The Lock Was Milled Predictable: What the 594-BTC Coldcard Sweep Teaches About Entropy

Updated 31 July 2026: Coinkite’s advisory has widened since first publication. It now states that seeds generated on the Mk4, Q and Mk5 are also affected — at roughly 72 bits of entropy rather than the expected 128 — "not as severe" than the Mk3 but "still serious." An earlier line in the same advisory still reads "not affected based on our early analysis," which the newer, more specific figure supersedes. Treat the entropy flaw as confirmed across the product line; treat its causal link to this particular sweep as still under investigation. The technical corrections below reflect the updated advisory.

On July 30, roughly 594 BTC (~$38M) left about 500 single-signature addresses in a 15–25 minute window. Many had been dormant since 2021. Within hours, on-chain sleuths and then Coinkite itself converged on the same suspect: seeds generated on the Coldcard Mk3, firmware v4.0.1 and later, carry insufficient entropy — and, per the updated advisory, the newer Mk4, Q and Mk5 are affected too, less severely (~72 bits vs the expected 128). This is worth dissecting carefully, because the failure mode here is the most instructive one in all of applied cryptography — and the one people most consistently misunderstand.

The safe was not cracked. Nobody brute-forced SHA-256 or broke the secp256k1 curve. If the leading hypothesis holds, the lock was milled — at the factory — with a key that could be predicted. Coinkite has now confirmed an entropy flaw across the product line; what remains under investigation is whether that flaw is specifically what emptied these 500 wallets. But the distinction the metaphor draws is the durable lesson either way — so hold onto it.

Why "impossible to guess" rests entirely on entropy

A BIP-39 seed is just a number. A 24-word seed encodes 256 bits of entropy; 12 words, 128 bits. The security argument for Bitcoin custody is not that your key is hidden — every public key is, by definition, public — it is that your private key sits in a space so vast (2²⁵⁶) that enumerating it is thermodynamically impossible. The entire edifice depends on one assumption: that your key was drawn uniformly at random from that space.

Break that assumption and everything downstream collapses silently. If a device’s random number generator only produces, say, 2³² distinct possible seeds instead of 2²⁵⁶, then the keyspace an attacker must search is not astronomically large — it is a weekend on a single GPU. The addresses look completely normal on-chain. The signatures verify perfectly. Nothing is detectably wrong until someone who has pre-computed the reachable keyspace decides to sweep it. And note the gradient the advisory now describes: even the newer models’ ~72 bits, while astronomically stronger than a degraded 2³², is a large step down from 128 — a reminder that entropy failures come in degrees, not just as on/off.

The anatomy of an entropy failure

Hardware RNG failures are a recurring genre, not a novelty. The classic patterns:

• Under-seeded PRNG. A deterministic pseudo-random generator is only as unpredictable as its seed. Seed it from a low-entropy source (a boot-time counter, an uninitialized variable, a weak hardware noise source) and its entire output stream becomes predictable. This is what felled the Android SecureRandom Bitcoin thefts of 2013.
• Biased hardware noise. A ring-oscillator or diode-noise source that is skewed, temperature-sensitive, or insufficiently conditioned yields bits that are correlated rather than uniform. Effective entropy per bit drops below the nominal count.
• Insufficient extraction. Even good noise needs conditioning (von Neumann extraction, hashing) to remove bias. Skimp on it and you leak structure.

We do not yet have Coinkite’s full root-cause post-mortem, so which of these applies — and why the newer models degrade to ~72 bits rather than the Mk3’s far worse figure — is unconfirmed. NVK has rejected the framing of a total device-wide cryptographic break, and the manufacturer describes its analysis as ongoing. But the on-chain signature that started the investigation is textbook: AnchorWatch’s Rob Hamilton put it plainly — "at first glance, it appears there was faulty entropy in wallet generation somewhere along the path." The tell is the clustering. Genuinely random keys do not fall into a set an attacker can pre-enumerate; keys from a degraded RNG do. Five hundred of them draining in one coordinated sweep is what a harvested, pre-computed keyspace looks like when someone finally presses send — which is why the entropy hypothesis is the leading one, even before the causal chain is formally proven.

