Coldcard Adds New Security Measures After $130 Million Bitcoin Exploit

Coldcard maker Coinkite has released a security overhaul for its Bitcoin hardware wallets after a seed-generation flaw allowed attackers to steal more than $100 million in Bitcoin.

In a blog post on Thursday, Coinkite urged Coldcard Mk4, Mk5, and Q users to upgrade to firmware 5.6.1 or 1.5.1Q. The release follows a three-week review of Coldcard’s systems that included outside security researchers and AI models including Kimi.

“We are grateful to the security researchers who went above and beyond over the past weeks, reporting issues, reproducing edge cases, and reviewing our fixes,” the company wrote. “Their work put this firmware under intense, sustained scrutiny and made this release stronger.”

In July, attackers began draining Bitcoin from air-gapped Coldcard wallets after exploiting a firmware flaw dating to 2021 that generated some wallet seeds with too little randomness, making their private keys easier to guess. The first attack drained 594 BTC, worth about $38 million, from roughly 500 wallets in 25 minutes.

Coinkite suggested that the attackers may have used AI to examine older versions of its open-source firmware and uncover the flaw.

By early August, Galaxy Research had tracked roughly $88.6 million stolen across 4,585 addresses and said the attacks appeared deliberate, programmatic, and potentially orchestrated using a large language model.

The research company continued tracking losses and by August 14 said attackers had stolen more than 1,778 BTC, worth roughly $112 million at the time, across three major attack waves and dozens of smaller incidents.

All told, the Coldcard exploit has now resulted in roughly $130 million in stolen Bitcoin and raised questions about entropy—the randomness used to generate wallet keys. On some affected devices, the flaw reduced security from 128 bits of entropy to roughly 40 bits, making wallet seeds easier for attackers to guess without physical access to the device.

Coinkite said it fixed issues involving transaction signing, USB data handling, firmware validation, Delta Mode, and wallet backups. Coldcard now also requires users to add randomness when generating a wallet seed using at least 65 key presses, 50 dice rolls, or 128 coin flips, which the device combines with its own randomness.

The hardware wallet maker also replaced its Yasmarang backup pseudo-random number generator with SHA-256 Hash_DRBG and added checks intended to catch failures in the hardware random number generator. Users who may have generated seeds on affected versions between 2021 and July 2026 must create a new seed using updated firmware and move their Bitcoin, the company said.

More than seed generation

Coldcard now checks a partially signed Bitcoin transaction, or PSBT, immediately before signing it. Previously, a compromised computer connected over USB could theoretically change a transaction after the user reviewed it but before the Coldcard signed it.

The updated firmware stops the signing process and displays a warning if the transaction has changed. Coinkite described the issue as theoretical and did not say it had been exploited.

Coinkite also tightened USB data access, hardened Delta Mode, and changed how Coldcard handles wallet backups.

While AI has played a role in patching vulnerabilities, it also plays a role on both sides of cybersecurity and cryptography.

“We’re treating this as a serious reminder of how the whole security model of a hardware wallet lives or dies on randomness,” Ledger CTO Charles Guillemet told Decrypt. “Cryptography is hard and implementing it securely is harder. This week’s Coldcard incident made that visible in the most expensive way possible.”

Earlier this month, swap service Boltz suspended operations after saying AI-assisted attackers were finding bugs faster than its developers could fix them. A volunteer Bitcoin Red Team also used AI agents to identify thousands of potential vulnerabilities across hundreds of Bitcoin projects.

Coinkite said the investigation into the thefts remains ongoing as affected customers continue moving funds to new wallets.

“Law enforcement authorities continue investigating the thefts and are working to identify those responsible,” Coinkite said. “We remain available to assist, and authorities are keeping us informed of material developments,” adding that the company “remain committed to supporting every customer working through their migration until it’s done.”