Coldcard fixes seed-generation flaw after thefts tied to weak wallet entropy

Coinkite patched a Coldcard seed-generation flaw that Block linked to thefts of about 594 BTC from around 500 single-signature wallets, while later public tracking showed at least 1,360 BTC, valued at about $85.76 million on a Coldcard Sweep Watch dashboard, had been swept from identified wallet clusters. Anthony Pompliano said the incident should be understood as a hardware-wallet security failure involving user funds rather than a compromise of Bitcoin’s network, consensus rules or ledger, warning that inaccurate descriptions could damage investor confidence in an already weak market. Coldcard said reduced entropy during seed creation left some recovery phrases easier to calculate than intended, with Coinkite’s hotfix notes indicating Mk3 seeds may have had roughly 40 bits of entropy and later models about 72 bits, versus a 128-bit target. Affected users have been urged to install corrected firmware, generate entirely new seeds, verify receiving addresses and migrate funds, because updating firmware alone does not secure previously created seeds.