Why the passphrase saved people — and what that teaches

Coinkite’s analysis says users who added a BIP-39 passphrase ("25th word") are at minimal risk — and note this holds across all the affected models, which is the strongest practical signal in the whole advisory. The reason is architecturally elegant and worth internalizing: the passphrase is not generated by the device. It comes from the user’s head. The final wallet is derived from seed + passphrase, so even a fully predictable seed produces an unpredictable wallet as long as the passphrase carries real entropy the RNG never touched.

This is defense-in-depth doing exactly its job: a second, independent secret whose failure modes do not correlate with the first. The lesson generalizes far beyond hardware wallets. When one layer’s security rests on an assumption you cannot personally verify (the quality of a chip’s RNG), a second layer sourced from a fundamentally different place (your memory) turns a catastrophic single-point failure into a survivable one. It is the same reason we pair something-you-have with something-you-know.

The uncomfortable part: you cannot audit randomness by looking

Here is what makes entropy failures uniquely nasty for a self-custody user: bad randomness is indistinguishable from good randomness by inspection. A weak seed produces valid words, a valid checksum, valid addresses, valid signatures. There is no error message, no failed transaction, no visible tell. You cannot look at your 24 words and know whether they came from 256 bits of entropy or 32 — or 72. The only defenses are structural, applied at generation time:

• Add your own entropy the device cannot control. Coldcard’s dice-roll option (≥99 rolls, or dice XORed into the RNG output) means the final seed depends on physical randomness you supplied. A compromised RNG cannot predict your dice — which is exactly why Coinkite now lists a controlled dice-only process among its recommended mitigations.
• Always use a passphrase for meaningful sums. As above — it is the cheapest correlation-breaker available, and the one defense the advisory says held across every affected model.
• Verify seeds across independent implementations. Reconstructing the same wallet on a different vendor’s device confirms the derivation, though not the entropy quality.
• Prefer open, audited firmware and reproducible builds. They do not guarantee good entropy, but they make degraded entropy far more likely to be caught by someone before your funds are.

So how safe is hardware custody now?

Still very safe — arguably safer today than a week ago, because a latent flaw that had been quietly harvestable since 2021 is now public, defended against, and being corrected in firmware. That is the responsible-disclosure timeline working, painfully, as designed. Three sober framings:

• This is a device-generation entropy failure, not an indictment of cold storage. The threat model that hardware wallets exist to defeat — malware on your daily-driver computer reading your keys — is unchanged and still overwhelmingly worth defeating. The bug is in one vendor’s RNG design, spanning a product line at varying severity, not in the concept of cold storage.
• Concentration of trust is the real lesson. When thousands of users depend on one vendor’s one RNG, that RNG becomes systemic infrastructure — and the widening of this advisory from one model to the whole line is precisely that risk materializing. The mitigation is user-supplied entropy and passphrases, exactly because they de-correlate individual outcomes from the vendor’s single point of failure.
• Note the adjacency to this month’s cryptanalysis news. A frontier model just found a symmetry in a post-quantum scheme that humans missed for two years. Entropy failures are the same family of problem — mathematical structure hiding where it should not be — approached from the manufacturing side rather than the algorithm side. Expect the tooling that hunts for both to get much better, and expect it to find more legacy weaknesses before attackers do. That is the timeline you want to be on.

The bitter irony of this sweep is that the victims did almost everything right: they chose cold storage, they held long-term, they avoided the obvious phishing traps. What they could not do was audit the randomness inside a sealed chip. The durable takeaway is not "hardware wallets are unsafe." It is: never let a secret you cannot verify be the only secret standing between an attacker and your funds. Add the word only you know.