Cabinet
レポート一覧に戻る
Wallet
Security
Incident
Security Audit
2026年08月05日

One Broken Random Number, $130 Million Gone: The Coldcard Incident Explained, Technically and Socially

「乱数」がひとつ壊れただけで、200億円が消えた——Coldcard事件を技術と社会の両面から読み解く

Technical: The Problem Was How the Secret Was Made

A Bitcoin wallet derives all its keys and addresses from a secret value called a seed, usually displayed as 12 or 24 words. A properly generated 12-word seed carries 128 bits of entropy—an astronomically large number of combinations that makes brute-forcing effectively impossible. What guarantees that impossibility is not the strength of the cryptographic algorithm but the unpredictability of the randomness used when the seed is created.

Coldcard was designed to draw that randomness from a hardware random number generator inside the device's microcontroller, sourced from physical electrical noise no outside observer can predict. The design itself is sound.

The problem arose in 2021, when Coinkite migrated its cryptography onto libsecp256k1, the same library Bitcoin Core uses. During that migration two random-number functions with matching interfaces became confused, and seed generation began calling not the hardware generator but MicroPython's software fallback, a small algorithm called Yasmarang intended for devices with no randomness chip at all.

The root cause is smaller still. A build guard used #ifndef, which checks whether a setting is defined rather than whether it is switched on. The equivalent of confirming a switch exists on the wall without checking whether it is flipped up. The randomness chip was present. It simply stopped being asked.

The result was that seeds on Mk3-generation devices carried roughly 40 bits of entropy instead of 128. Forty bits is about one trillion possibilities—vast to human intuition, small to a computer. A modern GPU cluster can enumerate that range in hours.

Why Theft Required No Physical Access

What makes this incident unsettling is that the attacker touched no device and intercepted no communication. The method is simple: generate candidate seeds, compute the Bitcoin addresses each would produce, and compare them against the public blockchain. Any match with a funded address is a wallet that opens.

The very property that makes Bitcoin's ledger readable by anyone served as the attacker's lookup table. Transparency is the source of auditability and, when keys are weak, the mechanism that makes victims automatically discoverable. That duality has never been displayed as starkly.

The attack began July 30. Within roughly 25 minutes, about 594 BTC—then worth close to $38 million—moved out of approximately 500 wallets into a single consolidation address. At least four waves followed over the next four days. According to TRM Labs, transaction construction differs across waves, suggesting multiple attackers may be involved; the firm is not attributing the theft to any specific actor at this stage.

Social: Three Kinds of Trust Shaken at Once

First, the premise of self-custody. "Hold your own keys and no one can take them" is true, but it silently assumed the keys were correctly generated. TRM Labs notes that self-custody relocates risk rather than eliminating it, and that a wallet is only as trustworthy as the process that generated its key. Users have no independent means of verifying that their seed came from sufficient randomness. This is not specific to Coldcard: it is the third instance of the same pattern after Milk Sad in 2023 and Ill Bloom in July 2026.

Second, trust in open source. Coldcard carried the configuration this field treats as exemplary—Bitcoin-only design, dual secure elements, published firmware. Nobody found the flaw for five years. Open source and audits improve security without guaranteeing it. Remediation is limited too: updating firmware does not repair seeds already generated. Users must create a new seed and move funds manually. As of early August, Coinkite had announced no compensation plan.

Third, trust in vendor data handling. To reach potentially affected users urgently, Coinkite emailed every purchase address on file going back to 2019. That response revealed that addresses the company had said were deleted after 90 days had in fact been retained, and the company acknowledged that no deletion schedule existed. A list of hardware wallet purchasers is effectively a list of asset holders, and potentially a physical target list. The emergency response exposed a different risk.

