Introduction: *I wrote a brief report on this news story, which is of course of concern to bitcoiners everywhere. This follow-up article is a "Deep Dive" into the technical details and documented information I could derive.

.

What happened?

A group of people exploited a vulnerability in the operating system software of ColdCardHardware Wallets. The wallets are not connected to the internet and are "air gapped " so they are not connected to the internet.
The attack didn't technically happen to the hardware
The attack occurred onchain, on the bitcoin blockchain.

How did this happen??

The operating system of these particular hardware wallets has a software bug which caused it to create 24 word seed phrases, the passwords to these bitcoin wallets, which were not random, and actually followed a pattern . When the hackers discovered the software bug and the error in the way the passwords were created, they used the pattern they detected in the seed phrase generation to guess the passwords. They used computers equiped with GPUs or ASIC chips to guess the passwords of FIRST 1100 Bitcoin wallets and transfer the bitcoin out of the wallets onchain. Then this same methodology allowed the hackers to drain 3000 other wallets, for a current.. CURRENT number of 4500 plus wallets.

Did the maker of the ColdCard Hardware wallet and companies who provide onchain analytics acknowledge that this really happened?

Yes. The company ColdCard has publically acknowledged that this attack tootk place, and the company acknoledged it was their mistake.

Did the company ColdCard release a Fix or Firmware Update??

Yes. It did , but it states specifically that the Update doesn't protect the wallets because the 24 word seed phrases are still to weak to protect the Bitcoin. They speifically told their customers to migrate their Bicoin to other wallets with different seed phrases not seed pharses generated by their Firmware.

What should people with these hardware wallets do??

Move your bitcoin to another hardward wallet ASAP.
Consider splitting your Bitcoin between one or more wallets, from different companies to reduce your risk from such a thing happening agains.

Documentation: Here's the documentation I could find online researching this story.

Note the following are quotes from sources not my words, I am providing them here for information and to help you understand what happened.

ColdCard Hardware Wallet maker Statements

Official Responses and Expert Statements: 1. CoinCard & Founder Response
CoinCard co-founder Rodolfo Novak took public responsibility on social media, confirming the scope of the firmware bug and announcing emergency patch builds for affected Coldcard models (Mk3 and select Mk4 release paths):

"We take full responsibility for the firmware bug... We released a hotfix to remove the software fallback path, but updating the device alone does NOT protect seeds that were generated on vulnerable firmware."
— Rodolfo Novak, Co-founder of CoidCard

Onchain Analytics Companies:

On-Chain & Security Analysts
Galaxy Research mapped the movement of stolen funds into central consolidation wallets, noting that the incident exposes a fundamental risk in client-side key generation:

"Most crypto theft involves reaching into something—an exchange breach or a phished key. Hardware wallets sell distance... But when the underlying key is born mathematically weak, an attacker never needs to touch the device."
— Galaxy Research Analyst Team

On-Chain Timeline and Research Findings

The Sweep Window: On July 30, 2026, between 01:10 and 01:51 UTC, the attacker swept 1,082.65 BTC across 1,196 target addresses across blocks 960,183 through 960,191.

Automated Footprint: On-chain mapping by Galaxy Research revealed that all sweep transactions used an identical 30 sat/vB transaction fee rate and left zero change outputs, proving the automated nature of the key reconstruction.

Discovery & Bug Origin: Security engineers at Block (led by Clay Garrett and team) isolated the bug within the Coldcard firmware build pipeline and notified affected parties.

Critcial Steps for Hardware Owners to take, per these experts and hardware manufacturer:

• Some of this is very technical, but basically move your bitcoin to another wallet you trust!

Critical Mitigations for Wallet Holders
ColdCard Firmware Update Alone Is Insufficient: Patching the wallet prevents future faulty seed generations, but any seed created between March 2021 and July 2026 remains mathematically compromised.

Migration Procedure: Users with seeds generated on affected Coldcard firmware must immediately generate a completely new seed phrase on patched firmware and transfer all funds to the new addresses.

Manual Entropy (Dice Rolls): Utilizing manual entropy sources (such as rolling physical 6-sided dice directly on the device) bypasses software RNG reliance.

Multisig Setup: Using multi-signature vaults with devices from different manufacturers ensures that a single vendor firmware vulnerability cannot compromise funds.

What was the underlying problem??

This is a very technical explanation, which I have copied and pasted here for the purpose of being accurate, as I don't understand much of the cryptographic analysis.

