Editor's note: Loss totals remain live and depend on methodology. No attacker has been publicly identified. There is no public proof that AI found the flaw, that one actor ran every sweep, or that a licensing dispute caused the bug.

The box was offline.

That part worked.

No browser. No cloud account. No exchange employee resetting a password after a convincing phone call. The owner could put the device in a drawer, stamp the backup into steel, and keep both away from every network on Earth.

Then the bitcoin moved anyway.

Exploiting the flaw did not inherently require touching the device or stealing its backup. It allowed candidate secrets to be searched offline and checked against public blockchain data. Public evidence does not establish the exact method used in every attributed theft, and affected seeds could have been generated at any point from 2021 through 2026.

That is the incident in plain English:

The device stayed cold. The key was born weak.

If you used COLDCARD, read this first

Exposure follows the firmware used when a seed or other secret was generated. It does not follow the purchase date, the firmware installed today, or the brand of device currently holding the seed.

• Coinkite's published customer range for Mk2/Mk3 is firmware 4.0.1 through 4.1.9. Researchers verified the vulnerable construction in the v4.0.0 source/release commit. Coinkite says no signed v4.0.0 binary was publicly released; the reviewed record does not independently settle distribution.

• Mk4/Mk5 seeds generated before Standard 5.6.0 or Edge 6.6.0X are inside the current warning.

• Q seeds generated before Standard 1.5.0Q or Edge 6.6.0QX are inside the current warning.

• A safely generated seed imported into affected firmware is not automatically weak merely because it later sat on that device.

• Updating firmware protects future generation. It does not repair an old affected seed.

• Restoring the same words on a new device moves the same weakness.

Use Coinkite's first-party migration guidance. Verify replacement addresses on a trusted display, send a test transaction, account for change, confirm the full transfer, and retire old key material only after the replacement is verified.

Never enter a seed, passphrase, xpub, backup file, or dice history into a public post, support chat, or website claiming it can check whether you are safe.

What actually failed

Bitcoin's cryptography did not break. The blockchain did not reveal private keys. An air gap was not remotely crossed.

The failure occurred earlier, while certain COLDCARD firmware generated wallet secrets.

A 2021 software migration changed seed generation from a board-specific hardware-randomness path to a cryptographic-library call. A small preprocessor mistake caused the production build to resolve that call to a deterministic fallback called Yasmarang instead of the intended hardware random-number generator.

Think of it this way: the device had a good well, but the pipe feeding the kitchen had been connected to a decorative fountain running in a loop.

For Mk2 and Mk3 devices, Coinkite modeled the practical search around roughly 40 bits under assumptions about device identity and timing. That is vastly smaller than the intended 256-bit secret space.

Later Mk4, Q, and Mk5 devices added secure-element material. That helped, but the implementation passed only four digest bytes—32 bits—into one reseed state word. Coinkite describes an effective search space around 72 bits under its assumptions. Block's more cautious view is that only 32 bits of secure-element distinction entered the reseed; any additional cost depends on uncertain and correlated device or timing state.

Those are not interchangeable claims. “About 72 bits of search under a model” is not the same as “72 bits of clean cryptographic entropy.”

Independent researcher 3z reports rebuilding vulnerable Mk3 firmware 4.1.9 and fixed firmware 4.2.0, verifying signatures, and checking the binary path. In the vulnerable build, rng_get reached Yasmarang. In the fixed build, it reached the hardware RNG.

That strongly confirms the broken path and the Mk3 repair. It does not prove one universal recovery cost for every wallet, model, or feature.

The weak path also touched some paper-wallet keys, random Seed XOR masks, cloning, Key Teleport, Web2FA, Secure Notes, and other generated secrets. Exposure and practical exploitability vary.

How much was stolen?

The clean answer is not one number pretending to be a fact.

Galaxy Research estimated 1,596 BTC stolen with high confidence by August 3, covering three confirmed mass waves plus fourteen smaller incidents. Galaxy said roughly 7,300 addresses were involved and reported contact from 73 individual claimants.

