing over 12,000 transactions in 48 hours. That experience taught me one lesson: when attackers scan for weak signals, they move faster than the communities they target. The same pattern appears here. The gap between discovery and exploitation is shrinking. The hotfix makes the situation even more confusing for ordinary users. Updating the firmware changes how new seeds are generated. It does not change the math on seeds already in use. If you take an old, weak seed and type it into a device running the latest firmware, you are still holding a weak seed. The only correct move is to create a completely fresh seed on secured firmware, send a small test transaction, verify it, and then transfer the remaining balance. And even that migration is stressful, because the signature you create with a weak key is another data point the attacker can check. The hardware security industry has spent a decade telling users that self-custody means the only key is the one in your hand. That story depends on every key being random enough. This bug does not destroy the whole narrative, but it exposes a blind spot in the hardware layer. If the firmware governing a secure element can silently fall back to a software PRNG, then a device can look exactly like a fortress while leaking the equivalent of the vault code. Here's what the market is missing. Only about 10% of the stolen bitcoin has moved so far. Most observers read that as a sign of limited impact. I read it differently. The attackers holding 90% of the haul are not stuck; they are waiting. Moving a large stack of bitcoin immediately would create a traceable path for exchanges, law enforcement, and chain analysts. Keeping it dormant buys time, builds distance, and lets market depth recover. This is not a fading event. It's a reserve for future liquidation. That means the real price impact isn't visible in today's order books. It is lurking in the balance sheets of anonymous thieves. The sum is small relative to bitcoin's daily volume, but the psychological effect on self-custody is larger than the dollar figure. When the community's most security-conscious users get drained because a hardware manufacturer chose a software fallback, the phrase "not your keys, not your coins" gains a new subtitle: "even your keys are only as safe as the randomness that created them." There's a temptation to answer this by telling users to move their money onto exchanges. I understand the urge. Custodians have engineers, monitoring, and insurance. But in a bull market, that same custodial comfort is also a magnet for centralized risk. Shifting self-custody failures into exchange custody does not eliminate the underlying problem; it just moves the trust boundary. That is why the next step should be better verification, not a retreat from ownership. The transparency that defines bitcoin works for the good guys and the bad guys. The same public ledger that lets analysts track these wallets is what lets attackers scan for weak keys in the first place. That paradox is uncomfortable, and I don't expect it to be solved by a firmware patch. One more warning before the practical part. Crisis events like this always spawn second-layer scams. In 2022, after the Terra collapse, I coordinated with 15 other journalists to publish a red-flag list of fraudulent recovery tokens. The same pattern is probably forming now. Anyone who claims they can recover your stolen keys, "re-randomize" your wallet, or retrieve your balance for a fee is lying. If they could access the key, they would not need to announce it in a Telegram chat. Your only path forward is generation, migration, and verification. Do not wait for a complete incident report. If you have ever used a Coldcard Mk2, Mk3, or Mk4, assume nothing. Export nothing that connects to old seeds. Generate a new seed on updated firmware, send a small test transaction, verify the destination, then move the balance. The salvage window is real. Data checked. Community warned. The next test is not whether Coinkite improves the next firmware release. It is whether the industry can admit that a hardware wallet is not an end stop; it is one link in a chain of randomness, verification, and custody. Watch the dormant wallets. Watch for a second wave. And keep asking who else is scanning the same ledger.