The 4-Billion-Seed Problem: How a Silent RNG Fallback Drained 1,196 Coldcard Wallets in 41 Minutes

Everyone thinks hardware wallets are unbreakable fortresses. The data says otherwise. On July 30, 2026, roughly 1,196 Bitcoin wallets were swept clean in 41 minutes. Total haul: approximately $70 million. And the victims weren't careless users pasting seed phrases into note-taking apps. They were Coldcard owners — people who bought the Bitcoin-maximalist's hardware wallet of choice, the device that treats air-gapped, offline signing as a religious doctrine. Here's the part that should genuinely unsettle you: the attack wasn't a sophisticated zero-day exploit. It was a brute-force traversal of a 32-bit key space. The attacker didn't crack the cryptography. They watched a random number generator fail — silently, for four years — and then vacuumed up the aftermath. Coldcard is built by Coinkite, a Canadian company with a reputation for uncompromising Bitcoin-only design. No Bluetooth. No USB auto-connect. Full offline transaction signing. It's the device you buy when you believe self-custody is the only custody worth having. The security model rests on a clean assumption: the private key never leaves the device. That statement is true. But it's an incomplete truth. The private key has to be generated somewhere — inside the device — and that process depends entirely on a random number generator producing sufficient entropy. If the RNG is degraded, the key isn't a key. It's a needle in a very small haystack. In March 2021, a coding error crept into Coldcard's firmware. A task that should have invoked the secure random-number path was silently redirected to a weak fallback. The fallback derived randomness from the device's serial number and internal clock. Those inputs aren't random. They're predictable. They're enumerable. For over four years, this defect sat dormant. New wallets created with affected firmware were generating seeds from a catastrophically reduced entropy pool. The security model didn't fail loudly. It quietly degraded — and nobody noticed. Volume without intent is just digital noise. Now let's talk about the actual numbers, because the magnitude of this failure only becomes clear when you do the math. A proper BIP39 seed carries 128 to 256 bits of entropy. The key space is 2^128 or higher. Forget brute-forcing that; the heat death of the universe would arrive before your laptop found a match. The affected Coldcard seeds, by contrast, occupied a space Block's engineers estimated at roughly 4 billion possibilities. That's about 2^32. A modern laptop can traverse that space in hours. With GPU assistance, you're looking at seconds to minutes. But here's the subtlety that makes this attack especially insidious — and it's a detail most coverage has missed. The attacker didn't need to watch for new wallet creations in real time. They could pre-generate the entire 4-billion-seed address space offline, convert each seed into Bitcoin addresses, and build a massive lookup database. Then they simply scanned the public blockchain — which is, by design, completely open — for any address with a balance. No failed attempts. No on-chain fingerprint. No interaction with the victim. Just a database match against addresses holding funds. This is address sweeping at industrial scale. And it's embarrassingly low-tech in execution. Galaxy Research flagged the abnormal pattern first, alerting the community. Block's researchers — the crypto arm formerly known as Square — performed the forensic reconstruction. They mapped the attack timeline: wallets swept in systematic batches, transactions routed through intermediary blocks to obscure the flow. One detail stands out: three consecutive blocks in the middle showed no sweeping activity. The attacker was pacing themselves — throttling the drain to avoid triggering exchange alerts or monitoring systems, or simply matching block confirmation rhythms. That's not the behavior of a panicked thief. That's the behavior of an operator running a disciplined liquidation pipeline. The 41-minute figure is jarring, but it deserves unpacking. 