Technical Deep-Dive: How "Air-Gapped" Wallets Were Drained

To understand how an offline wallet sitting in a safe could be compromised without direct physical access or network connectivity, it helps to understand how cryptographic seed phrases are generated:

1. The Flaw:

Hardware RNG BypassNormally, Coldcard hardware wallets generate BIP-39 24-word recovery seeds using a dedicated Hardware True Random Number Generator (TRNG) on the device's STM32 microcontroller.

In March 2021, firmware update v4.0.1 introduced a code logic error: A check in a supporting code library (libNgU) tested whether a specific build setting existed rather than verifying whether it was actually switched on.

This bug caused the firmware to bypass the hardware TRNG entirely.
Seed generation quietly fell back to a deterministic software pseudo-random number generator (PRNG) named Yasmarang.

2 . Predictable Seed Entropy

Instead of tapping entropy from physical noise, the software fallback seeded the PRNG using predictable device state metadata:Chip Unique Identifier (UID): Factory metadata fixed per hardware chip.

System Clock Registers: Hardware timer states (SysTick and RTC).While the resulting seed phrase appeared random to humans, the entropy pool collapsed from $2^{256}$ possibilities down to roughly $2^{40}$ to $2^{48}$ combinations.

3. Offline Key Reconstruction

An attacker did not need to touch the physical device or compromise its air gap:

Enumeration:

High-performance GPUs and ASIC clusters systematically generated candidate seeds by cycling through plausible combinations of chip UIDs and system clock times.

Derivation: The attacker derived the corresponding BIP-32 private keys and public Bitcoin addresses for each candidate state.

Cross-Referencing:

They cross-referenced these generated addresses against public Bitcoin blockchain UTXOs.

Execution:

Once a match was found, the attacker held the mathematically identical private key and broadcast automated sweep transactions across the network.

In English or plain language please.

I am not a cryptographer, but I see the math underlying the problem,

First: The way a bitcoin wallet is suppose to work:

A random generated 24 word seed pharse generates $2^{256}$ possibilities which in common math terms is this number of possible 24 word seed pharases: A 78-digit number: 115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936
For reference that is almost the same number as the number of atoms in the observable Universe.
as you can imagine, a computer program, which randomly gueesses paswords would take a few lifetimes to guess one 24 word seed phrase correctly, and drain one wallet. This hack took 41 minutes to drain 1000 wallet.

Second: The way these wallets worked

Their random defective Firmware generated a range of $2^{40}$ to $2^{48}$ possibilities, which in common math terms is this number ranger: In plain numbers, 2⁴⁰ to 2⁴⁸ combinations ranges from 1.1 trillion to 281.5 trillion.

Exact numbers:

2⁴⁰ = 1,099,511,627,776

2⁴⁸ = 281,474,976,710,656

Scale & Word Equivalent

2⁴⁰: ~1.1 Trillion ($1.1 \times 10^{12}$)

2⁴⁸: ~281.5 Trillion ($2.81 \times 10^{14}$)

Third

These seem like very large numbers, but using computers with extra GPUS to perform the math, this is how long it takes to generate the correct 24 word sed phrase by guessing random combinations:

Real-World Context (Computer Speed)

To put this range into practical perspective in computing or password cracking:

At 1 billion guesses per second (a modern fast GPU or small computer cluster):

2⁴⁰ combinations takes ~18 minutes to search completely.

2⁴⁸ combinations takes ~3.25 days to search completely.

While trillions of combinations sound huge to humans, to modern computer hardware, searching a space of 2⁴⁰ to 2⁴⁸ is considered very small and easily crackable in minutes to days.

Last: Taking the Bitcoin

• Using publically available knowledge on the bitcoin blockchain explorer they were able to find the wallets with the most bitcoin that used this particular brand of Hardware wallet, then use the computers to guess their passwords and then drain the wallets.

Mass Guessing:
The hackers used powerful computers to generate millions of possible combinations per second by combining known chip serial numbers with past dates and times.
Finding the Matches:
They generated the exact Bitcoin addresses that those combinations produced and checked them against the public Bitcoin blockchain to see which ones held money.
Taking the Money:
Because they had recreated the exact same 24-word keys on their own computers, the Bitcoin network recognized them as the rightful owners, allowing them to send all the funds to their own address in minutes.
The Takeaway:
The wallet wasn't hacked through the internet.
The "secret code" created when setting up the wallet was so mathematically predictable that someone else was able to guess it from far away.

So there you have it. The current explanation using math. The defect produced weak passwords, which attackers using a computer equipped with GPUS similar the computers used for mining cryptocurrency like Bitcoin could do the math to guess these mathematically weak passwords.

