Coldcard Mk3 Seeds Born Broken

Early Friday, someone emptied about 500 Bitcoin wallets in 25 minutes — 594 BTC, roughly $38 million. Many had sat untouched for years. All traced back to the same device: the Coldcard Mk3, a hardware wallet whose entire job is generating and guarding keys offline, sold to people who wanted to hold their own coins instead of trusting an exchange.

A hardware wallet's security rests on one moment: when it creates your seed — the 12 or 24 words everything else derives from. Those words must be genuinely random, so the device includes a dedicated chip for producing randomness. Researchers at Block found that a firmware setting introduced in March 2021 made the Mk3 skip that chip and build keys from predictable software output instead — and the code that should have caught this checked whether the setting existed, not whether it was on. The dice were never rolled. Every affected wallet looked secure and was guessable from day one; the thief didn't break in, they re-derived the keys and walked through the front door. Five years later, in one 25-minute pass.

Who kept their coins is the lesson. Users who added a passphrase on top of the seed, rolled physical dice to make their own randomness, or required multiple keys to spend — all fine. Not because the device worked, but because they never rested everything on one manufacturer's promise. That's the honest reading of this mess: self-custody didn't fail; a single point of trust did. Being your own bank is survivable. Being your own bank with one unverified vault, less so.

And file this in a pattern I've been tracking (see Claude Guts A Post-Quantum Bitcoin Candidate / Zcash Seals Its Vault, Starts Over): reviews keep finding cryptographic flaws, and the timing keeps getting worse. HAWK's weakness was caught before anyone deployed it — the ideal. Zcash's was caught four years into production, seemingly before anyone exploited it — late, but lucky. Coldcard's was published mid-theft, because the exploitation was the discovery. The lesson from last week stands, now with a body count: audits expire — and the only audit schedule that matters is the attacker's.