Kraken chief security officer Nick Percoco has called for independent testing of hardware wallet firmware after a five-year Coldcard seed-generation flaw was linked to suspected attacks that have drained almost $90m (£67m) in Bitcoin from thousands of wallets.
Writing on X on Sunday, Percoco said the incident should be treated as a warning for the hardware wallet industry. He argued that manufacturers should not be the only organisations checking how wallet seed phrases are generated.
Percoco said production firmware should be independently tested to establish whether it is using the approved source of randomness when creating wallet secrets.
The scale of the suspected theft remains uncertain. Galaxy Research’s latest blockchain analysis identified more than 1,800 BTC taken from 5,200 potential victim addresses across four observed attack waves. However, Galaxy said those figures were on-chain estimates rather than confirmed losses. Coinkite has not verified every affected wallet, while blockchain data cannot establish whether all of the attacks were carried out by the same person or group.
Coinkite disclosed the vulnerability on Thursday, saying it dated back to March 2021. The problem emerged when the company migrated part of its firmware while integrating a new cryptographic library.
The updated firmware mistakenly used a weaker deterministic pseudo-random generator supplied by MicroPython instead of Coldcard’s intended hardware-backed true random-number generator when creating wallet seeds.
In its postmortem, Coinkite said the intended random-number generator remained active elsewhere in the firmware. That meant code reviews could confirm that the approved component was present without revealing that a different source of entropy was being used during wallet creation.
The company said it did not know the MicroPython generator existed on the relevant code path until its investigation. Although the hardware random-number generator continued to operate for other functions, it was no longer generating new wallet secrets.
Block’s Bitcoin engineering and security team reached the same conclusion in an independent technical review. Block said the affected firmware called the deterministic MicroPython fallback rather than the STM32 hardware random-number generator when producing wallet seeds. It had not completed empirical testing on every device, but chose to publish its findings after reports of active theft had emerged.
Coinkite estimates that seeds generated on affected Mk2 and Mk3 devices may have had about 40 bits of effective entropy. On affected Mk4, Mk5 and Q models, the figure may have been about 72 bits, rather than the intended 128 bits.
Percoco used the Coldcard incident to argue that hardware wallet certification has failed to scrutinise a crucial part of wallet security. He said users currently have to trust manufacturers to implement seed generation correctly because there is no independent process confirming that production firmware actually calls the approved entropy source.
According to Percoco, existing checks including Common Criteria evaluations for secure elements, CSPN reviews and vendor-sponsored audits do not systematically verify that connection.
He pointed to NIST SP 800-90B, the United States standard for designing and validating true random-number generators used in cryptographic systems, and Germany’s BSI AIS-31 framework, which sets comparable testing requirements. Percoco said the hardware wallet sector did not currently have an equivalent end-to-end verification process.
He also compared the industry with payment security. PIN entry devices cannot be shipped without independent laboratory testing, while US government cryptographic modules require entropy-source validation before approval.
Coinkite halted all shipments after confirming the vulnerability and said it had destroyed every remaining device at its facilities that contained the affected firmware. The company nevertheless advised customers not to throw away affected devices, saying they could become important if stolen funds were recovered through legal proceedings. Its legal team will coordinate with law enforcement agencies in multiple jurisdictions where appropriate.
Firmware updates have been issued for all affected models. Version 4.2.0 applies to Mk2 and Mk3, version 5.6.0 to Mk4 and Mk5, version 1.5.0Q to Coldcard Q, and versions 6.6.0X and 6.6.0QX to Edge releases.
Coinkite has warned that installing the new firmware only protects future wallet creation. It does not strengthen seed phrases generated before the update.
Affected users are therefore being instructed to create completely new seed phrases after updating their devices. They should verify a receiving address, send a small test transaction and move their remaining balance only after confirming that the transfer was successful.
Coinkite said wallets generated using at least 50 fair, private dice rolls were not considered exposed by the random-number-generation flaw alone. It added that a strong, unique BIP-39 passphrase offers further protection, but does not remove the weakness from a seed that was already affected. Migration remains the recommended action.
Galaxy Research said the attacks had continued after the vulnerability became public. Alex Thorn, Galaxy’s head of research, identified what he described as a suspected fourth coordinated attack wave on 3 August. That took the firm’s observed total to about 1,815.75 BTC across 5,294 potential victim addresses, assuming none of the address groups overlapped.
Thorn described the wallets as “likely Coldcard victims”, while stressing that the figures were based on blockchain analysis rather than confirmed device records or law-enforcement findings.
Galaxy said the latest wave saw activity reach 13.8 wallet sweeps per block, compared with a pre-incident baseline of 0.3 sweeps per block. Most victim balances were sent to newly created addresses instead of one central collection wallet. Some funds had also moved through second-hop transactions, making the stolen Bitcoin more difficult to trace.
Users whose stolen funds remain in unconfirmed Bitcoin transactions may have a limited chance to issue a higher-fee replacement transaction before miners confirm the original transfer. Citing Bitcoin Core documentation, Galaxy said Replace-by-Fee can only be attempted while a transaction is still unconfirmed, and does not guarantee recovery even if the legitimate owner continues to control the affected keys.
