Coldcard is a hardware wallet aimed at serious Bitcoin users. It only supports Bitcoin, can be kept offline and uses open-source software. It is assembled in Canada and is designed to keep users' Bitcoin secure.
But from March 2021, some Coldcard devices generated customers' private keys using the device's serial number and its internal clock, rather than the dedicated chip designed to produce random numbers. That made the keys far easier to predict.
On July 30, an attacker stole 594 Bitcoin from about 500 inactive wallets in just 25 minutes. Galaxy Research has since linked the wider theft to 1,082 Bitcoin across 1,196 addresses. By August 2, the total had reached nearly 1,367 Bitcoin, worth about $88.6 million.
The attacker did not need physical access to the wallets. Coldcard's software code is publicly available, as is information on the Bitcoin blockchain.
The attacker appears to have spent several weeks working out the possible keys that the faulty software could have created. Those keys could then be matched with Bitcoin addresses holding funds. Once the vulnerable wallets had been identified, the attacker was able to move the Bitcoin. The theft itself took just 25 minutes.
Inside the flaw
The defect is more embarrassing than the word “bug” suggests. Coldcard distrusts the general-purpose randomness in the software it is built on, so it wraps the chip's own hardware generator and switches the built-in one off. But a safety check in a supporting library failed to detect that the built-in generator had been disabled. Seed generation dropped through to the software fallback, which took what randomness it could from the serial number and the clock and never gathered anything fresh again. A seed is meant to carry 128 bits of entropy. On the Mk3, it carried about 40.
Putting it in physical terms, a lock manufacturer advertises a million combinations. A factory defect means one production run can only ever land on about a thousand of them. The lock still turns and looks identical to every other lock on the shelf. The owner has no way of telling. The thief only has to know which thousand.
The elliptic-curve mathematics underneath Bitcoin has never been broken. The randomness feeding it was.
The blast radius is also wider than the coins that moved. A seed is not a Bitcoin object; it is simply entropy. It can also generate addresses and keys for other systems. Anyone who took a Coldcard seed into a multi-chain wallet was using the same broken dice at a different table.
Coinkite, the Canadian firm behind the device, has published its own account of what went wrong. A few weeks before the theft, the company ran one of the best available AI models over this exact code, looking for security problems. The review came back clean. The company also believes that is how the attacker found the flaw, the firmware having always been open source. Both sides had the same tool. It worked for only one of them.
The episode highlights an important problem with AI-assisted security. A defender asks a model to review a codebase and needs it to spot every serious vulnerability. An attacker asks it to find one exploitable path and can afford any number of wrong answers because he needs only a single correct one. Defence has to be right everywhere. Offence has to be right once. Cheap code review does not soften that asymmetry – it accelerates it.
The asymmetry of defence
Which brings us to the mantra. Not your keys, not your coins. The oldest line in Bitcoin. It was aimed at exchanges, and last week it delivered exactly as written. The victims held their own keys. So did the attacker. The protocol has no view on which of them was the owner.
That is why recovery here is worse than difficult. Bitcoin is a bearer instrument. Whoever can produce a valid signature can move the coin. The network does not ask whether you are entitled to the funds. It asks only whether the signature is correct.
After that, the argument moves to the courts. You have to find the person, in a jurisdiction willing to hear you, then prove the wallet was yours and that the transfer was theft rather than authorised. From the chain alone, those stories can look the same.
Who would you sue?
Some years ago, a Bitcoin whale came into the office to hear about the digital asset products we were running. He asked about custody inside 90 seconds, then made a performance of not trusting a single name on the list. Enterprise-grade, ISO-certified, audited, insured – and, to him, beside the point, because somebody else held the keys.
My answer then is the one I would give today. A regulated custodian is the part of the structure that can be made to pay. If client assets are mishandled, there may be insurance, contractual liability, auditors and regulators to pursue. None guarantees recovery, but somebody is on the hook.
He chose otherwise, as was his right. The trouble is that the choice was made by slogan. Six words settled a question about a very large sum of money that deserved a conversation about failure modes, insurance and precisely who you would sue.
None of this is an argument for buying the ETF and switching your brain off. Self-custody did not fail here. One vendor's build pipeline failed, and every user who supplied his own dice rolls at set-up came through untouched. But the defect was invisible for five years, and it lived inside the exact ritual the practice tells you is the safe one.
No way to check
Which leaves the unpleasant part. There is no self-test. You cannot run anything against your own wallet to learn whether your seed fell inside the reproducible set, because a compromised seed and a sound one look identical. The only honest posture is to assume you are in it, and move the assets to a newly generated, secure wallet.
The lesson is not that self-custody does not work. It is that it transfers responsibility. The important question is not simply who holds your keys, but who bears the loss when those keys fail.
Yevgeny Bebnev is an investment professional and multi-manager fund specialist based in Dubai. He is also the founder and CIO of Alaris Capital
