Key Takeaways

• A firmware flaw in Coldcard Bitcoin hardware wallets weakened seed generation for years before it surfaced.
• On-chain researchers link the flaw to bitcoin sweeps worth tens of millions of US dollars.
• The root cause was a firmware error that bypassed the device’s dedicated hardware randomness source.
• Even trusted offline hardware can carry hidden software faults that only appear years later.
• Ainslie Crypto holds client assets in institutional-grade, professionally managed custody in Australia.

What happened

A firmware flaw in Coldcard hardware wallets has unsettled parts of the Bitcoin self-custody sector. Security researchers at Block, working alongside independent researchers, root-caused a vulnerability in the device’s firmware that weakened how wallet seeds were generated. Block published its technical advisory on 30 July 2026.

The problem traces back to firmware released on 17 March 2021 (version 4.0.0) for the Mk3, with the underlying code change dated 1 March 2021. Later models were affected differently. During seed generation, a configuration error meant the device could skip its dedicated hardware random number generator and fall back on a weaker software generator. Block’s analysis found the fallback was initialised from fixed device metadata and timer state rather than a genuine source of cryptographic randomness, which in some configurations made the output far more predictable than a properly generated seed should be.

How large are the losses

On-chain analysts have linked the flaw to a series of bitcoin sweeps. Galaxy Research mapped an initial sweep of 1,196 addresses on 30 July 2026 (about 1,082 BTC, roughly US$70 million at the time) and later identified further suspected waves, raising its observed estimate to around 1,367 BTC, worth about US$88.6 million, across roughly 4,585 addresses.

These figures come with an important caveat. Galaxy has stated it has not computationally confirmed that every affected address was generated with weak entropy, and it noted that an on-chain sweep “looks the same as if a coin owner chose to move coins.” The losses appear substantial, but the full scope is still being assessed.

Coinkite, the maker of Coldcard, shipped emergency firmware for affected models on 31 July 2026. Installing the update does not repair a seed that was already generated on vulnerable firmware. Owners with a potentially exposed seed are advised to generate a new one on patched firmware and move their coins.

What this means in practice

This was not a remote supply-chain hack or physical device theft. It is a reminder that even well-regarded hardware can carry subtle software flaws that only surface years later.

For the broader Bitcoin sector, the episode highlights ongoing tensions in self-custody. Tools like Coldcard have earned loyal followings for their focus on transparency and offline signing, yet this shows that no single solution is bulletproof. Many voices in the space now stress diversification: don’t rely on one seed or one vendor, combine methods where possible, and stay on top of firmware updates.

What it means for Ainslie Crypto clients

Ainslie Crypto holds client assets in professionally managed, institutional-grade custody based in Australia. Custody is built around segregated, air-gapped cold storage, hardware security modules, multi-signature controls, and strict operational governance that keeps manual intervention to a minimum.

The approach draws on institutional standards: independent audits, regulatory compliance, and a focus on removing single points of failure. Assets stay offline and isolated by design, while remaining accessible under tightly controlled protocols. Client holdings are never mixed with those of others, and the custody model is managed with transparent, professional-grade risk controls suited to the Australian market.

_______________________________________________

This article is general information only and does not constitute financial advice. Past performance is not indicative of future results. Always conduct your own research or consult a licensed financial adviser before making investment decisions.

If you would like to discuss your options around moving to custody with Ainslie, our staff would be more than happy to have a chat. https://ainsliecrypto.com.au/book-a-meeting/.