The 2^96 Silence: Inside Coldcard's RNG Collapse and the End of Absolute Security

On July 30, 2026, 1,196 Bitcoin wallets were emptied in 41 minutes. No server breach. No phishing campaign. No physical access to any device. The attacker simply enumerated roughly four billion possible seed phrases, converted them into addresses, scanned the public blockchain for funded matches, and swept every wallet that responded. Total take: approximately $70 million — nearly double the $38 million that early reports suggested. The math is the story. A healthy BIP39 seed carries 128 to 256 bits of entropy, a minimum search space of 2^128. The compromised seeds occupied a space of roughly 2^32 possibilities. That is a reduction of 2^96 — a factor so large it resists intuition. It is the difference between enumerating every atom in the observable universe and counting the population of a small city. Modern hardware iterates through the smaller set in minutes. And this is the detail that should unsettle every engineer reading it: the difference between 2^128 and 2^32 is not a linear reduction, nor even a simple exponential one. It is a collapse from the computationally impossible to the trivially searchable. Exhausting 2^128 candidates would outlast the age of the universe with all terrestrial computing power combined. Exhausting 2^32 is a warm-up exercise for a single GPU. The attacker did not need advanced mathematics. They needed patience to build an index. I do not trust the silence. I audit the code. This silence lasted four years. The vulnerable device was Coldcard, the Canadian hardware wallet produced by Coinkite — the gold standard of Bitcoin self-custody, beloved by the "not your keys, not your coins" maximalist set. Air-gapped. Open-source. Architected around a single proposition: private keys never leave the device. That proposition, it turns out, was always contingent on an unspoken assumption — that the random number generator produces genuinely unpredictable entropy. When the RNG fails, the private keys might as well be printed on the packaging. The root cause traces to a coding error in March 2021. A defect in a firmware update silently rerouted seed generation to a weak fallback scheme. That fallback derived randomness from the device's serial number and system clock. Deterministic inputs. Predictable outputs. For four years, no internal test caught it. No external audit flagged it. The failure was reconstructed only after the fact, when Galaxy Research and Block's engineering team traced swept funds backward and identified a structural weakness shared across the compromised seeds: their entropy was compressed into a range any desktop computer could traverse. The consequences are not limited to Coldcard users. CZ's public warning — that even hardware wallets can have vulnerabilities — was not hyperbolic. It was the first honest statement of a truth the industry has been reluctant to name. And in a year already breaking records for cryptocurrency theft, this incident lands differently. "Hardware wallet compromised through bad randomness" is a category of failure that undermines the foundational narrative of self-custody itself. The market response, at the aggregate level, has been muted. Seventy million dollars is a rounding error against a multi-trillion-dollar crypto market. But the collateral damage is harder to quantify. Every hardware wallet vendor now faces the same uncomfortable question: what is the independent audit trail for your RNG? What happens if your fallback path triggers? Most brands cannot answer. The near-term beneficiaries will be MPC-based custody solutions, which distribute key material across multiple parties and eliminate the single-device RNG dependence entirely. The fix, released after discovery, prevents newly generated seeds from suffering the same fate. But the damage is structural. Every seed created on affected devices during the four-year window remains exposed. And here is the cruelest detail: there is no way for a user to test, at home, whether their seed is part of the compromised range. No tool exists. No independent verification is possible. Users are left with a single recommendation — create new seeds, migrate assets, and hope. This is the story most commentary has missed. It is not a story about one bad firmware release. It is a story about an industry that sells "absolute security" while building on assumptions that were never audited. Let me walk through the technical chain, because the implications extend far beyond Coldcard. The attack path was embarrassingly simple. The attacker first identified that affected seeds were generated from a weak source. They then reconstructed candidate seeds from the predictable fallback parameters — serial numbers and timestamps. Each candidate seed was converted into Bitcoin addresses using standard derivation paths. The addresses were indexed into a precomputed database. Then the attacker scanned the blockchain for funded addresses matching their set. Every match was swept. No interaction with any victim device. No malware. No social engineering. Pure enumeration. The precomputation angle deserves emphasis. Because the address database was built offline, the attacker performed all the expensive work before touching the blockchain. The on-chain phase was execution — silent, fast, and entirely automated. This is why the sweep appeared to happen "in 41 minutes." The preparation had been underway for far longer. The public timeline