The COLDCARD Seed Flaw: One Maker Should Never Supply Two of Your Three Keys
594 BTC swept in 25 minutes. The lesson is not "use multisig" — it is that no single manufacturer should supply enough of your keys to open the vault.
On the morning of 30 July 2026, in about twenty-five minutes, 594 BTC left roughly 500 Bitcoin addresses. The on-chain analysis Rob Hamilton of AnchorWatch published that day carries one detail worth sitting with: every drained wallet was a one-key wallet.
Later that day Coinkite, which makes the COLDCARD hardware wallet, published a security advisory, and Block's Bitcoin engineering team described a flaw in how COLDCARDs create seeds — the secret number every wallet is built from. Coinkite is careful about whether one caused the other, and so am I: they say the exact cause "has yet to be confirmed." What is confirmed is a real flaw, and a theft consistent with it.
Keystody supports COLDCARD, and this is not a piece about Coinkite behaving badly. They disclosed same-day and corrected their own advisory upward within 24 hours.
If you own a COLDCARD, start here. Any seed created on firmware 4.0.1 or later may be weak, and a firmware update does not repair a seed that already exists — it was created wrong, and stays wrong wherever you move it. Emergency releases: 5.6.0 for the Mk4 and Mk5, 1.5.0Q for the Q. Update first, then create a new seed and move your funds to it. The Mk3 has been out of support since 2023 and gets no fix at all. Seeds built from 50 or more of your own dice rolls are exempt. If your seed has a strong passphrase on top of it, that still protects you — the device never generated it — but Coinkite treats this as breathing room, not a fix. Read Coinkite's advisory today.
How a hardware wallet stops being random
Everything about a Bitcoin wallet rests on one thing: its secret was picked at random from a range so vast nobody could ever search it. The PIN and the tamper-proof case protect that secret; they don't replace it.
The flaw was one line of setup code asking the wrong question. It asked does this setting exist? when it should have asked is this setting switched on? The setting existed and was switched off — but because it existed, the device took the wrong path, drawing its randomness from a weak, predictable source instead of the real hardware one on the chip.
The good code was on the device the whole time. It was simply never used. No error, no warning, nothing different on screen. For five years and four months, devices that looked like they were producing strong secrets were not.
The cost is easiest to see as a number of guesses. A proper seed hides among roughly 340 undecillion possibilities — a 3 followed by thirty-eight digits, which nobody searches, ever. On the oldest affected models, what shipped was around a trillion. A trillion sounds enormous to a person. To a computer it is an afternoon's work.
Newer models are affected too. How badly is unclear — Coinkite and Block published different figures for how much randomness those models kept, and never reconciled them. Owners should act anyway.
The rule this proves
A Keystody vault has three keys, and any two of them can move funds. That shape is good for the reason you'd hope: one stolen key isn't enough, and one lost key isn't fatal.
But read it from the attacker's side. They don't need all three. They need two.
So a vault built from two COLDCARDs and one device from another maker is multi-brand on paper only. Two keys, one company, one bad line of code — and the third device never has to be touched. Block set the condition themselves: protecting yourself takes "a quorum of secure devices," meaning enough working ones to open the vault on their own. Two COLDCARDs and a Ledger leaves you with one.
One thing does still stand in the way, and it is worth understanding rather than taking comfort in. Keys alone are not enough to rob a vault. A thief also needs your vault's setup file — the shared record of all three public keys that any wallet needs before it can even find your coins, let alone move them. Without it, two broken keys are useless.
But that file was never meant to be a secret. It sits with whoever coordinates your vault. It is loaded onto each of your signing devices. It travels inside every unsigned transaction your vault passes around. And it is in the backups you were correctly told to make, because the standard advice is to store every cosigner's public key alongside every seed. Spending starts leaking pieces of it on-chain as well. You cannot audit whether yours has already escaped — which is precisely why it is not something to rely on.
Spreading your keys across manufacturers is not about how many logos are in your vault. It is about making sure no single manufacturer supplies enough of your keys to open it on its own.
Read the bottom row precisely: it holds against this flaw. And multisig was not magically immune here — Kevin Loaec of Wizardsardine noted the attacker's script only looked where single-key wallets live. Opportunism, not immunity.
Where randomness actually comes from
If one weak source can sink a device, the answer is not a better single source. It is to stop depending on any single one.
The sturdier designs mix several independent sources together — electrical noise, unpredictable leftovers inside the chip, the timing of your own button presses — and blend them so that no one of them decides the outcome. When a source fails there, it weakens the mixture instead of becoming it. That is the difference between a device that has a bad day and a device that quietly hands out guessable keys for five years.
It is also why two logos are not automatically two designs. Wallet makers borrow from each other's open code, and shared lineage can mean shared blind spots. What you want is different sources of randomness, not branding.
What open source got right
COLDCARD's code is public, and that is why this story has an ending at all. Outside engineers found the exact cause within hours — a closed device would have left owners with "we are investigating." Better still, Block's list of affected models was broader than Coinkite's first advisory, and Coinkite corrected upward. A second opinion changed the answer, only because an outsider could read the code.
The uncomfortable half: this code had been reviewed. Reading the source told you what the device was meant to do, not which code it ran.
What spreading your keys costs
Using several manufacturers is not free. You trade one catastrophic risk for several smaller ones: a single maker's silent flaw stops being fatal, but you now carry three supply chains, three firmware update cycles, and heirs who must learn three different devices in the worst week of their lives. Complexity is its own kind of risk. Usually this is the right trade. It is never a free one.
Where Keystody sits — and where it doesn't
Keystody is a 2-of-3 platform that holds zero keys. That is what makes a genuinely spread-out vault possible: all three keys are yours, so all three choices are yours. Ledger and Trezor connect directly today; COLDCARD is supported by importing its public key manually.
But I said I'd be honest, so: Keystody does not warn you today when two keys in a vault come from the same manufacturer. The Recovery Readiness checklist covers physical separation — no two keys in the same place — the cardinal rule for years. This week suggests that rule has a sibling about manufacturers. The gap is on my list; for now the choice is yours.
If you're unsure whether one maker quietly supplies two of your three keys, that is an hour well spent. I offer a free 30-minute setup call — this week I would rather be a second pair of eyes than a sales pitch. For why one key is the wrong shape for money held over decades, see passing a family vault to the next generation and why I built Keystody.
This story is a day old, so go to the primary sources: Coinkite's advisory and technical backgrounder, the firmware ChangeLog, and Block's disclosure.