After $116M Vanished From 'Secure' Wallets: The Actual Checklist for Safe Self-Custody

By - Brook, Senior Analyst, and Danger, Founder

Subscribe for daily free DeFi news covering launches, tradable catalysts, and actionable farming opportunities.

---

Today’s News Headlines:

- EtherFi split weETH into two distinct products
- Late Ondo Founder’s mother fights CEO legal control

TL;DR

• $116M drained from 5,200+ Coldcard wallets (Jul 30–Aug 3, 2026) — not phishing, not malware. A 5-year-old firmware bug silently disabled the device’s true random-number generator, making seeds guessable.

• Affected: any seed generated on-device between March 2021 and the July 31 patch. The patch doesn’t fix existing seeds — you have to generate a new one and move funds.

• This isn’t new: weak randomness has now cost crypto $15B+ over the past decade across multiple “unrelated” hacks.

• What actually protects you:

  1. Pick wallets by entropy architecture, or supply your own via dice rolls

  2. A phone only replaces a hardware wallet if it’s permanently air-gapped

  3. Multisig only works if the keys come from different vendors

  4. MPC removes the single-seed failure point entirely

• Do this now: if any seed in your setup was born on a Coldcard between March 2021–July 31, rotate it.

---

Find and execute the 15%+ stablecoin yields in minutes
Save time without checking every protocol manually. DeFi Saver’s Discover page surfaces rates across Aave, Morpho, Spark, and more, lets you simulate leverage before committing, and handles the full loop in one click. Stop leaving yield on the table.

<Discover Yields on DeFi Saver> | Today in DeFi is Supported by DeFi Saver

---

At 01:10 UTC on July 30, a wallet-draining operation unlike any before it began executing on the Bitcoin blockchain. Over the next 41 minutes, 1,082.65 BTC — about $70 million — moved out of 1,196 addresses. No phishing links, no malware, no devices touched. The victims were Coldcard users: owners of the hardware wallet built for, and marketed to, the most serious self-custody crowd in Bitcoin.

By August 3, four sweep waves had taken roughly 1,816 BTC — nearly $116 million — from more than 5,200 addresses, per Galaxy Research’s tracking, with victims literally racing the attackers with replace-by-fee transactions to rescue their own coins.

Strike CEO Jack Mallers called it “one of the most serious wallet security incidents Bitcoin has seen.” On-chain analyst James Check put it more personally: “I feel betrayed by something I trusted very deeply.”

The uncomfortable part: these users did everything right. They bought a respected hardware wallet, kept their seeds offline, never clicked anything. The flaw was in the one step nobody can see — the moment the device generated their seed phrase.

How the exploit happened

A quick refresher on what a seed phrase actually is. When a wallet is created, the device draws 128 or 256 bits of randomness — entropy — and encodes them as 12 or 24 words (BIP39). Those words are stretched into a master seed, and every private key and address the wallet will ever produce is derived deterministically from it. One random draw, at creation, secures everything forever. If that draw is truly random, a 2^128 keyspace means no computer on earth can find you. If it isn’t, nothing else about your setup matters.

Coldcard’s draw wasn’t. In a March 2021 firmware rewrite, a build configuration set the flag enabling the microcontroller’s hardware true-RNG to 0. A safety check in the code asked whether that flag existed — not whether it was actually switched on.

Since a flag set to zero still exists, the check passed, the compile-time error that should have screamed “get a HW TRNG plz” never fired, and seed generation silently fell through to a deterministic software generator called Yasmarang, seeded with little more than the device’s serial-style ID and its clock counters.

As Wizardsardine put it, the code that was supposed to mix physical noise into the seed “was in fact mixing two software PRNGs together.” The genuine hardware RNG sat in the firmware, compiled and unreachable, for five years.