A stricter public tracker at coldcard.rip independently accounted for 1,432.48323487 BTC delivered into tracked destinations. Its methodology counted thousands of swept addresses and UTXOs, but addresses are not people. One owner can control many addresses; several owners can also be grouped incorrectly by a bad clustering assumption.

Galaxy also described a suspected fourth wave that would raise its total to 2,055 BTC, but it kept that wave outside its high-confidence headline because no victim had yet confirmed inclusion.

So “more than 1,500 BTC stolen” is defensible only with attribution:

Galaxy Research estimated 1,596 BTC stolen with high confidence. A stricter public tracker accounted for 1,432.48 BTC. A suspected fourth wave could raise the total to 2,055 BTC, but remained unconfirmed.

No reviewed source established recovered funds, exchange freezes, or a publicly identified attacker. Reports that most attributed funds remained unmoved do not mean the funds were recovered. Unmoved is not returned.

The customer was never the auditor

Most COLDCARD customers are not cryptographers, firmware engineers, compiler specialists, or embedded-systems auditors.

They bought a specialist security product precisely because they could not personally verify macro behavior, symbol resolution, entropy paths, secure-element integration, and the final signed binary between pressing “New Wallet” and receiving twelve words.

For some buyers, those words protected retirement savings or generational wealth. The commercial bargain was not that every customer would independently audit the firmware after dinner.

The customer was responsible for protecting the secret received. The manufacturer was responsible for ensuring the product generated a secure secret.

Dice entropy, strong passphrases, and independently sourced multisig keys are valuable defenses. They are not a fair excuse for the primary generator failing.

A small specialist company is not blameworthy merely for being small. Small teams can build excellent security products. But limited resources do not reduce the consequence of accepting an enormous security obligation. If the team lacks the people, tests, outside review, or release controls needed to verify the root-secret path, that constraint belongs in the product's risk model. It cannot be transferred to the buyer after a loss.

“You should have rolled dice” is not accountability. It is warranty language written backward after the fire.

Self-custody means the user controls the keys. It does not mean the user authored the firmware.

Who owns what

Coinkite owns the product failure

Coinkite owns the integration defect, the missing end-to-end verification, the initial scope error, and the long period during which affected firmware generated secrets.

Its first public advisory said Mk4, Q, and Mk5 were not affected based on early analysis. After Block reported broader exposure, Coinkite expanded its technical scope about eight hours later and issued wider migration guidance.

Coinkite also owns the promised postmortem, its explanation of prior testing and audits, and whatever position it takes on compensation. At this cutoff, the reviewed public record contained neither a final postmortem nor a public compensation program. That leaves an accountability question open; it does not by itself establish legal liability.

Coinkite also deserves credit for its response

The company accepted responsibility, apologized, shipped emergency fixes, warned that firmware updates do not repair existing seeds, helped users migrate, assisted investigations, recommended competing products, and promised a formal postmortem.

Coinkite says it halted shipments and destroyed remaining affected inventory because its security locks prevented a safe pre-initialization upgrade.

A responsible emergency response does not erase the original failure. The original failure does not make every emergency action fake. Both facts fit in the same room.

MicroPython does not own the wallet integration

The Yasmarang fallback was not designed to generate Bitcoin wallet seeds. The failure occurred when COLDCARD's integrated production build allowed that fallback to satisfy a wallet-critical symbol.

Upstream code can be imperfect. The product vendor still owns the product integration.

Block produced evidence—and sells a competing product

Block's researchers, working with other investigators, produced the strongest public independent root-cause analysis reviewed for this column. They documented the symbol-resolution failure, the deterministic fallback, and the truncated later-model reseed. They also warned that later models were affected before Coinkite broadened its initial scope.

Block sells Bitkey and stated that its own products were unaffected.

That commercial interest is relevant context. It is not a rebuttal to reproducible technical evidence. Useful evidence does not become false because its source has a product. It does mean readers should demand receipts. Block supplied many.