The Funds Are Not Moving, Which Is Unusual

Another distinctive feature is the stillness of the stolen funds. Galaxy Research reports roughly 90 percent unmoved, with the confirmed first through third waves entirely static. TRM's tracing found laundering limited to a single 64.9 BTC Wasabi deposit and 200 ETH sent to Tornado Cash on August 4, with everything else amounting to one additional consolidation hop. That contrasts sharply with groups such as North Korea's TraderTraitor, which typically begin aggressive laundering within hours or days, and suggests an attacker still working out how to move a sum this large. Notably, OP_RETURN fields on-chain carried spam messages addressed to the hackers, including an offer to launder the funds for a seven percent fee.

Market behaviour has been less calm. Bitcoin's active address count spiked after the incident, though this likely reflects funds fleeing to safety rather than adoption. The CEO of Swan Bitcoin has said affected holders are not abandoning self-custody but migrating to multisignature vaults where compromise of any single device does not endanger the funds.

Business Development Insights

  1. Key generation belongs explicitly in due diligence scope. Firms and institutional investors evaluating custody tend to focus on physical device hardening and certifications, but what broke here sat upstream of all of that. As TRM Labs notes, firmware and entropy generation deserve the same scrutiny as the device itself. Three practical questions capture it: what is the entropy source, how is it verified that the call to that source is actually active, and does the user have any independent way to confirm the quality of a generated seed. Almost no product can answer the third, which marks a structural gap.
  2. Avoiding dependence on any single implementation is the only defence with real effect. With updates unable to repair existing seeds and no compensation framework, remedies after the fact are limited. What works is a multisignature setup combining independently designed devices and independently generated entropy, structuring things so no single implementation flaw becomes total loss. As corporate crypto holdings grow in Japan, self-custody on a single device from a single vendor should now be treated as explicitly inadvisable, and the presence or absence of this design distribution is worth adding as a line item in board-level documentation.
  3. Emergency customer notification collides with peacetime privacy policy, and that conflict must be resolved in advance. Coinkite contacted past purchasers to protect them, and in doing so revealed retention of personal data it had said was deleted. Any firm offering crypto-related products needs a plan, designed in advance and consistent with its data retention policy, for who gets contacted and how when a serious vulnerability surfaces. Failing to notify lets harm spread; notifying reveals that a holder list exists. Having an answer to that bind is a substantive differentiator in dealings with institutional customers.

Sources

Supervisor

Akihisa Ishida

Cabinet Inc. Founder CEO

Since 2017, He has been consistently engaged in token and NFT utilization, blockchain game planning and development, and NFT-based business development. Having contributed to over 80 blockchain products—including projects for major entertainment companies listed in Tokyo Stock Exchange —He has served in various key roles such as Business Lead, Designer, PM, and Advisor. In 2021, founded Cabinet Inc.

Disclaimer

This report has been prepared solely for informational purposes regarding crypto assets and related markets, and is not intended to recommend, solicit, or offer the purchase, sale, holding, or any other transaction of any specific crypto asset. It does not constitute investment advice, investment solicitation, or the sale or intermediation of financial products as defined under the Financial Instruments and Exchange Act or any other applicable laws and regulations, nor does it constitute tax, legal, or accounting advice.

The information contained in this report is based on sources believed to be reliable at the time of preparation; however, we make no representation or warranty, express or implied, as to its accuracy, completeness, timeliness, or usefulness. Crypto assets are subject to significant price volatility and may result in the loss of principal or other financial losses. Any investment decision shall be made solely at the user's own discretion and responsibility, and we accept no liability whatsoever for any damages arising out of or in connection with the use of this report.

Blockchain Business Consultation

From idea-stage brainstorming and technical validation (PoC) to implementation and operations, Cabinet provides end-to-end business development consulting. Start with a free consultation today.

← Previous Article

The Word "stablecoin" on a Convenience Store Receipt: What Lawson's POS Pilot Actually Crossed

Next Article →

Money That Never Sleeps: What JERA, J.P. Morgan and the BIS Reveal About the Next Shape of Corporate Treasury

Sign Up for Newsletter

Beyond the content of this report, we will deliver the latest industry information and exclusive reports by email.