1,196 wallets. $70 million. That's roughly $58,500 per wallet on average — though the distribution is almost certainly skewed. Some of those wallets likely held meaningful positions. Four attacker-controlled addresses are still known: bc1qq85..., bc1qx76..., bc1q8jy..., and bc1qnk4... — and as of the latest check, some of the stolen funds haven't moved. The attack isn't over. It's paused. Now consider the timeline problem. The coding error landed in March 2021. The attack was disclosed on July 30, 2026. That's four years and four months of silent exposure. How many wallets were created with flawed firmware during that window? How many weak seeds were swept before the attack went public? We don't have an answer. We may never get one. What we do know is that Coinkite has released a fix — but the fix only protects new seeds. It does nothing for seeds already generated. Exposure is permanent. And here's the detail that keeps me up at night: there is no home test. No script, no tool, no verification method that can tell a Coldcard user whether their existing seed was drawn from the weak entropy pool. Block's researchers explicitly stated this. The only safe course is to create a new seed and abandon the old one. That's not a fix. That's a forced migration with zero diagnostic clarity — users must assume the worst without ever knowing if they're actually affected. Based on my audit experience — I've spent years reading security-critical code that claims to be "secure by construction" — the most damning element here isn't the RNG fallback itself. It's the absence of detection. A security-critical subsystem silently switched to a degraded mode, and the device didn't log it, didn't warn the user, didn't present any visible indicator. The firmware's health-check mechanisms were either missing entirely or blind by design. The predictable failure was treated as impossible — and the cost of that assumption is now denominated in millions. The easy narrative is to blame Coldcard and move on. That would be a serious analytical error. This could happen to any hardware wallet vendor that treats RNG as a solved problem. The uncomfortable truth is that "hardware wallet equals absolute security" was always a probabilistic claim dressed up as an absolute. Every security architecture rests on assumptions. Coldcard's assumption was that the random number source never fails. That assumption just collapsed in broad daylight. CZ's public warning — that even hardware wallets can have vulnerabilities — isn't fear-mongering. It's arithmetic. And the man has at least shown the intellectual honesty to admit when his past judgments were wrong. "Nothing is 100%" isn't a slogan. It's the correct mental model for evaluating any cryptographic device. There's also a painful irony in who got hurt. The victims were the most security-conscious segment of the Bitcoin community — people who took self-custody more seriously than almost anyone. The narrative damage here isn't "Coldcard is bad." It's "self-custody infrastructure has invisible single points of failure." That's a much bigger problem, and it affects every hardware wallet brand on the market. Let me push one layer deeper, because the most overlooked defense in this entire event is the BIP39 passphrase — the 25th word. If affected users had set strong passphrases, the swept seeds would have been cryptographically useless without that additional input. The attacker could derive the seed and still couldn't unlock the funds. Yet many mobile wallet interfaces and even some hardware devices make passphrase support clumsy or absent. That's an ecosystem-level gap, not just a Coldcard gap. The industry has failed to default users into defense-in-depth. This is also the moment where the long-term winners reveal themselves. MPC wallets — which split key material across multiple parties and eliminate the single-RNG failure point — will likely capture renewed attention. Multisig setups from providers like Casa or Unchained Capital may see an influx of refugees from single-signature setups. But let's not romanticize the alternatives. Those solutions introduce different attack surfaces and different trust assumptions. There is no perfect answer. There is only layered risk — and the willingness to acknowledge that every layer can fail. Volume without intent is just digital noise, and so is security theater without honest threat modeling. The signal I'm watching isn't the Bitcoin price. It's the four known attacker-controlled addresses. If those funds move toward an exchange, expect sell pressure. If they remain dormant, the attacker is waiting — possibly building larger sweeping infrastructure, possibly preparing to liquidate in a more favorable window. The bigger structural signal is whether another hardware wallet vendor discovers a similar RNG defect in the next three to six months. If that happens, the entire hardware wallet category shifts from "trusted" to "suspect," and the market structure permanently tilts toward multi-party custody and institutional-grade safeguards. If you're a Coldcard user reading this, here's the practical takeaway: don't ask whether your seed is compromised. Act as if it is. Create a new seed, move your funds, and never look back. The cost of being wrong is small. The cost of being right and doing nothing is everything. Volume without intent is just digital noise — but silence in a security-critical system is a signal you cannot afford to ignore.