only shows the final step. Three intermediate blocks in the sweep showed no theft activity. In a naive automated attack, you would expect continuous broadcasting. The gaps indicate deliberate pacing — the attacker controlling transaction tempo to avoid triggering exchange monitoring systems and chain surveillance alerts. The sweep was professionally executed. That is not a comforting detail. Here I draw on my own audit history. In 2017, I spent three months manually auditing CryptoKitties' smart contracts during the ICO cycle. I found an integer overflow vulnerability in the breeding logic that had escaped everyone else. I submitted it privately to the core developers, prioritizing network stability over recognition. The reason this matters: that bug, like Coldcard's, was introduced by a change that looked harmless at the time. Security-critical code does not fail loudly. It fails quietly, years later, when the original author has moved on and the review trail has gone cold. The March 2021 error is precisely that class of defect — a regression bug that evaded every layer of review because no layer was independently verifying the RNG's actual output. The most damning fact is not that the coding error happened. Errors happen. The damning fact is that no heartbeat check, no entropy self-test, no external audit caught it for four years while it silently compromised one of the most trusted devices in Bitcoin self-custody. An RNG self-test is not difficult to implement. It does not require exotic hardware. It requires a commitment to verifying, at runtime and at boot, that the entropy source is behaving within expected parameters. If such a check had existed, the weak fallback would have triggered an alert on the first affected device — not four years later in an attacker's ledger. The second structural failure is the fix's incompleteness. The firmware update prevents new seeds from being affected. It does nothing for existing seeds. Coinkite's disclosure initially omitted the Mk2 model from its list of affected devices — a transparency gap that will complicate trust recovery. Users of older Coldcard models are left in permanent uncertainty, unable to verify whether they are sitting on a compromised wallet or a clean one. Block has reportedly submitted its findings to authorities, but the attacker's identity remains unclear and the funds have not been moved. None of this is hypothetical. The 41-minute sweep was a proof-of-concept executed at scale. The attacker demonstrated that weak entropy is not an abstract concern — it is an attack surface that pays. As long as old firmware versions remain in circulation, and as long as affected users cannot verify their exposure, that attack surface persists. The comfortable conclusion from this incident is: "Coldcard failed. Buy a different brand." That conclusion is wrong, and it is dangerous. Fragility hides in the single point of failure. Every hardware wallet on the market shares the same structural weakness: a single RNG pipeline whose output is trusted without independent verification. Ledger. Trezor. Coldcard. They differ in firmware philosophy and brand identity. They do not differ in their dependence on unpredictable entropy. The attack that swept 1,196 Coldcard wallets required no physical access. It exploited the seed generation step — the common ancestor of every hardware wallet's security model. The deeper error is the narrative itself. "Hardware wallet equals absolute security" was never a proof. It was a marketing position. Self-custody is a system with multiple trust assumptions: firmware correctness, RNG quality, physical security, operational discipline. Pretending that any single device satisfies all of them is the kind of magical thinking that produces four-year silent failures. The underrated defense in this story is the BIP39 passphrase. Users who set a strong passphrase rendered their swept seeds worthless — an attacker would need both seed and passphrase to access funds. The vulnerability only becomes catastrophic when the passphrase layer is absent. Yet mobile wallet support for passphrases remains fragmented across the ecosystem, and most users never enable the feature. That fragmentation is arguably a larger systemic risk than any single hardware wallet bug. We have spent years debating which device to buy and almost no time asking why the free, mandatory, software-level protection is so poorly supported. And the pragmatist's retreat — moving funds back to exchange custody — is not a solution. It relocates the single point of failure from a device to a counterparty. Centralized custody replaces an RNG you cannot verify with a balance sheet you cannot audit. The institutional answer is MPC wallets, which split key material across multiple parties and eliminate the single-RNG problem by construction. The market should expect that shift to accelerate. Proof precedes value; provenance is the only art. The industry that built "not your keys, not your coins" now faces an uncomfortable corollary: your keys are only as safe as the entropy that produced them. The market needs RNG verification tooling, active scanning services that identify weak seeds before attackers do, and honest language about layered defense rather than absolute security. CZ said nothing is 100%. He was right. The question is not which hardware wallet to buy. The question is whether you have audited your own assumptions — because silence, as we have now learned, is not proof of safety.