Lines of code. 1,596 BTC gone

Aug 07, 2026 10:25 AM - 3 hours ago 2

Full incident study · 13 sources · Anzen Lab

Two files, 4 lines, 5 years unnoticed. This is the COLDCARD entropy nonaccomplishment taken isolated measurement by measurement — what the defect was, really attackers recovered the wallets, what affected owners should do — and the 4 checks OneKey runs truthful the aforesaid point cannot hap present quietly.

One overlooked setting, measured

5 years

the flaw sat successful afloat nationalist code, unnoticed1

1,596+ BTC

confirmed stolen from astir 7,300 addresses — and still rising7

41 min

the largest azygous expanse — 1,083 BTC, astir $70 cardinal astatine the time9

1 successful a trillion

the likelihood an attacker had to hit connected a Mk3 — the creation called for 1 chance successful a number pinch 78 digits1

What went wrong

A information cheque that was there, and did nothing

Six steps, nary jargon. The statement beside each 1 is the precise method version, for anyone who wants to cheque the work.

Everything other assumes this 1 number

A hardware wallet does respective jobs. It shows you what you are really signing alternatively than asking you to spot the surface of an infected computer, and it keeps your cardinal wrong a spot built to defy being opened. Every 1 of those defences assumes the aforesaid thing: that the number your cardinal was derived from could not person been guessed. If it could, an attacker ne'er has to get past immoderate of them. The excavation a 24-word building is expected to beryllium drawn from holds astir 1 number for each 1000 atoms successful the observable universe. The constituent was ne'er that your building is hidden. It is that the excavation cannot beryllium searched.

Technical detail

12 words transportation 128 bits of entropy, 24 transportation 256, positive a checksum from the SHA-256 of that entropy. BIP-39 stretches the consequence into the BIP-32 maestro key.

Technical detail

12 words transportation 128 bits of entropy, 24 transportation 256, positive a checksum from the SHA-256 of that entropy. BIP-39 stretches the consequence into the BIP-32 maestro key.

COLDCARD stopped drafting from that pool

A 2021 firmware alteration softly stopped the wallet asking its dedicated randomness spot for that number, and had mean package cipher 1 instead. Side by side, this is the full incident:

It is tempting to publication that arsenic information trim by 2 thirds. It is not. Each spot doubles the work, truthful losing 88 of them does not shrink the occupation by a facet of 3 — it shrinks it by a facet of 2⁸⁸. A trillion is still a ample number to a person; it is not a ample number to personification renting high-performance machines to activity done it 1 astatine a time.

Technical detail

Seed procreation moved from ckcc.rng_bytes() to ngu.random.bytes(). Coinkite estimates astir 40 bits of remaining hunt abstraction connected Mk3 and astir 72 connected Mk4/Mk5/Q, against a 128-bit target. Independent study by Block reaches the aforesaid bid — nether 2⁴⁰·⁷ and nether 2⁷³·³ — and finds narrower conditions wherever acold little is left.2

Technical detail

What 24 words should beryllium drawn from

115,792,089,237,316,195,423,570,985,008,687,907,853,269,984,665,640,564,039,457,584,007,913,129,639,936

What COLDCARD really drew from

1,099,511,627,776

Because package cannot beryllium random

Think astir what makes a coin flip unpredictable: the unit of the throw, gravity, a draught from an aerial conditioner, faint tremors successful the ground. Dozens of influences you tin sanction and dozens you cannot. Nobody tin compute the trajectory, truthful cipher tin telephone the result. Software has nary of that. It runs a fixed look complete a fistful of starting values and produces a fixed reply — and present the starting values were the chip's serial number and really agelong the instrumentality had been powered on. An attacker who learns the look and the ingredients does not conjecture the output. They recompute it.

Technical detail

With the hardware RNG disabled, rng_get() linked to MicroPython's Yasmarang PRNG, seeded from non-secret authorities — UID, SysTick, RTC — and it gathered nary caller entropy aft that, truthful candidates enumerate offline. Coinkite does not see seeds mixed pinch 50 aliases much fair, backstage rolls astatine consequence from this rumor alone: 50 × log₂6 ≈ 129 bits.3

Technical detail

And the cheque meant to extremity it asked the incorrect question

This is the portion worthy sitting with. There was a defender successful the build, written specifically to extremity firmware shipping without the hardware generator. It asked whether a mounting existed. It did not inquire whether the mounting was switched on. The mounting existed, and it was off. So the defender stayed quiet, the build reported nary errors, and the firmware shipped.