The angle map

The AI angle

Coinkite argued that AI-assisted tooling may have made exploitation cheaper and faster. That is plausible as a general warning.

It is not evidence that the original attacker used AI to discover or exploit this flaw. AI-assisted reproduction demonstrates capability, not historical attribution.

The AI frame also redistributes attention. “Attackers became newly powerful” invites a different emotional response than “our production seed-generation path went unverified for years.” The first may be true without replacing the second.

The open-source angle

Open-source defenders argue that public code enabled outsiders to identify and verify the defect. Critics answer that the code was public for years while the defect remained.

Both points are true.

Source availability is not audit completion. Audits are not complete unless they cover the integrated production artifact and the behavior that matters. The lesson is not “open source failed” or “open source saved us.” The lesson is that inspectability and actual verification are different things.

The custody angle

Custody advocates have a serious argument: most users cannot audit firmware, monitor emergency channels, or safely execute a rushed migration while an attacker searches for keys. Regulated custody, collaborative custody, or an ETF can transfer some technical burden to institutions with larger security teams.

That also introduces counterparty, legal, operational, and access risks. It changes where trust sits; it does not abolish trust.

“Self-custody is dead” and “this changes nothing” are both factional conclusions trying to inherit the customer before the investigation is finished.

The media angle

The biggest dollar number wins the headline. “Offline wallet hacked” wins the click. “AI may have cracked hardware wallets” wins the future-shock paragraph.

The technical truth is conditional and therefore less marketable: firmware version matters; generation path matters; imported seeds differ; dice, passphrases, and multisig change exposure in specific ways; addresses are not victims; suspected waves are not confirmed waves.

The headline is doing the steering.

The missing scene

The most important missing scene is not the theft. It is the test that should have failed before release.

Did seed generation draw from the intended production hardware source?

Was the signed binary inspected to confirm which rng_get implementation it actually called?

Did tests detect deterministic output under controlled device identity and timing?

Did later-model tests verify how much secure-element material reached the reseed state?

A wallet can have secure elements, tamper evidence, air gaps, PINs, encrypted backups, and careful signing workflows. If the root secret begins inside a searchable neighborhood, those controls can faithfully protect the wrong thing.

The device can be offline and still inherit online-scale risk from an earlier engineering decision.

That is the part every hardware-wallet vendor—not only Coinkite—should be forced to answer.

What we know, and what we do not

We know: a 2021 integration routed affected secret generation through a deterministic fallback rather than the intended hardware RNG.

We know: later models added secure-element material, but only four digest bytes entered the reseed call.

We know: updating firmware does not strengthen a seed generated through the affected path.

We know: Coinkite accepted responsibility, shipped fixes, corrected its initial scope, and issued migration guidance.

We know: Galaxy's August 3 high-confidence estimate was 1,596 BTC; its 2,055 BTC figure included a suspected wave outside that tier.

We do not know: who carried out the thefts, whether one actor ran every wave, whether the original attacker used AI, whether a licensing dispute caused the regression, or the final population-wide exploit cost for later models.

The Trent read

Major camps are framing the incident through risks they already emphasized.

The vendor points to AI-accelerated attackers.

Competitors point to their architecture.

Custodians point to the burden of holding keys.

Open-source factions point at each other.

Influencers point to dice, multisig, or whichever product they already liked.

The media points to the biggest number available before deadline.

Victims point to the promise underneath the product: they paid for specialist expertise because they did not possess it themselves. They should not disappear while institutions argue over which architecture gets to inherit them.

Some of these arguments are useful. None gets the whole wallet.

The owner thought trust had been reduced to a box and a backup. In reality, the owner also trusted the compiler path, the macro, the library, the symbol table, the tests, the release process, the entropy claim, the reviewers, and the quiet passage of time.

Bitcoin removed the need to trust a bank with the ledger.

It did not remove the need to verify the machinery that creates a key.

The machine was cold.

The assumptions were hot.

Everybody has an angle. This one arrived with a five-year head start.

- Trent Jones