The result was a keyspace an attacker can simply enumerate. Block’s engineering team — who published the definitive teardown — put older Mk2/Mk3 devices at roughly 2^16 to 2^40 possible seeds, and found that even on newer Mk4/Mk5/Q devices, where Coinkite initially claimed ~72 bits of protection from secure-element mixing, only 32 bits of that entropy actually survived into the final seed.

A 32-bit space can be cracked in hours on a single gaming GPU. So the attack needed no access to any device: regenerate every possible weak seed offline, derive the addresses, match them against the blockchain, and sweep everything funded — all at once, with robotic fingerprints like identical overpaid fees and no change outputs.

Who’s affected: essentially any seed generated on-device between March 2021 and the July 31 emergency firmware (Mk2/Mk3 on 4.0.1–4.1.9, Mk4/Mk5 before 5.6.0, Q before 1.5.0Q).

Safe: seeds created with 50+ dice rolls (Coldcard’s own dice feature mixed in user entropy — the users who took the paranoid path were saved), seeds imported from elsewhere, wallets with pre-2021 history, and funds behind a strong, unique BIP39 passphrase (though Coinkite advises even passphrase users to migrate when practical).

Critically, the firmware patch does not fix an existing seed — affected users must generate a fresh seed on patched firmware (or with dice) and move coins on-chain.

One caution on the discourse: Coinkite’s CEO has speculated that AI-assisted code review found the bug, and the “AI found it” framing is spreading. Nobody has demonstrated that. What’s undisputed is that a five-year-old logic error in widely viewable source went unnoticed by everyone — including Coinkite’s own AI-assisted reviews — until the money moved.

Ledger’s CTO used the same “reportedly” hedge — while noting his security team already runs LLM agents against its own products, with real CVEs to show for it. The honest summary: AI-assisted bug hunting is now table stakes on both sides of the fence; its role in this exploit remains unproven.

This keeps happening

Coldcard is the biggest hardware-wallet entropy failure, but weak randomness is arguably crypto’s most repeated catastrophic bug.

• In 2013, Android’s unseeded SecureRandom made early mobile Bitcoin wallets predictable.

• In 2022, the Profanity vanity-address tool’s 32-bit seed cost Wintermute ~$160M.

• Trust Wallet’s browser extension shipped 2^32 possible mnemonics in late 2022 (disclosed in 2023),

• and that same year the Milk Sad researchers showed Libbitcoin’s bx seed had the same 32-bit flaw — a rabbit hole that eventually revealed the 2020 draining of ~137,000 BTC from the LuBian mining pool — the DOJ later seized 127,271 of those coins, worth ~$15B, making it the largest weak-RNG loss in history.

• Three weeks before Coldcard, Coinspect disclosed “Ill Bloom” — five more wallet implementations with predictable recovery phrases, $5M+ already swept.

The pattern is always the same: the wallet looks perfectly normal for years, then an entire cohort is drained in minutes. Ledger CTO Charles Guillemet summed it up this week: “A bad RNG is silent.

The output still looks random and passes casual inspection” — you find out when someone else does, on-chain. Which means the practical response isn’t “audit your firmware” — it’s structuring your custody so that no single RNG, vendor, or device can be a fatal point of failure.

Fix #1: hardware wallets, chosen on entropy architecture

Hardware wallets are still the right tool for keeping keys off internet-connected machines. Hardware wallets are dedicated signing devices where the keys never leave the device. What changes after Coldcard is how you choose and initialize them.

Favor devices where randomness doesn’t depend on one chip or one vendor’s code path. Trezor documents device-, host- and secure-element-sourced entropy plus a user-runnable entropy check, and markets the Safe 7’s Tropic Square TROPIC01 as the first auditable secure element. Keystone supports dice-generated seeds, and its post-exploit statement points users to the firmware source lines where its three TRNG sources are combined — though its secure-element firmware remains closed, so source review covers the application layer, not the whole stack. Bitcoin focused options like BitBox and SeedSigner go further, but aren’t well suited for DeFi.

