At 01:31 UTC on July 31, 2026, bitcoin began leaving wallets whose owners had done nothing at all. By 01:56 — twenty-five minutes later — roughly 594 BTC, about $38 million, had been swept from around 500 single-signature wallets. Later analysis from Galaxy Research and Chainalysis coverage linked up to roughly 1,083 BTC across some 1,196 addresses. Nobody was phished. Nobody installed malware. Nobody approved a transaction. The one trait the victims shared was the date their wallet was created — because what failed was wallet entropy: the randomness a seed phrase is made from, fixed in the first second of a wallet’s life.
The wallets had been generated on Coldcard hardware devices, and the flaw behind them had been sitting in shipped firmware for more than five years. This article covers what happened, why this bug class stays invisible, what it does and does not say about hardware wallets — and what to ask about any wallet’s randomness, including ours.
A 2021 flaw, cashed out in 2026
According to Coinkite’s advisory, the flaw entered Coldcard firmware 4.0.0, released in March 2021. On affected devices, seed generation skipped the hardware random number generator and fell back to key material seeded by non-secret chip data. A BIP39 seed phrase is supposed to encode 128 bits of entropy — 2¹²⁸ possible seeds, a space no attacker can search. Seeds generated on affected Mk3 devices carried roughly 40 bits of effective entropy instead. 2⁴⁰ is about 1.1 trillion candidates — enormous to a human, entirely searchable to a machine. That is the Coldcard vulnerability explained in one sentence: the device quietly stopped using its own randomness, and nothing visible gave it away.
Two groups were never exposed: anyone who created their seed with a BIP39 passphrase, and anyone who generated it from 50 or more dice rolls. Coinkite disclosed the issue and shipped corrected firmware — 5.6.0 for the Mk4 and Mk5, 1.5.0Q for the Q. In the five years between, affected wallets worked flawlessly and looked identical to safe ones. Whoever ran the sweep never needed to touch a victim: enumerate the weak keyspace, derive addresses, match them against the chain, move everything in one 25-minute window.
Silent entropy degradation: why the seeds looked random
The unsettling part is that nothing about the affected seeds ever looked wrong. A seed built from 40 bits of predictable input still comes out as twelve perfectly ordinary BIP39 words with a valid checksum. The wallet accepts it, derives addresses, signs transactions; every screen shows exactly what a strong wallet would show.
Statistical testing cannot help either: a deterministic generator seeded with predictable data still produces output that passes randomness tests — the bits are well distributed, just drawn from a catastrophically small set of possible sequences. The weakness lives in a property no output can reveal: how many other seeds could have been generated instead. Only the generation code carries that answer.
A weak seed does not look weak. The difference between 2¹²⁸ and 2⁴⁰ exists only in the code that made the words.
That is why this bug class persists for years, and why the Coldcard incident belongs to a family. Milk Sad in Libbitcoin’s bx tool, the Trust Wallet browser extension’s MT19937 generator, Cake Wallet, the Profanity vanity-address tool, and Randstorm in early browser wallets all share one shape: a CSPRNG silently replaced by a predictable source — no error, no warning, no visible difference, until someone enumerates the keyspace.
The uncomfortable lesson
“Hardware wallet” names a form factor, not a guarantee. The wallets swept on July 31 were created on purpose-built signing hardware — and that was not the layer that failed. What decided survival was a property fixed years earlier: how the seed was generated on the day the wallet was created. Everything downstream — cold storage, air-gapped signing, careful verification — protects a key from being stolen. None of it helps if the key can be regenerated.
It matters equally that Coinkite disclosed the flaw and shipped fixed firmware promptly. This is not a story about a careless vendor; it is a failure mode the industry keeps rediscovering, in hardware and software alike. Any wallet — ours included — is one silent fallback away from the same class of bug. The honest question is not “which vendor is immune?” but “how would this wallet fail, and would anyone notice?”
Five questions to ask about any wallet’s randomness
You do not need to be a cryptographer to raise the bar. Five questions sort wallets meaningfully:
- What is the entropy source? A seed should come from a CSPRNG, not from timestamps, device identifiers, or anything an outsider could reconstruct.
- What happens if that source fails? The acceptable answer is a hard error that stops wallet creation. The unacceptable one is a quiet substitute — silent fallback is the defining trait of this bug class.
- Is the generation path open source and verifiable? Weak entropy is invisible in outputs, so code review is the only place it can be caught.
- Does the wallet support a BIP39 passphrase? A passphrase adds secret material the device’s generator never touched. It is the reason passphrase users on affected Coldcards lost nothing.
- In a multisig, are keys generated on independent devices? Independent devices mean independent randomness: one flawed generator compromises one key, not the quorum.