Sources / references / Citations as this math work is the work of math brain trusts

The primary sources for the figures, calculations, and security concepts discussed in the previous response are detailed below:

1. Mathematical & Computational Sources

• Exact Value ($2^{40}$ and $2^{48}$): Standard binary exponentiation ($2^x$).
• $2^{40} = 1,099,511,627,776$
• $2^{48} = 281,474,976,710,656$

• Hardware Crack Speeds: Standard cryptographic brute-force benchmarks (e.g., Hashcat / GPU benchmark documentation for SHA-256 and Secp256k1 key derivation performance). A modern multi-GPU setup running at $10^9$ hashes per second completes $2^{40}$ operations in roughly 1,099 seconds (~18 minutes).

---

2. Contextual Security Source (The "Milk Sad" Exploit)

The range of $2^{40}$ to $2^{48}$ combinations often arises when discussing reduced key entropy vulnerabilities, such as the famous CVE-2023-39910 vulnerability (dubbed "Milk Sad"):

• Vulnerability Disclosure: Milk Sad Official Security Disclosure (milksad.info)
• National Vulnerability Database Entry: NVD - CVE-2023-39910
• Technical Summary: In August 2023, security researchers discovered that Libbitcoin Explorer (version 3.0.0 through 3.6.0) used a weak 32-bit PRNG (Mersenne Twister) seeded by system time. This limited the internal search space, allowing attackers to brute-force private keys off-chain in minutes using standard hardware, leading to the theft of over 1,080 BTC.

Comments? As I learn more I will publish it here, but this is obviously an important news story.

Bonus Material:

For you cryptography junkies who can't get enough math

I asked Google Gemini AI to explain this in plain language

• Think of your Bitcoin wallet as a master combination lock.Normally, when you set up a hardware wallet, the device acts like a chaotic dice-roller, picking a 24-word sequence out of more combinations than there are atoms in the observable universe ($2^{256}$).
• Guessing that combination by brute force is mathematically impossible, even for supercomputers.

Here is how that broken promise allowed hackers to steal the funds without ever touching the device:

1. The Broken Dice-Roller
   To generate a truly random secret key, the device is equipped with a special hardware chip designed to pick pure, unpredictable physical noise (the Hardware TRNG).
   However, a mistake in the software code (firmware version v4.0.1) broke this feature.
   A simple coding error asked the system "Is this feature installed?" instead of "Is this feature turned on?"
   Because of this mistake, the wallet skipped the physical dice-roller entirely and secretly switched to a basic software backup program (Yasmarang) to create the 24 words.
2. Predictable "Randomness"Because the backup program didn't have access to real randomness, it tried to fake it using information it already had on hand:The chip's factory serial number (Chip UID)
   The exact time and date on the internal clock (System Clock)To a human, the 24-word phrase generated this way still looked completely random.
   But mathematically, the number of possible combinations collapsed from an impossible number down to just a few trillion ($2^{40}$ to $2^{48}$).
3. Guessing the Combination Offline
   Because the software flaw followed a predictable pattern, hackers didn't need to steal the hardware wallet or connect it to the internet.
   They just needed to reproduce the math:
   Mass Guessing:
   The hackers used powerful computers to generate millions of possible combinations per second by combining known chip serial numbers with past dates and times.
   Finding the Matches:
   They generated the exact Bitcoin addresses that those combinations produced and checked them against the public Bitcoin blockchain to see which ones held money.
   Taking the Money:
   Because they had recreated the exact same 24-word keys on their own computers, the Bitcoin network recognized them as the rightful owners, allowing them to send all the funds to their own address in minutes.
   The Takeaway:
   The wallet wasn't hacked through the internet.
   The "secret code" created when setting up the wallet was so mathematically predictable that someone else was able to guess it from far away.

Source Googlle Gemini

I asked Google Gemini what is the take home lesson here?

The answer is complicated, but basically weak passwords that don't use the full strength of cryptography to make it mathematically impossible to guess them are best.

Gemini's answer:

The overarching take-home lesson connects both the cryptographic security behind your wallet and the economic strategy behind your assets:

1. Security: Math is Truth, but Flawed Entropy Kills

Full Entropy ($2^{256}$) is Unbreakable: A properly generated 24-word seed phrase has $2^{256}$ possibilities—more than the number of atoms in the observable universe. It cannot be brute-forced.

Flawed Generation ($2^{40}$) is Fatal: If software uses a weak or predictable random number generator (like the Libbitcoin "Milk Sad" bug), the security space shrinks to $2^{40}$–$2{48}$. High-speed computers can brute-force that range in minutes to days.

The Lesson: "Offline" hardware wallets only protect you if the initial seed phrase was generated with true randomness. Never trust auto-generated seeds from non-standard software, and use multi-signature (multisig) across distinct hardware brands for large holdings.