On July 30, 2026, someone emptied 1,196 Bitcoin addresses in 41 minutes. The first sweep took 1,082 BTC, about seventy million dollars at that day’s price. By the weekend, as later waves hit, the count had grown to roughly 1,367 BTC across more than four thousand addresses.

No malware was involved. Nobody was phished. Not one of the victims’ devices was touched, opened, or connected to anything. The coins were stored on Coldcard hardware wallets, devices whose entire reason to exist is that the secret material never leaves the metal. The secret material never did leave the metal. The attacker simply sat somewhere with a computer and guessed it.

That sentence should sound impossible. The security of Bitcoin rests on the fact that guessing a private key is not just hard but comically, cosmically hard. The whole system is engineered so that guessing is the one attack that can never work.

It worked because of a firmware bug that shipped in March 2021 and sat dormant for five years. The bug did not break the cryptography. It broke something quieter and more fundamental: the randomness the cryptography is built on.

To understand what actually happened, and why some Coldcard owners lost everything while others standing right next to them lost nothing, you need four ideas: what a seed is, how keys are derived from it, what entropy means, and what a random number generator actually does. None of them require mathematics beyond counting. All of them are worth having in your head permanently, because this exact failure will happen again, on some other device, with some other logo on the box.

Your wallet is one number

Strip away the apps, the devices, and the jargon, and a Bitcoin wallet is a single number. One number, chosen once, between zero and 2^256.

That number is called the seed. Everything else is derived from it. The twelve or twenty-four words your wallet showed you during setup are not a password protecting the number; they are the number, written in a friendlier alphabet. The BIP-39 standard maps chunks of the number to words from a fixed list of 2,048, so that humans can copy it onto paper without transcribing 64 hexadecimal characters. “Ripple mango vault” is just how a certain string of bits looks when dressed up for human eyes.

This is the first thing worth internalizing: there is no account, no file, no server entry that is your wallet. There is a number. Whoever knows the number owns the coins, from anywhere on Earth, with no further questions asked. The blockchain cannot tell the difference between you and someone who guessed your number, because on the blockchain, knowing the number is the entire definition of being you.

Which raises the obvious question: if a number is all it takes, why doesn’t someone just guess it?

Because 2^256 is not a number in any sense your intuition can handle. The notation is compact and hides everything, so climb the ladder with me.

Start with a beach five kilometers long, fifty meters wide, a few meters deep. Count every grain of sand on it: about 10^15 grains, a million billion. Now suppose your secret number is one specific grain on that beach, and an attacker gets a serious machine, one that checks a trillion grains per second. How long to search them all? About seventeen minutes. Hold onto that: numbers that are enormous for humans are lunch for computers.

Now stop counting grains and start counting atoms. A single grain of sand contains about 10^19 atoms, which means one grain holds more atoms than the entire beach holds grains. All the atoms on the beach together: about 10^34. Your number is now one atom, somewhere on the beach. Same machine, same question: how long? About three hundred trillion years, twenty thousand times the age of the universe. Two rungs up the ladder and we have already left time itself behind.

Widen the circle. Every atom in a large city, buildings, streets, the ground beneath them, every person walking through it: roughly 10^39. How long now? Around two billion ages of the universe. Every atom in planet Earth, molten core included: about 10^50. The question is starting to lose meaning, but ask it anyway: give a copy of the machine to every human alive and let all eight billion run in parallel, and you still wait tens of billions of ages of the universe. Every atom in the solar system, of which the Sun alone is more than 99 percent: about 10^57. Ten million times longer still.

Keep going. Every atom in every star of every galaxy in the known universe: about 10^80. How long to search that? There is no honest way to say it in human units. The universe ends, restarts, and ends again more times than there are grains on our beach before the machine gets halfway.

And 2^256 is about 10^77. On this ladder, that is one rung below the whole universe, a factor of a mere thousand, which at these scales is a rounding error. The number of possible seeds is, for every practical purpose, the number of atoms in a universe. Guessing someone’s wallet is not finding a needle in a haystack. It is being told “I am thinking of one particular atom” and having the entire cosmos as the haystack. And upgrading the machine does not rescue you: swap our trillion-a-second computer for the entire Bitcoin mining network, roughly a billion times faster, and you have not meaningfully moved the needle.