Technical detail

#ifndef only tests definedness. The committee config defined MICROPY_HW_ENABLE_RNG arsenic 0 — defined, and abnormal — truthful the #error ne'er triggered and the linker resolved rng_get() to the package fallback.3

Technical detail

The defect, quoted from the source. Two files, 4 lines, 5 years.3

Nothing astir it looked incorrect for 5 years

A anemic betterment building looks precisely for illustration a beardown one. Twenty-four mean words, the correct checksum, a instrumentality that behaves normally. No informing connected screen, nary correction successful the build, thing to notice. The root was nationalist the full time. Anyone could publication it. Being capable to publication codification is not the aforesaid arsenic personification having publication that portion of it.

Technical detail

Output length, non-zero-ness and non-repetition each walk connected a anemic PRNG, truthful the accustomed fume tests could not person caught it either.

Technical detail

Output length, non-zero-ness and non-repetition each walk connected a anemic PRNG, truthful the accustomed fume tests could not person caught it either.

Then personification did the arithmetic

They ne'er touched a azygous device. They generated the apt phrases connected their ain machines, worked retired which Bitcoin addresses each 1 would produce, and checked those addresses against the nationalist blockchain. Every reside holding a equilibrium was emptied. A wallet that had sat unplugged successful a drawer since 2022 was precisely arsenic exposed arsenic 1 successful regular use.

Technical detail

Candidates deduce offline done BIP-39/BIP-32; only the last equilibrium lookup touches the network, truthful location is nary awesome connected the victim's broadside beforehand.3

Technical detail

Candidates deduce offline done BIP-39/BIP-32; only the last equilibrium lookup touches the network, truthful location is nary awesome connected the victim's broadside beforehand.3

One be aware connected the estimates: they picture really overmuch guessing an attacker faces nether existent assumptions, not a stopwatch. Nobody tin show you really agelong immoderate peculiar wallet would return to crack.2

This page is not a triumph lap.

Coinkite disclosed this publicly, published a afloat method report, and shipped a due fix. COLDCARD being unfastened root is precisely why extracurricular researchers could portion the communicative together astatine all. We are penning it up because really it grounded is worthy knowing successful detail: a defect successful codification cipher was reading, and nary cheque connected the measurement retired that would person caught it.

If you ain a COLDCARD

Read this earlier thing else

What you request to do depends connected which instrumentality you were utilizing erstwhile the betterment building was first created — not which 1 you clasp today.

Assume this is still happening. The phrases were made guessable successful 2021 and the method is now public, truthful anyone tin tally the aforesaid hunt — location is nary spot that closes it from the outside, and nary logic for an attacker to stop. If you are affected, the safe presumption is that clip is the only point betwixt you and them.

Mk2 and Mk3 — move your coins now

The affected scope is firmware 4.0.1 done 4.1.9. Version 4.2.0 fixes really caller phrases are made, but nary update tin spell backmost and adhd randomness to a building that already exists. Create a caller wallet connected a instrumentality you spot and move your costs across.1

Mk4 and Mk5 — cheque the firmware version

If the building was created connected firmware older than 5.6.0 — aliases 6.6.0X connected Edge builds — update, create a brand-new wallet connected the updated firmware, past move your funds. Updating connected its ain does not repair the aged phrase.1

Q — same, the cutoff is 1.5.0Q

Update to 1.5.0Q aliases later, aliases 6.6.0QX connected Edge builds, create a caller wallet, constitute down and trial the backup, nonstop 1 mini trial transaction, past move the rest.1

Does updating COLDCARD firmware hole a betterment building I already have?

How do I find retired which firmware created my COLDCARD betterment phrase?

How do I cheque whether my reside was caught up successful this?

Do dice rolls aliases a passphrase protect a COLDCARD betterment phrase?

Does Coinkite’s advisory screen each affected COLDCARD?

Coinkite's charismatic method noticeMove to a caller wallet connected a instrumentality you already trust, and nonstop 1 mini trial transaction earlier migrating everything. Keep the nationalist grounds — transaction IDs, addresses, timestamps — and ne'er a secret. Treat anyone offering to retrieve your costs arsenic a 2nd theft successful progress; nary specified work exists. Deciding what hardware to bargain adjacent tin hold until your coins are safe — we would alternatively you took that determination slowly.

