How One Line of Firmware Drained $38 Million in Bitcoin
A build error in a Coldcard hardware wallet quietly swapped a real random number generator for a weak one. Four years later someone guessed the keys and swept hundreds of wallets in 25 minutes. Notes on what went wrong.
Hardware wallets are supposed to be the safe option. You keep your Bitcoin keys on a small offline device, off the internet and out of reach. On the 31st of July a cold wallet called Coldcard got drained anyway. Around 594 BTC, close to 38 million dollars, gone in about 25 minutes. The unsettling part is how ordinary the bug was.
One line that checked the wrong thing
The device is meant to build its secret key from a true hardware random number generator. In a firmware build back in March 2021, a config guard checked whether a setting was *defined*, not whether it was actually *enabled*. So the build quietly fell back to a software random generator instead, and it compiled with no warnings at all.
That software fallback was seeded from predictable values, things like the chip serial number and a timer. The seed space that was sold as 128 bits collapsed to somewhere around 40 bits on the older devices. A 128 bit seed is astronomically large. Around 40 bits is roughly a trillion combinations, which an ordinary computer can grind through.
A bad random number generator is silent
This is the part that stuck with me. The output still looked random. It passed a casual glance, nothing crashed, nothing warned, and the flaw sat in public firmware for years. Then someone precomputed the weak keys ahead of time, and when they were ready they swept hundreds of wallets inside one short window. No physical access to any device. They simply guessed the keys.
What actually fixes it
A firmware update does not repair a seed that was already generated the weak way. Anyone affected has to create a brand new seed on patched hardware and move every coin across, which is its own nervous window. Ledger and Trezor were quick to say their own designs were not affected, because they generate keys differently.
The lesson I am keeping
Randomness cannot be a software convenience with a quiet fallback path. On a device whose entire job is holding secrets, the random number generator has to be real hardware, measured, and checked while it runs, not a macro that fails open. One wrong build flag turned unbreakable into guessable, and nobody noticed for four years.