The Coldcard losses passed $88 million, and the cause was 56 missing bits
The devices were never compromised and Bitcoin’s cryptography never broke. The seeds those devices had already produced simply turned out to be findable, and the running loss total is still climbing.
The running total from the Coldcard hardware-wallet exploit has moved again. What was first reported as roughly $70 million drained on July 30 now stands above $88 million as more affected addresses are identified, and the figure is still climbing.
The expanded number does not change the technical nature of the attack. It changes the measured blast radius, and it keeps a question in front of every self-custody holder that most would rather not sit with: the device did its job, and the money left anyway.
What actually broke
This was not a break of Bitcoin's cryptography, and it was not a supply-chain tamper. Coinkite disclosed a firmware defect that weakened the randomness used when a device generated a wallet's recovery seed.
The specific failure is worth stating precisely, because the precision is the lesson. A firmware integration error introduced in March 2021 routed seed generation to a deterministic software pseudorandom number generator instead of the STM32 hardware random number generator the device shipped with. Seeds created on affected Mk4, Mk5 and Q units carried roughly 72 bits of entropy instead of the intended 128.
Fifty-six missing bits does not sound like a catastrophe until you consider what the exponent does. A 128-bit search space is not searchable by anyone, ever, with any hardware. A 72-bit space is a computing budget. That is the entire distance between "unguessable" and "enumerable", and it is why attackers could reconstruct private keys without ever touching a device, going near its owner, or exploiting anything at the moment of the theft.
The devices were never compromised. The seeds they had already produced simply turned out to be findable.
The scale, and how fast it happened
More than 1,000 bitcoin came out of 1,196 wallets in a 41-minute window on July 30. Not 41 hours. Once you can enumerate the keyspace, there is no detection window and no chance to react, because nothing anomalous happens until every transaction is already signed and valid. The affected keys had been quietly vulnerable for as long as five years before anyone moved on them.
Bitcoin has treated the news as contained so far, consolidating near $63,000 through August 2. That is a reasonable market response to an issue confined to one vendor's firmware, but the rising loss total keeps the story open, and "contained" is a statement about price rather than about how many vulnerable seeds are still sitting in wallets that have not yet been swept.
Cryptographic risk versus operational risk
The distinction this incident illustrates is the one that most self-custody discussion gets backwards. There is a persistent conversation about future threats to the underlying cryptography, quantum computing chief among them, conducted largely in the abstract. Meanwhile the losses that actually occur come from implementation and process: firmware, key generation, backup handling, custody practice.
This was the second kind. Nothing about Bitcoin's cryptography failed. A build configuration in one vendor's firmware silently disabled the hardware entropy source, and five years later that quietly cost holders more than $88 million.
The practical implication is unglamorous. The largest near-term threat to a holder is not a theoretical advance in computing. It is whether the specific device in the drawer generated its seed correctly, and whether anyone would notice if it had not.
If you hold a Coldcard
Coinkite has released patched firmware for all affected devices. The critical detail is that updating alone is not sufficient: a seed generated under the vulnerable firmware stays weak no matter what firmware runs afterward, because the weakness is in the key that already exists. Affected users need to update and then migrate funds to a newly generated seed. The advisory also asks users to stop creating new wallets until the device is updated.
Mk2, Mk3, Mk4, Mk5 and Q devices are all implicated across the affected firmware range. If you are unsure when a seed was generated, treat it as in scope. Check the vendor's advisory directly rather than a summary of it, this one included.
Nothing here is financial or security advice. It is a description of a disclosed vulnerability and the vendor's published remediation.