That is why nobody guards Bitcoin wallets, no firewall, no fraud department, no alarm. The guessing space itself is the guard. Hold onto that thought, because the July 30 attacker did not defeat this guard. They discovered that for some wallets, the ladder had quietly collapsed.

One number, a million addresses

You may have noticed that your wallet produces a new address every time you receive funds, and yet you only ever backed up one set of words. That is not a trick. It is a standard called BIP-32, hierarchical deterministic derivation, and it means your seed is not a key but a key factory.

From the seed, the wallet deterministically computes child key after child key, an effectively endless tree of them. Deterministically is the important word: the same seed always produces the same tree, in the same order, on any device, forever. That is why you can drop your hardware wallet in the sea, buy a new one, type in your words, and watch every address and every balance reappear. Nothing was stored anywhere. It was all recomputed from the number.

This is a genuinely elegant piece of engineering, and it has a sharp edge. If deterministic derivation means one backup recovers everything, it also means one leak loses everything. Whoever obtains the seed does not get an address. They get the factory. On July 30, that is exactly what the sweep looked like: the attacker was not picking individual locks, they were regenerating entire trees and harvesting every branch that had ever held coins.

The one-way street

So the seed generates private keys. What keeps the rest of the system safe is that each derivation step is a one-way function: private key to public key, public key to address. Computing forward is instant. Computing backward is not merely slow; with current mathematics and hardware there is no known way to do it at all before the sun burns out.

This asymmetry is why Bitcoin can work in public. You can post your address on your website, and nobody can walk it backward to the key that controls it. The entire edifice, every exchange, every wallet, every node, reduces to one assumption: nobody can guess your starting number.

Notice what this assumption is really about. It is not about the strength of the encryption or the quality of the device. It is about how the number was chosen. The cryptography guarantees that nobody can work backward to your number. It cannot guarantee that nobody can work forward to it, by choosing numbers the same way you did and checking each one. Preventing that is not cryptography’s job. It is the job of randomness.

Entropy is how many numbers it could have been

Entropy is one of those words that gets waved around until it means nothing, so here is the version that matters: entropy measures how many other values your secret could equally well have been. It is counted in bits. One bit means two possibilities. Ten bits, 1,024. Each added bit doubles the space a guesser has to search.

The crucial subtlety is that entropy is a property of the process that picked the number, not of the number itself. A number is not “random-looking” or “random-feeling”. The digits of 42 chosen by 256 coin flips are exactly as secure as any other outcome of 256 coin flips, and your dog’s birthday converted to hexadecimal is exactly as weak no matter how scrambled it looks. What matters is the size of the pool your process drew from, because the attacker does not attack the number. They attack the process, and then enumerate everything it could have produced.

A 24-word Bitcoin seed represents 256 bits of entropy; a 12-word seed, 128. You already climbed this ladder: 256 bits is the atoms-in-a-universe number from earlier. Every computer humanity has ever built, running until the heat death of the universe, does not scratch a space that size. This is why “someone guesses your seed” is treated as impossible. Not unlikely. Impossible, in any physical sense.

Provided, and here is the entire story in one clause, the seed actually has those 256 bits.

The betrayal

A hardware wallet’s job on setup day is to flip 256 fair coins. Real chips do this with a hardware random number generator, a circuit that harvests physical noise, thermal jitter, and electrical chaos that nobody, including the manufacturer, can predict or reproduce. The STM32 chip inside a Coldcard has exactly such a circuit.

Software, meanwhile, often uses a different tool: a pseudorandom number generator. A PRNG is a formula. You feed it a starting state, and it produces a stream of numbers that look random by every statistical test. But feed it the same starting state and it produces the same stream, every time, on any machine. That is not a defect. PRNGs are built for simulations and games, places where you want randomness you can replay. They are deterministic by design, which is precisely why they must never be the source of a secret.

In March 2021, a Coldcard firmware release quietly crossed those wires. A build setting that should have enabled the hardware generator was set to zero, and the supporting library only checked whether the setting existed, not whether it was on. Seed generation silently fell through to a fallback PRNG, seeded from the chip’s unique ID and its timer registers, and gathering no fresh physical noise after that.