How Ownbit generates entropy
Questions like these deserve concrete answers about our own product. Ownbit’s mnemonic generation has two layers. At the app layer, generateMnemonicRandom(entropy, langIndex) calls generateMnemonic from the standard bip39 library — 128 bits of entropy by default, with eight BIP39 wordlists supported: English, Simplified and Traditional Chinese, Japanese, French, Italian, Korean, and Spanish. At the library layer, bip39’s randomBytes draws from crypto.getRandomValues — the platform CSPRNG.
What matters here is what happens when that source is unavailable: the library throws an error. It does not consult a clock, a chip identifier, or any secondary source — there is no fallback path in the code. The failure mode is a loud error at creation time, never a silently weaker seed. That property — fail loudly, never fall back — is the exact inverse of the flaw behind the Coldcard incident, Milk Sad, and Randstorm, where generation quietly carried on from a predictable source.
We will not claim this makes Ownbit immune to bugs; no honest vendor can. What it removes, by construction, is this failure shape: no code path exists on which an Ownbit wallet quietly generates a weak seed. The rest of the model is laid out on our security page.
Why independently generated keys survive this bug class
The July 31 sweep hit single-signature wallets: one seed, one signature, funds gone — the textbook case of a seed phrase as a single point of failure. Multisig changes the arithmetic. In an Ownbit MultiSig wallet, every key is its own standard BIP39 seed phrase, generated on that participant’s own device. Suppose one device carried exactly this class of flaw. In a 2-of-3 wallet, an attacker who enumerates the weak keyspace holds one key — below the threshold. Nothing moves. A weak key becomes a maintenance task — rotate it — instead of a loss.
The protection comes from independence, not from the word “multisig.” Three cosigner keys generated on the same flawed device model would fail together. Three keys born on genuinely different devices — your daily phone, a spare phone kept offline as a QR-signing cold wallet, a family member’s device — share no generator, so they share no bug. The same logic explains why a BIP39 passphrase saved affected Coldcard users: the passphrase is secret material the device RNG never produced, so enumerating 2⁴⁰ seeds was not enough to spend.
If you own an affected Coldcard
Three actions:
- Update the firmware. The fixed releases named in Coinkite’s advisory are 5.6.0 for the Mk4 and Mk5, and 1.5.0Q for the Q.
- Move funds to a new seed generated on fixed firmware. Updating protects future seeds; it cannot strengthen an existing one. A seed born with roughly 40 bits stays enumerable forever — retire it completely, never re-use it, never send funds back to its addresses.
- Never type an existing seed phrase into any website offering to “check” whether it is vulnerable. Entering a seed into anything online is how remaining funds get taken; “checker” sites are a standing phishing pattern after incidents like this.
Frequently asked questions
What is wallet entropy?
Wallet entropy is the randomness used to create a seed phrase. A standard 12-word BIP39 seed encodes 128 bits of it — 2¹²⁸ possible seeds. If the generator is predictable, the real number of possible seeds collapses, and an attacker can enumerate them regardless of how the seed was stored afterwards.
Is my Coldcard affected?
Per Coinkite’s advisory, the flaw entered firmware 4.0.0 in March 2021, and affected Mk3 seeds carried roughly 40 bits of effective entropy instead of 128. Seeds created with a BIP39 passphrase or from 50 or more dice rolls are not at risk. If in doubt, update to the fixed firmware — 5.6.0 for Mk4/Mk5, 1.5.0Q for the Q — and move funds to a newly generated seed.
Can a weak seed be detected by looking at it?
No. A weak seed still produces twelve normal words with a valid checksum, and statistical tests cannot reveal a predictable source. Strength is a property of the generation code, not of the words — which is why the affected wallets went unnoticed for more than five years.
Does multisig protect against weak entropy?
Structurally, yes — provided the keys are generated on independent devices. One weak key gives an attacker one signature — below an M-of-N threshold — so funds do not move. Keys generated on the same flawed device model could fail together, which is why independence matters as much as the threshold.
Should I stop using hardware wallets?
No. The lesson is narrower: the phrase “hardware wallet” is not itself the guarantee — how the seed was generated is. Keep using well-maintained devices, apply firmware updates, add a BIP39 passphrase where supported, and put serious balances behind a multisig threshold rather than any single seed.
If this incident has you re-examining your own setup, the structural fix is to stop letting any single seed stand alone between your funds and an attacker. Ownbit’s MultiSig wallet puts an M-of-N threshold across keys generated on independent devices, each one a standard BIP39 seed phrase. Every new user gets a 7-day free trial, and the keys are yours regardless.