Coldcard Users Urged to Migrate Seeds After $88 Million Bitcoin Theft

The security flaw, identified by Block’s engineering team, stems from a firmware integration error that caused affected devices to utilize a deterministic MicroPython fallback rather than the intended hardware random-number generator. This failure effectively stripped the seed creation process of necessary cryptographic entropy. While Coinkite has released firmware patches to rectify the generation process for new wallets, the manufacturer confirmed that updates cannot retroactively secure existing, compromised seeds.

Galaxy Research reported three distinct attack waves, noting a shift in tactics from targeting large holdings to sweeping smaller wallets. Investigators found that 4,585 addresses were compromised, with the attackers successfully reproducing weak private keys offline. Because the vulnerability lies within the third-party firmware rather than the Bitcoin protocol itself, the transactions appeared legitimate on-chain, complicating recovery efforts. Coinkite maintains that users who incorporated at least 50 independent dice rolls during seed creation may possess sufficient entropy, though the company generally recommends a full migration for all users of the affected firmware versions, which include models from the Mk2, Mk3, Mk4, and Mk5 series.