Look at what that did to the entropy. The chip’s ID is factory metadata, fixed and constrained. Timer registers are timing state an attacker can narrow down by studying a device of their own. According to Galaxy Research’s analysis of the theft, the space of possible seeds collapsed from 2^128 or more to roughly 2^40 on the Mk3, and about 2^72 on later models. The wallets went on printing beautiful 24-word phrases that looked exactly as random as ever. Entropy is a property of the process, and the process was broken; the words could not show it, and no one could see it.

Two to the fortieth is about a trillion possibilities. Remember the machine from our beach, the one checking a trillion candidates per second? It walks through 2^40 in about one second. The wallets that were supposed to hide one atom in a universe were hiding one grain on a beach the machine could sift before you finish reading this sentence. Even 2^72 is not a fortress: for perspective, the Bitcoin mining network performs that many hash operations in a matter of seconds. The impossible had become merely industrial.

And the attack could be run entirely offline, which is the detail that should genuinely unsettle you. The attacker never needed to touch a Coldcard. They replayed the broken process: enumerate plausible chip states, run the same PRNG formula, derive each candidate seed’s addresses, and check them against the public blockchain. The blockchain, being public, worked as a free oracle that answered “does this guess hold money?” a billion times without ever raising an alarm. Five years of accumulated balances, searchable at leisure, and on July 30 someone finished the search.

The people who lost nothing

Here is the part I find most instructive. Scattered among the victims were Coldcard owners with the same models, the same broken firmware, the same flawed process, who lost nothing at all.

Some of them had set a BIP-39 passphrase, an extra word or sentence of your own invention that is combined with the seed words to derive a different tree of keys. The passphrase never lived on the device, so reconstructing the device’s seed was not enough; the attacker’s perfect replay of the broken PRNG produced a wallet with nothing in it.

Others had, during setup, told the device to mix in dice rolls, physically rolling a die 50 or more times and entering the results. Fifty fair dice rolls contribute about 129 bits of entropy from a source no firmware bug can reach: the physics of a tumbling cube in your hands. Their seeds drew from a pool the attacker could not enumerate, because the attacker could not replay their living room.

Neither group knew about the bug. They were not smarter about firmware than anyone else. They had simply declined, on principle, to let a single component be the only thing standing between their savings and the world. The device said “trust me, I generate good randomness”, and they answered “probably true, and I will add my own anyway”. Five years later, that one habit was the entire difference between everything and nothing.

There is a name for this: defense in depth. It is the least glamorous idea in security and the one that keeps working when the glamorous ones fail.

What to actually do

If you own a Coldcard, the practical part is short. Coinkite shipped emergency firmware on July 31, but the patch cannot repair an existing seed; a number drawn from a poisoned pool stays poisoned. If your seed was generated on affected firmware, generate a fresh seed on a patched device, ideally with dice rolls, and move your coins to it. Moving the old seed to a new device changes nothing.

For everyone else, the lessons travel well beyond one Canadian company:

A backup of your seed words is a backup of the number, and the number is everything. Treat the words accordingly.

When you set up any wallet, add entropy the manufacturer cannot control: dice rolls if the device supports them, and a passphrase you keep in your head or on separate paper. You are not being paranoid; you are refusing to make one chip’s honesty a single point of failure.

And ask, of any device that generates secrets for you, the question this whole episode boils down to: where does my randomness come from? You will rarely get a satisfying answer. That is fine. The point of the question is to remind you to behave as if the answer might one day be “a formula an attacker can replay”.

In the days after the theft, a familiar chorus started up: this proves self-custody is too dangerous, better to hold Bitcoin through an ETF and let professionals worry. I think the episode proves something closer to the opposite. The people who treated self-custody as an active practice, layering their own entropy on top of the device’s, sailed through a five-year-old critical bug untouched. The failure mode was not “individuals holding their own keys”. The failure mode was trusting a single vendor’s word completely, and that failure mode exists in every custodian too; it just fails bigger, later, and with your coins in someone else’s name.

Seventy million dollars did not vanish because the math failed. The math held perfectly. It vanished because somewhere in a build configuration, a flag was zero instead of one, and for five years every affected device answered the most important question in cryptography, “pick a number nobody can guess”, with a number somebody could.

The cage held. The lock was strong. The key was cut from a pattern the locksmith left on the counter.

---

Sources: Galaxy Research’s analysis via The Hacker News, CoinDesk’s reporting on the sweep and the self-custody debate that followed.