For actively signing DeFi transactions, the practical field narrows to four, each with a real tradeoff.

• Ledger: the broadest chain and dApp coverage, but closed-source firmware — you’re trusting its certifications — and a customer-data history some buyers still weigh.

• Trezor: open firmware, EVM via Suite and MetaMask plus Solana on the Safe line, but USB-connected rather than air-gapped.

• Keystone: air-gapped QR signing that pairs with MetaMask, Rabby, Safe and Solflare, with the closed-secure-element caveat above.

• And GridPlus’s Lattice1: a large touchscreen aimed at decoding complex calldata — though note that the claim it would have caught a Bybit-style masked transaction is GridPlus’s own marketing.

Settle the entropy question first, then make sure the device actually speaks your chains — and pick the tradeoff you can live with.

Better yet, supply the entropy yourself. The guidance worth trusting here comes from parties other than the vendor that just got burned: security researchers were recommending dice-generated seeds within a day of the exploit, and Keystone’s post-exploit math thread lays out the numbers — at ~2.58 bits per roll, 50 rolls clears 128 bits (12-word security), while a genuine 256-bit, 24-word seed takes ~100 rolls; its latest firmware hides the 24-word option until 100 rolls are logged, so a 24-word phrase can’t quietly carry 12-word entropy. Even Coinkite’s own advisory concedes the point: its dice-roll users came through the exploit untouched.

Two caveats to keep you honest. Open source helped diagnose this bug in hours, but it didn’t prevent it — the flaw sat in viewable code for five years, so “open source” is necessary, not sufficient. And buy direct from the manufacturer, never marketplaces — pre-seeded and tampered devices remain a live scam.

One more shopping aid: on the night of August 3, BitBox posted four questions worth asking any manufacturer — where does the randomness come from, and how many independent sources feed it; can you verify the firmware on your device matches the published code (reproducible builds “prove the binary matches the source — it does not prove the source is correct,” which is precisely how Coldcard failed); who approves a change before it ships; and what does the process look like after a bug is found. Vendor content, sure — but the questions transfer to every device on this list.

Ledger’s response — 193K views and counting — champions the other school: certification over self-verification. Its seeds come from a hardware TRNG inside a certified secure element, evaluated under the German BSI’s AIS-31 methodology (PTG.2 certified), and “generating a biased or deterministic random number” sits as Threat #1 in its published security targets. In a longer essay, CTO Charles Guillemet defends keeping that layer closed-source — Coldcard’s bug sat in public code for five years, and “’open’ and ‘reviewed’ are not the same word” — which is, of course, exactly the tradeoff open-source advocates reject — and Ledger’s own record (the 2020 customer-data leak, the 2023 Recover backlash) is part of why “trust our certifications” lands badly with a slice of the market. Two schools, one test: entropy you can independently verify, or entropy independently certified. A wallet offering neither now has some explaining to do.

Fix #2: the dedicated phone:

Two weeks before the exploit, investigator ZachXBT argued that a dedicated iPhone offers better security than a hardware wallet. Post-Coldcard, part of that holds up and part of it needs a sharper edge — because “a phone” is really two very different security tiers, and the argument only lands once you say which one you mean.

Start by separating three things people blur together: how the seed is generated (entropy), where the key lives once it exists (custody), and whether the device that holds it ever touches a network (exposure). ZachXBT’s strongest ground is entropy. The claim gets shaky on exposure — and exposure is what decides whether a phone replaces a hardware wallet or merely beats your laptop.

It also helps to separate two jobs that a single wallet app often does at once: the signer (where the key is generated and lives) and the front-end (what builds, previews, and broadcasts the transaction). In a hot wallet, one app does both. In a cold setup, you split them across two devices — and that split is the whole game.

