The Coldcard Sweep Hits $88.6 Million, and the 'Not Affected' Models Join the Advisory

What Happened

The Coldcard incident did not stop at one sweep. Galaxy Research, the research arm of Galaxy Digital, now counts 3 distinct waves of thefts from addresses tied to weak Coldcard-generated seeds: 1,082.65 BTC taken from about 1,195 addresses in 41 minutes on July 30 (the event first reported as 594 BTC and revised upward as analysts connected more transactions), another 76.

16 BTC from 1,478 addresses on July 31, and a suspected third wave stretching into August 1 that drained roughly 208 BTC from 1,912 addresses. The running total stands at 1,367.05 BTC, about $88.6 million, swept from 4,585 addresses. Every stolen coin is still sitting where the attacker parked it, a stillness Galaxy describes as unusual for a theft this size, and the firm is monitoring roughly 300 attacker addresses for the first outbound spend.

The advisory grew along with the theft count. Coinkite's original warning, published within a day of the first sweep, covered seeds generated on the Coldcard Mk3. On August 1 the company expanded it to the rest of the product line: seeds generated on Mk4 or Mk5 devices before standard firmware 5.

6.0, and on the Q before standard 1.5.0Q, carry about 72 bits of entropy instead of the 128 bits a 12-word seed should provide. Per Coinkite's technical backgrounder, the root cause dates to a 2021 code migration in which seed generation began pulling from MicroPython's software random number generator (RNG) instead of the device's dedicated hardware RNG, a substitution that shipped because both functions shared the same name.

Fixed firmware is out for every model, but a firmware update does not repair an existing seed. Seeds built with at least 50 fair, private dice rolls were never exposed, and Coinkite does not consider them at risk from this bug.

The attacker has not spent a single stolen coin, but the panic already moved thousands of coins into custody. A weak seed is fixable with dice and an afternoon; a counterparty is a permanent line in the risk ledger.

72 Bits Is Below Spec. It Is Not the Mk3 Flaw.

The distinction between the Mk3 problem and the rest of the line matters, and it is worth being precise where the headlines have not been. The swept addresses appear to trace to Mk3-era seeds whose effective entropy was low enough to enumerate: an attacker could grind through the candidate space offline, derive the matching addresses, and watch the chain for funded ones.

72 bits is a different regime. It is a severe downgrade from 128 (each lost bit halves the search space, so 56 lost bits shrink it by a factor of about 72 quadrillion), yet a 72-bit space still sits beyond published brute-force capability, and no loss from a pre-fix Mk4, Mk5, or Q seed has been confirmed as of this writing.

The honest reading is that the expanded advisory is precaution, not evidence that a second enumerable population exists.

Precaution is still the right frame for a holder, for one structural reason: a Bitcoin seed is a static target with a decades-long exposure window. The margin that makes 72 bits impractical this year is a bet on attacker capability staying flat, and this week demonstrated that at least one operator was willing to precompute for a long time and collect everything in a single coordinated window.

The calibrated read: pre-fix Mk4, Mk5, and Q holders are not in the emergency the Mk3 population is in, but they are holding seeds that are 56 bits short of what they paid for, and closing that gap costs one afternoon.

The Flight to Exchanges Trades a Bug for a Counterparty

The crowd response is the part of this story worth studying. Centralized exchanges recorded net bitcoin inflows of 11,163 BTC on July 31, and daily deposits in transfers under 10 BTC (the size band that looks like individual holders rather than trading desks) spiked to about 7,300 BTC, the highest reading since February 6.

Long-dormant coins are moving too, a signature of old cold-storage wallets being rotated. CoinDesk drew the contrast directly: after FTX collapsed in 2022, coins flooded off exchanges as holders absorbed the lesson that custodians fail. This week the flow is running the other way, and some coverage is already framing the exploit as an argument for ETFs and custodians over self-custody.

This series tracks protective mechanisms inverting into attack surfaces, and the second-order inversion here is behavioral: a failure inside one vendor's RNG is converting thousands of self-custodied positions into custodial ones. That trade swaps a fixable entropy bug for a permanent set of counterparty exposures: exchange solvency, account freezes, withdrawal halts, and a jurisdictional contact point that did not exist while the coins sat onchain.

Note what the two failure modes ask of the victim. Coldcard holders who learned their seeds were suspect could rotate to new seeds within hours, on their own authority, without asking anyone. A frozen or insolvent custodial account offers no equivalent unilateral exit. Fleeing key control because key generation failed once is an understandable reflex, and it is the wrong lesson.

What This Means for You

Triage by model and seed provenance, not by headline. If your seed was generated on a Coldcard Mk3, treat it as burned and move funds now if you have not already: that population is being actively swept. If your seed came from a Mk4 or Mk5 before firmware 5.6.0, or a Q before 1.5.

0Q, you are in the 72-bit population: no confirmed losses, but plan a migration this week, not this quarter. Seeds created with at least 50 private dice rolls are outside the bug entirely, and a strong, unique BIP-39 passphrase (BIP-39 is the standard that maps seed words to keys) has shielded even weak seeds from the sweeps observed so far.

The migration mechanics are unchanged from our July 31 coverage in '594 BTC Swept in 25 Minutes: Coldcard's Mk3 Seed Flaw Turns the Hardware Wallet Inside Out': update firmware first, generate a fresh seed on the patched device (or supply your own randomness via dice rolls), send a small test transaction, verify you can spend it, then move the balance.

Never type the old seed into a computer, and expect a wave of fake 'seed checker' tools and impostor support accounts preying on exactly this moment; nobody legitimate needs your words to tell you whether they are weak. One correction to that July 31 piece: it relayed Coinkite's original statement that Mk4, Mk5, and Q devices were not affected.

The expanded advisory supersedes that line, and this article is the update.

If you moved coins to an exchange this week, be honest about what that position is: a short-term risk swap, defensible only while you cannot yet generate a trustworthy seed, and carrying its own tail risks of freezes, withdrawal halts, and insolvency for as long as it lasts. Self-custody did not fail this week; one vendor's seed generation did.

The durable fixes (randomness from your own dice, a strong passphrase, multi-sig spread across more than one vendor) keep both the bug and the counterparty out of your setup.

What to Watch

The first outbound spend from the roughly 300 attacker addresses Galaxy is monitoring would open the tracing and attribution paths that stillness currently denies. Watch whether a 4th sweep wave appears, whether any loss is ever confirmed from a pre-fix Mk4, Mk5, or Q seed (which would change the 72-bit calculus overnight), and whether Coinkite's promised full post-mortem explains how a silent RNG substitution survived 5 years of releases and audits.

The behavioral tell is the exchange flow: if the July 31 inflow spike reverses over the coming weeks, holders treated exchanges as a waystation while they rotated seeds. If it does not reverse, this incident will have durably converted self-custody holders into custodial customers, and that would be a larger structural loss than the $88.

6 million.

Tracked entities this report names, with total coverage across the archive. Follow one into the Actor Network to see every report it appears in.

Other reports that name the same tracked actors — a different thread than “related,” which follows wording. These are linked by who appears in them.