And if you ain a OneKey

No OneKey instrumentality is affected

Not 1 exemplary we person ever shipped. Our firmware carries nary libngu, Coinkite, COLDCARD aliases CKCC dependency — the codification way that grounded is not location to beryllium reached, and you tin cheque that yourself successful our repositories. On our existent hardware the cardinal comes from the existent random generator wrong a certified unafraid element, ne'er from package connected the main processor, and that substitution is what this nonaccomplishment was.

We did not return that connected spot either. When the news broke, Anzen Lab traced our randomness extremity to extremity — wherever it comes from, what calls it, and the build settings that determine which type reaches your instrumentality — and published the nonstop files they checked.12

Read Anzen Lab's re-check

The mobility you're really asking

Could this person happened to a OneKey?

This nonaccomplishment needed 3 abstracted things to beryllium existent astatine once. On a OneKey nary of them is — and each 1 is location you tin spell and cheque america alternatively than return our connection for it.

Where ours comes from

So wherever does OneKey's randomness travel from?

Made wrong an EAL 6+ certified chip

Your keys are created and kept wrong a dedicated, tamper-resistant spot alternatively than the general-purpose processor that runs everything else. EAL 6+ is the assurance people utilized for costs and personality cards.

Randomness that watches itself

That spot generates randomness from existent beingness noise, and continuously tests its ain output — if the randomness ever starts misbehaving, the spot notices alternatively of softly carrying on.

We went and re-checked ours

After the COLDCARD news, Anzen Lab traced our ain randomness the full measurement done — wherever it comes from, what really calls it, and the build settings that determine which type ends up connected your instrumentality — and published the nonstop files they looked at.11

OneKey Pro's EAL 6+ certified unafraid element

Each transaction, secured by EAL 6+ certified chips

Where the randomness is made

Assurance level

EAL 6+ certified

Entropy source

Hardware TRNG, self-testing

Output certified against

BSI AIS 20 / 31

Re-audited aft this incident

Anzen Lab, root published

Read the method detail

How OneKey is built, and who checks it

Four checks connected each OneKey, and nary of them trusts the different three

Any 1 of these tin miss something. The constituent is that each 4 would person to miss the aforesaid thing. COLDCARD had nary specified backstop: 1 unchecked build mounting was enough.

Open root you tin really verify

Our firmware and apps are nationalist connected GitHub — and our builds are reproducible, which intends you tin rebuild the codification yourself and corroborate it produces precisely the package moving connected your device. That is the measurement that catches a "right code, incorrect version" problem.

OneKey connected GitHub

SlowMist

Outsiders cheque us, connected the record

The information patient SlowMist audits america and publishes the reports — abstracted assessments screen OneKey Pro, the Classic 1S and our SDK. Our information practices are certified to ISO/IEC 27001, and the Pro and Classic 1S statement are certified against EN 18031 by an EU-appointed body. All of it published, nary of it self-assessed.13

Read the SlowMist audit summary

A squad paid to break our ain products

Anzen Lab is our in-house information squad — hardware, firmware and exertion information engineers, moving pinch a rotating group of extracurricular researchers. Their occupation is to break hardware wallets, ours included, earlier thing ships. When this communicative collapsed they re-examined OneKey’s ain randomness extremity to extremity and published precisely which files they checked.11

Read the Anzen Lab analysis

We salary strangers to find our mistakes

Anyone tin study a flaw to america privately, done our nationalist programme connected BugRap aliases consecutive to [email protected], and get paid for it. Severity decides the payout, scored connected CVSS. The full constituent is to make telling america much charismatic than trading it.15

OneKey connected BugRap

entro.tools · Built by our founder

Don't return our connection for it. Test the wallet successful your hand.

entro.tools is simply a free, open-source instrumentality that sounds the existent random numbers coming retired of a hardware wallet and runs the modular statistical wellness tests connected them — successful your browser, complete USB, pinch thing uploaded anyplace and nary firmware update required.

It useful connected Trezor and KeepKey arsenic good arsenic connected our ain devices, truthful you tin comparison them broadside by broadside alternatively of trusting immoderate azygous vendor's claim.

