{"id":15998,"date":"2026-08-01T11:47:23","date_gmt":"2026-08-01T09:47:23","guid":{"rendered":"https:\/\/www.bitcoinstuffstore.com\/coldcard-entropie-probleem\/"},"modified":"2026-08-02T09:17:25","modified_gmt":"2026-08-02T07:17:25","slug":"coldcard-entropy-problem","status":"publish","type":"page","link":"https:\/\/www.bitcoinstuffstore.com\/en_us\/coldcard-entropie-probleem\/","title":{"rendered":"The Coldcard Entropy Problem: What to Do"},"content":{"rendered":"

Last updated: August 1, 2026<\/em><\/p>\r\n\r\n\r\n\r\n

At the end of July 2026, bitcoin was stolen due to a flaw in the Coldcard firmware. This page explains in Dutch what happened, whether you\u2019re at risk, and what you can do about it, calmly, without panicking, and without having to study cryptography first.<\/p>\r\n\r\n\r\n\r\n

If you purchased your Coldcard from us, you\u2019ve already received a personal message about this. If you bought it somewhere else, this explanation applies to you just as well, and you\u2019re welcome to email us if you get stuck.<\/p>\r\n\r\n\r\n\r\n

Read this first<\/h2>\r\n\r\n\r\n\r\n

We will never ask you for your 24 words. No one does.<\/strong> Not by email, not over the phone, and not via a website that offers to check if you are vulnerable. Such sites exist now, and they are there to rob you.<\/p>\r\n\r\n\r\n\r\n

There are currently many scams circulating related to this topic. Only download firmware from coldcard.com, and go there by typing the address directly into your browser. Do not use a link in an email, not even a link in an email from us.<\/p>\r\n\r\n\r\n\r\n

What happened<\/h2>\r\n\r\n\r\n\r\n

In March 2021, a design flaw crept into an update to the Coldcard firmware. As a result, when generating a seed, the device did not use the hardware random number generator, but rather a predictable software alternative. This went unnoticed for five years.<\/p>\r\n\r\n\r\n\r\n

On July 30, 2026, this vulnerability was exploited. In less than half an hour, approximately 594 bitcoin were stolen from about 500 wallets. Coinkite, the developer of Coldcard, confirmed the vulnerability and immediately released a patch.<\/p>\r\n\r\n\r\n\r\n

Which models are affected<\/h2>\r\n\r\n\r\n\r\n
\r\n\r\n\r\n\r\n\r\n\r\n\r\n
Model<\/th>\r\nStrength of the key<\/th>\r\nSituation<\/th>\r\n<\/tr>\r\n<\/thead>\r\n
Mk3<\/td>\r\nabout 40 bits<\/td>\r\nSerious. This is where the theft happened.<\/td>\r\n<\/tr>\r\n
Mk4, Mk5, Q<\/strong><\/td>\r\napproximately 72 bits<\/td>\r\nWeaker than intended, but practically uncrackable. No known thefts.<\/td>\r\n<\/tr>\r\n<\/tbody>\r\n<\/table>\r\n<\/figure>\r\n\r\n\r\n\r\n

128 bits was intended. The Q, Mk4, and Mk5 score higher because those models mix in extra randomness from two security chips. That difference is precisely the reason why nothing was compromised in those models.<\/p>\r\n\r\n\r\n\r\n

The recovery firmware:<\/p>\r\n\r\n\r\n\r\n