At the end of July 2026 a hardware wallet stopped being hard. A firmware bug that had sat in the Coldcard codebase since March 2021 meant that some devices generated their seed from a predictable software counter instead of a real random number generator. On July 30 an attacker swept more than a thousand bitcoin out of those wallets in about forty minutes.
This site tracks a public challenge where people search bounded key ranges for sport and for a bounty. The Coldcard failure turned thousands of real wallets into the same kind of bounded range, except that nobody consented and nobody posted a prize. The numbers involved land so precisely on the puzzle difficulty curve that the puzzle is the clearest way to explain what happened.
A Bitcoin seed is supposed to start life as pure noise. The Coldcard has a hardware random number generator on its STM32 chip for exactly that job. In March 2021 a change to how the firmware called into its crypto library moved seed generation onto a different code path, and the production build configuration told that path the hardware generator was not available.
The supporting library checked whether the setting existed rather than whether it was turned on, so instead of failing loudly it quietly fell back to a small deterministic pseudorandom generator. That fallback was seeded from the chip unique identifier and some timer registers, and it took in no fresh randomness after startup. The device still showed the user twelve or twenty four words. Those words just no longer came from anywhere unpredictable.
Coinkite published its advisory on July 30 and 31, 2026, and estimated the effective entropy that remained at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5 and Q, against the 128 bits a twelve word BIP-39 seed is meant to carry. Those two numbers are the entire story.
Bitcoin private keys are 256 bit numbers, but the length of the number is not what protects you. What protects you is how many of those numbers an attacker cannot rule out. That count is the entropy. A seed with 128 bits of entropy is one of about 3.4 × 1038equally likely possibilities, and no amount of hardware gets through that. A seed with 40 bits of entropy is one of about 1.1 × 1012.
The fall from 128 to 40 is a loss of 88 bits, and every one of those bits halved the work. Nothing else about the wallet had to change for that to happen. Same chip, same screen, same twelve words handwritten on the same little card. Nothing an owner could see was any different, which is the part that should worry you.
A trillion candidates sounds like a lot until you notice that this site has a page for a puzzle of exactly that size. Puzzle 40 covers a 40 bit range and it was solved on January 30, 2015, on the hardware people had at the time. Today it is a laptop job; this site even ships an in-browser solver so you can watch a small range being walked in real time. That is the gap the bug opened: not a weakness at the margin, but a drop from impossible to a weekend project.
Put Coinkite's two estimates next to the puzzle ladder and the pattern in the theft stops being a mystery. One device family fell below a line that hobbyists crossed a decade ago. The other landed just above the point where the whole puzzle community, with GPUs and pooled effort and a standing cash prize, is still stuck today.
| Entropy | Device | Puzzle equivalent | Status of that puzzle |
|---|---|---|---|
| 40 bits | Mk3 | Puzzle 40 | Solved January 30, 2015 |
| 72 bits | Mk4, Mk5, Q | Puzzle 72 | Unsolved, 7.2001 BTC unclaimed |
| 128 bits | Working device | Off the ladder | Past every puzzle ever posed |
The reporting said the active sweep hit Mk3 wallets and left the newer devices alone, and people read that as the newer hardware being safe. The table is the less comforting reading. Mk4, Mk5 and Q seeds were not spared because they were sound. They were spared because 72 bits is currently out of reach. The lowest unsolved puzzle on this site is puzzle 71 with 7.1018 BTC sitting on it, and it has survived years of dedicated attention. That is the only thing standing between those seeds and the same outcome, and it is a margin that shrinks every year.
The comparison holds up on cost and breaks down on shape, and skipping past that would be sloppy. A puzzle address comes with a contiguous range of private keys and a promise that the answer is somewhere inside it. You walk the range in order and you are done when you are done.
The Coldcard case is not a key range at all. What collapsed was the space of internal states the seed generator could have been in, built out of a device identifier and some timer values. An attacker works through candidate generator states, derives the seed each one would have produced, walks the standard derivation paths, and checks the resulting addresses against the chain. The 40 bit figure describes how many states are plausible, not how many private keys sit in a row.
The practical difference is that puzzle progress is public and measurable while this kind of search depends on how well the attacker can constrain the device state, which nobody outside the attack knows. The similarity that does hold is the one that matters: in both cases the security came from the size of a search space rather than from any secret, and when that space shrank the money became reachable. It is the same lesson the quantum canary argument makes, arriving early and by accident.
Everything on this site points at addresses that were funded deliberately, by a creator who said in public that the coins are there to be taken by whoever does the work. Solving puzzle 71 and spending the prize is the intended ending of the story. Nobody is harmed and nothing is stolen.
The puzzle coins are a bounty, placed on purpose to be found. The Coldcard coins are somebody's savings. The search may cost the same. Taking the money is not the same act, and no derivation makes it one.
Coldcard wallets are the opposite case in every respect that counts. The coins belong to people who bought a device advertised as secure and did nothing wrong. Deriving one of those keys and moving the balance is theft. In most jurisdictions it is also unauthorised access to a computer system, which is charged separately. The elegance of the derivation changes none of that. Neither does the fact that the technique is publicly documented. A key you were never given does not become yours because the maths to find it got cheap.
So this page explains the mechanism and stops there. It carries no scanning code, no candidate state derivation, and no list of affected addresses. If you want to point a key search at something, point it at the unsolved puzzles, where the prize is real, the range is published, and taking it is the whole point.
Treat this section as a pointer, not as the authority. Coinkite's advisory is the document to follow, and it has been updated more than once as the picture developed.
You can check any address balance here with the balance checker, which queries the chain in your browser and never asks for a key. Nothing on this site should ever be given a seed phrase or a private key you care about.
The Bitcoin Puzzle was set up as a measuring stick. Each address gets a range one bit wider than the last, so the highest solved puzzle is a running public record of how far real key search has actually got, funded well enough that people genuinely try. The most recent fall was puzzle 69, on April 30, 2025.
For eleven years that measuring stick has been a curiosity, because no real wallet lives anywhere near the bottom of the ladder. The Coldcard flaw is the first widely publicised case of ordinary savings landing on the ladder by accident, and the result was visible within a day. That is the argument for keeping this kind of scoreboard: entropy failures are not theoretical, and when one happens the useful question is which rung it landed on. You can see the current answer on the solved and unsolved pages.
Written August 4, 2026. Entropy estimates and firmware version lists are Coinkite's own figures as published in the advisory. Loss totals were revised upward several times in the first week and may have moved again since.