How it runs

In your browser, complete WebUSB

Tests applied

FIPS 140-2, NIST SP 800-22 / 90B

Your data

Never leaves the page

Firmware update

Not required

Runs FIPS 140-2, NIST SP 800-22 and SP 800-90B wellness tests locally complete WebUSB (desktop Chrome aliases Edge). The instrumentality asks to export entropy — a batch of random numbers it conscionable generated, ne'er your betterment phrase.16

# entro.tools :: study — simulated demo, browser CSPRNG# not a OneKey instrumentality — tally the instrumentality connected yours for thatcollected 13,312 bytes = 106,496 bit[ok] FIPS 140-2 §4.9.1 · monobit · poker · runs · agelong run→ each 5 blocks of 20,000 spot passed[ok] SP 800-90B §4.4 · RCT streak 2 (cutoff 5) · APT max 5 (cutoff 17)[ok] SP 800-22 rev1a · 11 tests astatine α = 0.01 · lowest p = 0.0404[skipped] Maurer's cosmopolitan · needs ≥ 387,840 bitShannon 7.9867 bit/byte · mean 126.37 · serial corr 0.00032[ok] Pass — nary statistical defect detected successful this sample$

# entro.tools :: study — simulated demo, browser CSPRNG

Maurer's cosmopolitan statistical trial needs astatine slightest 387,840 bits, and beneath that the study marks it skipped alternatively than softly leaving it out.16

Which wallets tin beryllium checked

Whether an outsider tin publication a device's earthy random numbers astatine all. This is 1 constrictive magnitude — spot the statement beneath it.

OneKey

All models, banal firmware16

Trezor

All models, shared ligament protocol16

KeepKey

Trezor wire-protocol family16

Ledger

Closed unafraid element; nary big bid exposes earthy random numbers16

BitBox02

The protocol's random-number petition was removed by the vendor16

Blockstream Jade

Host tin only adhd entropy; location is nary measurement to publication the root back16

COLDCARD

Has USB, but its protocol contains nary entropy bid astatine all16

Keystone

Air-gapped by design; USB carries only instrumentality info and firmware updates16

To beryllium adjacent astir it: "can't beryllium tested" is not the aforesaid arsenic "insecure" — closed unafraid elements travel their ain certification path. And a passing consequence proves only that location is nary detectable statistical defect today; it cannot beryllium cryptographic unpredictability, and it cannot vouch for the randomness utilized the time your wallet was first created.

Still wondering

Questions this raises for everyone else

Is OneKey affected by the COLDCARD entropy failure?

Which hardware wallets does the COLDCARD entropy nonaccomplishment affect?

Can I trial my ain wallet’s randomness?

How do I judge whether a hardware wallet tin beryllium trusted?

OneKey successful depth

We return connected the occupation of explaining the difficult parts

Security you tin check, not information you're asked to believe.

Open root and reproducible. Audited by outsiders. Attacked by our ain lab. And paid for erstwhile personification finds a hole. That is the argument; these are the devices it is about.

Cold Storage Weeks

Up to $50 successful Bitcoin pinch each device, until August 17.

OneKey Classic 1S Pure / BTC-Only

References

Everything connected this page is drawn from the sources below, retrieved August 6, 2026 — the vendor's ain advisory and method study first, past independent source-level study and on-chain accounting. Loss figures are still being revised upward: Galaxy Research's confirmed tally stood astatine 1,596 BTC connected August 4, pinch suspected losses nearer 2,055 BTC.

1. Coinkite — COLDCARD Mk3 Seed Generation Security Advisory
2. Coinkite — Technical Deep Dive into the Entropy Issue
3. Block Engineering — Predictable RNG Fallback and 32-Bit Reseed successful COLDCARD Firmware
4. CoinDesk — Bitcoin cold-wallet onslaught spreads to 4,500 addresses arsenic losses adjacent $89 million
5. CoinDesk — Major bitcoin wallet flaw drains 594 BTC successful 25-minute sweep
6. Crypto Briefing (Galaxy Research) — Galaxy Research identifies 1,367 BTC drained successful attacks connected Coldcard addresses
7. The Crypto Times (Galaxy Research) — Coldcard hack losses deed $100M pinch 1,596 BTC stolen successful ongoing attack
8. The Crypto Times (Galaxy Research) — 15 attackers utilization ongoing Coldcard hack arsenic losses attack $130M
9. The Hacker News — Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft successful 41 Minutes
10. Bitcoin Magazine — Coinkite Releases Fixed Firmware After Coldcard Bug
11. OneKey Anzen Lab — The COLDCARD Entropy Failure: How a Silent RNG Fallback Cost Users $38 Million
12. OneKey — Statement: OneKey devices are not affected by this issue
13. OneKey — OneKey has passed a information audit by SlowMist — abstracted reports screen the Pro, the Classic 1S and the SDK
14. SlowMist — SlowMist Audit Report — OneKey Pro
15. BugRap — OneKey Bug Bounty Program
16. entro.tools — Entropy Check — verify your hardware wallet's randomness (device support matrix)