How the $89M Cold Wallet Hack Reconstructed Bitcoin Seed Phrases

**SPEAKER_1** (0:00)
Welcome back to the Daily Crypto Deep Dive. Imagine buying a specialist Bitcoin hardware wallet, generating your recovery phrase entirely offline, writing it down by hand, and then locking the device away without ever exposing it to the internet. You follow the rules. You avoid phishing links. You never type the recovery phrase into a computer. Nobody steals the physical device. Then, years later, somebody on the other side of the world reconstructs your private keys and empties the wallet anyway.
That is the nightmare now facing thousands of Coldcard owners after a firmware defect appears to have reduced the randomness protecting their Bitcoin wallets. As of Sunday, August 2nd, Galaxy Research has linked three separate waves of suspicious transactions to the vulnerability, involving approximately 1,367 Bitcoin worth nearly $89 million across 4,585 addresses. This is not simply another phishing scam, exchange collapse or smart contract exploit. The attacker did not necessarily need access to the victim's computers, recovery phrases or physical hardware wallets. The weakness appears to have existed from the moment certain wallets were created. Today, we are explaining exactly how the Coldcard vulnerability worked. How an attacker could potentially recreate supposedly secret recovery phrases. Whether this should have been discovered years ago, what the security experts are saying, which devices may be affected, and what this means for the future of Bitcoin self-custody. Before we begin, this episode is brought to you by Kraken.
Kraken provides access to Bitcoin, Ethereum, XRP and a wide selection of other digital assets. You can support the podcast by using our Kraken link when opening and funding an account. This is not financial advice, and cryptocurrency trading involves a risk of loss.
To understand this attack, we first need to understand what a hardware wallet actually protects. Your Bitcoin is not physically stored inside the device. The Bitcoin remains recorded on the blockchain. What the device protects is the private key that allows you to authorize transactions. When a new wallet is created, the device generates an enormous random number known as entropy.
That random number is converted into the 12 or 24 recovery words that you write down. With properly generated 128-bit entropy, there are approximately 340 undecillion possible combinations.
The number is so unimaginably large that trying every possibility should be functionally impossible. But the strength comes from the randomness, not from the words themselves. If the process creating those words is predictable, the enormous theoretical search space can collapse into something much smaller. That is what appears to have happened here. Coldcard devices contained a proper hardware-based true random number generator.
The problem was not that the necessary hardware was missing. The problem was that a firmware change introduced in March 2021 caused wallet creation to use a different function. Coldcard had moved some of its cryptographic operations to a library called LibNGU, which incorporates technology used by Bitcoin Core. During that integration, seed generation changed from Coldcard's established hardware randomness function to a function called ngu.random.bytes.
The system was supposed to connect that request to the hardware random number generator. Instead, because of how two software components were configured and linked together, it resolved to a deterministic fallback generator contained inside MicroPython. That fallback generator used information including the device's unique chip identifier and internal timing registers. Those values can vary, but they are not equivalent to strong cryptographic randomness. A chip identifier is fixed device information, and timing states may be estimated, constrained or systematically searched. Once the starting conditions and the number of previous random number calls are known or narrowed down sufficiently, the generator's output becomes reproducible.
Think of it like being told that somebody selected one number from an impossibly large universe. When in reality, they used a machine that always begins with its serial number and the time on its clock, you might not know the exact answer immediately, but you now have a pattern to investigate instead of infinity.
Block's Bitcoin engineering and security teams say the Mark II and Mark III versions on the vulnerable firmware path did not add cryptographically secure secret input to this generator. CoinKite, the company behind Coldcard, currently estimates that the infected Mark III seeds may have contained approximately 40 bits of effective entropy, rather than the intended 128 bits. 40 bits still represents roughly 1 trillion theoretical possibilities.
That sounds enormous, but it is dramatically below 128 bit security.
Once researchers or attackers can constrain device information, timing, call history and likely wallet behavior, the practical search may become manageable using specialized hardware and optimized software. The later Mark IV, Mark V and Q devices added entropy from secure elements during startup. So their situation is different and potentially more difficult to exploit. CoinKite estimates around 72 bits of effective entropy under its current assumptions. Blocks analysis is more cautious about reducing everything to one number. It says the later devices may have only 32 bits of securely distinguishing information once the predictable state and other conditions are fixed, but also stresses that the real attack cost depends on how much the attacker knows about the device, timing and previous generator activity. Block has not published a complete end-to-end brute force benchmark proving how quickly every affected wallet can be recovered.