Option 1 — A connected phone: a hardened hot wallet, not a cold one

A dedicated phone that signs while online is a hot wallet. A far better one than an extension on your daily laptop — fewer apps, no sketchy sideloads, less to go wrong — but the key is reachable over the network the entire time it’s transacting. Malware, a malicious app update, an OS zero-day: any of them can, in principle, exfiltrate a key that lives on a connected device. Dedicating the phone shrinks the odds; it doesn’t close the pathway.

This is the tier Rabby lives in. Rabby is online by design — it fetches balances, runs its transaction simulation, and broadcasts, all of which need a network. Put a seed into Rabby mobile and it’s a hot wallet, no matter what mode the phone is in; you cannot make Rabby itself “air-gapped.”

If its a dedicated phone, rabby can be a very good hot wallet given the transaction simulation, but it’s still a hot wallet. Use this tier for spending-size DeFi funds or as a multisig signer, not your main funds.

Option 2 — An air-gapped phone: a real hardware-wallet substitute (one tier down)

Take a different phone permanently offline and turn it into a QR-code signer, and the calculus flips. The key sits on a device with no route to the outside world; even fully compromised, it can’t leak a secret it has no way to transmit. That’s genuine cold storage and a reasonable stand-in for a hardware wallet.

The concrete tool here is AirGap Vault: open source, installed on a spare offline phone, it holds the key and signs by QR. This is where the signer/front-end split pays off — AirGap Vault is the offline signer, and Rabby browser extension(or another online wallet) becomes the watch-only front-end you pair to it over QR. Rabby builds and previews the transaction, shows a QR, the Vault signs and returns a QR, Rabby broadcasts. The key never leaves the offline phone; Rabby never holds it. That’s the setup that earns the “hardware-wallet substitute” label.

“Reasonable,” not “identical.” A boutique signer keeps its key in a secure element as a non-exportable key and enforces the air-gap in hardware. A phone app keeps the seed as words in app storage, and the air-gap holds only as long as your discipline does — one “just this once” reconnection breaks it. So rank it honestly: dedicated air-gapped hardware (a Keystone runs this exact QR flow with a secure element) at the top, an air-gapped phone a solid step below, any connected phone a rung below that.

Where the seed comes from

Now the part the Coldcard story is actually about. When a mobile wallet generates your 12 or 24 words, the entropy should come from the operating system’s CSPRNG, continuously seeded by the phone’s hardware RNG — the most attacked, most audited randomness stack in consumer computing. Conditional on the app actually calling it, that’s better-reviewed randomness than any boutique wallet’s TRNG will ever get.

That condition is the whole game, and it’s exactly where wallets keep dying. Trust Wallet’s browser extension, Cake Wallet, Klever — each rolled its own randomness instead of calling the platform CSPRNG, and each shipped guessable seeds.

That’s Coldcard’s mistake in mobile form: not bad hardware, but code that bypassed the good randomness sitting right there. The lesson transfers cleanly — on a phone as on a hardware wallet, the only thing that matters is an open-source, audited key-generation path.

Which raises the obvious question: how do you check that? You’re not going to read the code. In practice “checkable” means four things stacked up — the source is public, independent firms have audited it, the store build is reproducible from that source (so the app you install matches the code that was audited), and it leans on standard BIP-39 libraries instead of home-rolled crypto.

The one consumer-facing tool that verifies the reproducibility piece is WalletScrutiny, which tracks whether a wallet’s published build actually matches its source. Check it before you trust an app with generation.

From there you have two ways to get a seed:

a. Generate on the phone, with a checkable app.

The strongest pick is AirGap Vault — not only open source, but it lets you fold in your own dice or coin entropy on top of the device RNG, which is the closest mobile equivalent to rolling dice on a Coldcard.

For an EVM hot wallet, Rabby mobile is now fully open source with public audits from Cure53, Least Authority, and SlowMist.

