By now most of the Bitcoin world has heard the headline: more than $116 million drained from Coldcard wallets since July 30, with the running totals still climbing on our live tracker. What's been harder to find is a plain-English explanation of how this was possible — how attackers emptied hardware wallets they never touched, never phished, and never plugged in. The answer comes down to one word that most users never think about: entropy. I've been in Bitcoin since 2013, and this incident is the clearest lesson on randomness the ecosystem has ever produced. Here's what actually happened, without the jargon.
What entropy means for a Bitcoin seed
Your 24-word seed phrase is just a human-readable encoding of a very large random number — 256 bits of it. The security of every Bitcoin wallet on earth rests on a single assumption: that this number was picked so randomly, from a space so enormous, that nobody could ever guess it. And the space really is enormous. 2^256 is a number with 78 digits — comfortably more than the number of atoms in the observable universe. If every computer humanity has ever built worked together to guess seeds until the sun burned out, they wouldn't scratch the surface.
To feel the scale: imagine every grain of sand on every beach on Earth. Now imagine each grain contains an entire copy of Earth, with all of its beaches. You would need to repeat that nesting several more times before the count of grains approached the count of possible seeds. Lotteries, coin flips, guessing someone's password — nothing in everyday probability prepares you for how unguessable a properly generated seed is. That's the standard your wallet is supposed to meet.
But that guarantee has fine print: it only holds if the number was actually drawn from the full space. If the process that generated it was flawed — if it could only ever produce, say, a few billion different outcomes instead of 2^256 — then the seed merely looks random. The words on paper are indistinguishable from a safe seed. The math underneath is a house of cards.
Where the randomness is supposed to come from
This is precisely why hardware wallets exist. A good one contains a true random number generator — dedicated circuitry that harvests physical noise (electrical jitter, thermal fluctuations) that nobody, including the manufacturer, can predict or reproduce. Software pseudo-random generators, by contrast, are deterministic: feed them the same starting state and they produce the same "random" sequence every time. They're fine for shuffling a playlist. They are catastrophically wrong for generating keys that guard money, unless they're seeded with genuine hardware entropy.
What went wrong in March 2021
A Coldcard firmware build released in March 2021 broke that chain. Instead of drawing seed material from the device's true hardware RNG, the affected code path fell back to a weak pseudo-random generator with a predictable starting state. Every seed it produced came from a drastically smaller effective keyspace — small enough that an attacker who understood the flaw could simply enumerate the possibilities on ordinary computers, offline, at their leisure. No malware, no supply-chain tampering, no physical access. Just arithmetic.
The flaw sat unnoticed for over five years. Then someone did the arithmetic. Every wallet drained since July 30 traces back to a seed generated on that firmware after March 17, 2021 — seeds that passed every visual inspection and worked flawlessly for years, right up until the moment they didn't.
Why wallets could be drained without touching the device
Here's the part that confuses people: a Bitcoin private key isn't in your hardware wallet in any exclusive sense. The device just stores a number. Anyone who can reproduce that number owns the same wallet, from anywhere on the planet. So the attackers regenerated the weak seeds in bulk, derived the addresses each seed controls, checked them against the blockchain for balances, and swept the funded ones. The victims' devices sat untouched in drawers while their keys were being reconstructed on someone else's hardware. That's why our step-by-step guide for Coldcard owners is blunt about it: if your seed came from the affected code path, moving the funds to a fresh seed is the only fix. There is nothing to patch on a key that someone else can recompute.
The on-chain fingerprint
The drains are easy to spot once you know what to look for. The sweeps are automated and mechanical: consistent fee rates across thousands of transactions, entire balances taken in one shot with no change outputs, victims processed methodically from the largest balances down. The first wave emptied over 1,000 addresses in 41 minutes. Since then, distinct fee and batching patterns show at least fifteen separate operations racing each other for the remaining vulnerable wallets — a gold rush on a public flaw. The tracker follows each wave as it's confirmed on-chain.
Why a BIP39 passphrase defeated the attack
One group of affected-firmware users kept their coins: those using a BIP39 passphrase. The passphrase — often called the 25th word — is combined with the seed to derive an entirely different set of addresses, and crucially, it never came from the device's random number generator. It lives in the user's head or on their own backup. An attacker who reproduces the weak seed gets the unprotected wallet, which for passphrase users is empty. The compromised ingredient alone wasn't enough. Our passphrase guide covers how to use one without creating new ways to lose your coins.
Could the same thing happen to other wallets?
It's the obvious next question, and the honest answer is: in principle, yes — RNG failures are not unique to one vendor. Debian's OpenSSL bug in 2008 produced guessable SSH keys for two years; Android's SecureRandom flaw in 2013 let attackers sweep early mobile wallets; weak "brainwallets" have been drained for a decade. What makes this class of bug so dangerous is that open source alone doesn't catch it — Coldcard's code was public for the entire five years the flaw existed, reviewed by a community that missed it, and every device passed its self-tests. Randomness bugs don't crash anything. They produce output that looks perfect and fails silently, which is why they're consistently among the longest-lived vulnerabilities in cryptography. The defense isn't picking the one vendor that will never make this mistake — nobody can know that in advance. The defense is arranging your setup so that no single RNG failure, from any vendor, can cost you everything.
The lesson: entropy is invisible
The unsettling takeaway is that entropy can't be eyeballed. A weak seed and a strong seed look identical — twenty-four ordinary words. That invisibility is exactly why belt-and-suspenders practices exist: adding your own dice-roll entropy takes the manufacturer's RNG out of the trust equation entirely, and multisig ensures no single seed — however it was generated — can lose your funds alone. Handle the words themselves with the care they deserve too; our guide to critical seed phrase mistakes covers that side. Randomness failed quietly for five years. The defenses that worked were the ones that never trusted it blindly.