Coinkite now makes Coldcard owners roll dice, after $130M walked out of air-gapped wallets

Air-gapping protects a seed after it exists; it says nothing about how the seed was born. A wallet that never touches a network still publishes a public key the first time it receives coins, and if the private key behind it came from a pool of roughly 1.1 trillion candidates rather than 2^128, every step of the attack happens off the device ^[1][8]. Cutting entropy from 128 bits to about 40 shrinks the search space by a factor of around 3 x 10^26 ^[2]. The physical isolation held. The secret it was guarding did not ^[8].

The tempo of the first wave says the same thing. Roughly 500 wallets emptied in 25 minutes works out to 20 a minute ^[3], and those 594 BTC were about a third of everything eventually taken ^[8], which reads as a list being worked through rather than a search being run. Galaxy Research called the campaign deliberate and programmatic, possibly orchestrated with a large language model ^[5]. Coinkite has suggested the attackers used AI to read older releases of its open-source firmware ^[15]. Both readings point at the archive: nothing a vendor has ever published stops being readable, and a volunteer Bitcoin Red Team has already run AI agents over hundreds of Bitcoin projects and surfaced thousands of candidate bugs ^[18].

The new seed requirement is calibrated rather than decorative. A run of 128 fair coin flips carries 128 bits; 50 rolls of a six-sided die carries about 129 ^[4]. Either option reconstitutes the full target on its own, before the device mixes in whatever its own generator produced ^[9]. That is a vendor conceding it should not be the only source of randomness, and the price is a buyer sitting there flipping a coin 128 times. Coinkite also replaced the Yasmarang backup PRNG with SHA-256 Hash_DRBG and added checks for hardware RNG failure ^[10].

The larger bill is the migration. Anyone whose seed came from affected firmware between 2021 and July 2026 has to generate a new one and move the coins ^[11], which is about five years of devices ^[7]. The first Galaxy tally averaged roughly $19,300 per address ^[5], the shape of ordinary self-custody rather than a handful of whales. The total also keeps moving: about $18 million, or 16 percent, has been added since the August 14 count ^[6], and Coinkite says the investigation is still open while customers relocate funds ^[19]. Treat $130 million as a running figure ^[7].

The most useful item in the release is the fix nobody was owed. Coldcard now re-checks a partially signed transaction immediately before signing, closing a path where a compromised USB host could alter a transaction between the user's review and the signature; Coinkite describes that as theoretical and does not say it was used ^[12][13]. Three weeks of concentrated outside attention also produced changes to USB data handling, firmware validation, Delta Mode and backups ^[14][2]. The seed bug was the one found first, not the only one there. Ledger CTO Charles Guillemet, a competitor with an interest in saying it, told Decrypt that a hardware wallet's security model lives or dies on randomness ^[16]. The checkable part of that is narrower and more useful: user-supplied entropy is the one input a vendor cannot quietly get wrong.