Since July 30, attackers have drained more than $116 million from Coldcard wallets whose seeds were generated by flawed firmware — the full story is on our live tracker. But inside that disaster sits one remarkably clean data point: users who had enabled a BIP39 passphrase were not drained, even though their seeds were exactly as compromised as everyone else's. Same devices, same firmware, same weak randomness — different outcome. That divide is worth studying carefully, because it's the strongest real-world evidence the passphrase has ever produced.
The fact worth studying
The attackers' method was to reproduce the weak seeds offline, derive the addresses those seeds control, and sweep whatever they held. It worked against thousands of wallets. It failed completely against passphrase users — not because their seeds were stronger, but because the seed alone was no longer the whole key. Watching the waves unfold on-chain, that pattern held from the first hours: the drained addresses were overwhelmingly standard, passphrase-free wallets.
How a passphrase actually works
A BIP39 passphrase — often called the 25th word, though it can be a whole sentence — is combined with your seed words during key derivation. Seed plus passphrase produces a completely different wallet than the seed alone: different private keys, different addresses, no visible connection between the two. Two properties make this powerful. First, the passphrase is never stored on the device and never touched its random number generator — it exists only where you keep it. Second, there's no "wrong passphrase" error: every passphrase opens a valid wallet, just not necessarily one with your coins in it, which means an attacker can't even tell whether a passphrase is in use, let alone brute-force toward a confirmation.
Why it defeated this specific attack
The Coldcard flaw poisoned exactly one ingredient: the randomness behind the seed. Attackers who enumerated the weak keyspace obtained thousands of valid seeds — and for passphrase users, those seeds opened the decoy wallet: the passphrase-free derivation, typically empty or holding a deliberate trap amount. The wallet actually holding funds required a second ingredient that never existed on the device, was never derived from the broken RNG, and appears nowhere on-chain. The attack automated perfectly against one-secret wallets and hit a wall against two-secret ones. If you own a Coldcard and haven't yet worked through your own exposure, our check-and-migrate guide walks through it step by step.
What the on-chain data showed
The evidence for the passphrase's effectiveness isn't a vendor claim — it's visible in the drains themselves. The attackers' sweeps were exhaustive within the weak keyspace: they checked essentially every reproducible seed for balances and took everything reachable, over 5,200 addresses so far. What the stolen set conspicuously lacks is passphrase-derived wallets, because those addresses simply never appeared in the derivations the weak seeds produce on their own. Researchers following the waves — and the community members who watched their own decoy wallets get probed while their passphrase wallets sat untouched — confirmed the same split from the first days. It's rare for a security control to get a clean, large-scale, adversarial test. This one did, and it passed absolutely.
The honest trade-offs
Before this reads as a commandment to enable a passphrase tonight, the drawbacks deserve equal air time. A passphrase has no recovery mechanism whatsoever. Forget it, and your coins are gone with a finality that makes exchange hacks look gentle — the seed words in your safe will open only the empty decoy wallet, forever. A single typo when funding the wallet creates the same result: coins sent to a derivation you can't reproduce. And a passphrase stored in the same place as the seed adds nothing at all — a thief who photographs your backup card gets both ingredients at once. The passphrase moves risk; it doesn't remove it. It trades "someone else might reproduce the key" for "the owner might lock themselves out." Which of those risks you would rather manage is a personal question — but it should be answered consciously, not by default.
Passphrase or multisig?
For larger holdings, the honest comparison is with multisig, which solves the same single-point-of-failure problem differently: instead of one seed plus a secret, you need multiple independent seeds to move funds, so one compromised or lost key is survivable. Multisig is more forgiving of a single mistake but more complex to set up and inherit; a passphrase is simpler and cheaper but absolutely unforgiving of memory failure. A reasonable rule of thumb from watching how people actually fail: a passphrase suits disciplined users protecting meaningful but not life-changing amounts; multisig earns its complexity as the stakes rise.
There's also a quieter benefit worth naming: plausible deniability under duress. Because the seed alone opens a perfectly valid wallet, some users deliberately keep a modest amount on the passphrase-free derivation — enough to look like the whole holding — while the real savings live behind the 25th word. Against a $5-wrench attacker or a coerced border inspection, the decoy is the wallet you can "honestly" open. It's a niche scenario, but it illustrates the deeper design: the passphrase doesn't just add a secret, it makes the very existence of your real wallet unprovable.
Setting one up without hurting yourself
A few words on choosing the passphrase itself, because bad choices quietly undermine the whole mechanism. A single dictionary word adds little against an attacker who has the seed and can grind guesses offline; a famous quote or song lyric adds even less. Aim for genuine length — several unrelated words, or a full sentence only you would produce — and treat it with the same respect as the seed: it is not a login password protecting an account, it is half of the key protecting the money itself. Never store it digitally, never speak it near a phone assistant, and never keep it in the same drawer, safe, or photograph as the seed words.
If this incident has convinced you, move deliberately. Understand the mechanism before trusting it — our dedicated passphrase how-to guide exists precisely for that, covering choice, storage, and the failure modes in depth. Test the full cycle with a small amount first: create the passphrase wallet, send a little in, wipe or restart, and prove you can restore access before a single serious satoshi moves. Store the seed and the passphrase separately, both durably — paper or steel, never a photo or a cloud note. And write down, for your future self and your heirs, the fact that a passphrase exists at all; the decoy-wallet property that defeats attackers will just as thoroughly defeat a grieving family that doesn't know the 25th word exists.
The takeaway
The Coldcard hack will be studied for years, and its clearest finding is this: the users who assumed their device might one day fail them — and added a second secret it never knew — were right. Defense-in-depth isn't paranoia. On July 30 it was the difference between a bad headline and an empty wallet.