On the Bitcoin side: Nunchuk (multisig-first, air-gap friendly, and it ships verified reproducible builds — the gold standard), BlueWallet, Blockstream Green, or Phoenix for Lightning. MetaMask is the most-reviewed code in the space but its license isn’t strictly open — treat “open source” there with an asterisk. And skip Cake Wallet for generation; it’s patched, but it’s on the cautionary list above.

b. Generate the entropy elsewhere, then import.

If, post-Coldcard, you’d rather not trust any single device’s generation, produce the entropy externally — physical dice, or a separate air-gapped signer — compute the checksum offline, and import the finished BIP-39 phrase.

Both AirGap Vault and Rabby accept a BIP-39 import, but the security is opposite: import into AirGap Vault on the offline phone and the seed stays cold; import the same phrase into Rabby mobile and it’s now a hot wallet. Import to the signer, never to the front-end. And remember an import only moves a seed — it can’t fix one generated on a weak device.

What the secure element actually does

Modern phones ship a real secure element — Apple’s Secure Enclave, Google’s Titan M2 via StrongBox — which tempts people to assume a phone wallet holds keys the way a hardware wallet does. It half does, and the half it doesn’t is the one that matters.

The catch is the curve. The Secure Enclave and StrongBox only generate and hold keys on NIST P-256, while Bitcoin and Ethereum use secp256k1. So a normal BIP-39 wallet’s signing key cannot live inside the enclave as a non-exportable key — wrong curve — and a seed phrase is exportable by design anyway.

What the enclave does instead is protect the seed at rest: the stored mnemonic is encrypted under a non-exportable key held in the secure element, so decryption is bound to that one physical phone and gated behind Face ID / fingerprint / passcode with hardware-enforced lockout.

That genuinely raises the bar against pulling your seed off a lost, stolen, or imaged device. What it can’t do is protect the key while the app is using it — at signing time the seed sits in ordinary memory, reachable by a compromised app or OS. So the secure element makes a phone’s storage hardware-grade; it does not make the phone a hardware wallet, which is exactly why a connected BIP-39 phone stays a hot wallet no matter how good its at-rest encryption is.

The only way to get the full benefit — a signing key born non-exportable and never exposed even during signing — is to skip the seed entirely. A passkey or enclave wallet uses the enclave’s native P-256 keys, so the key never exists as words at all. That’s arguably the strongest custody available on a stock phone, but the tradeoff cuts against everything else here: no seed phrase means no BIP-39 portability, so you can’t later import into Rabby, a Trezor, or a Ledger — you’re committed to that wallet’s own recovery model. A real option, but a different one.

And it’s why AirGap Vault‘s security doesn’t lean on the enclave at all: it comes from network isolation plus your own dice entropy. The secure element stops a seed being stolen at rest; the air-gap stops it being reachable while signing — and the second is the one that actually substitutes for a hardware wallet.

The device, and the discipline

The setup that makes any of this real is a dedicated phone, not your daily driver: a spare Pixel running GrapheneOS (Pixel 8 or newer; the 10-series gets updates into the 2030s — setup guide) or a recent iPhone in Lockdown Mode. Fresh account, wallet apps only, updates on, no SIM. Then pick your tier deliberately: airplane mode toggled on only to transactis Option 1 (hot — Rabby holds the key); permanently offline, signing by QR, is Option 2 (cold — AirGap Vault holds the key, Rabby just watches). One caveat if you go the iPhone route for active DeFi — Lockdown Mode can break WalletConnect, in-app dApp browsers, and some wallet features, so test before you move funds.

For the online front-end specifically, the criteria are different from the signer’s — here you want transaction preview and scam-flagging, not entropy transparency. On EVM, Rabby ships simulation and scam-flagging built in; Phantom, which acquired the Blowfish security engine, is the Solana incumbent; MetaMask and Zerion cover the most chains. Names will change; the criteria won’t — for a signer: open code, audited generation, reproducible builds, ideally your-own-entropy support. For a front-end: transaction preview.

Phone-specific hygiene is non-negotiable, and it’s where most real-world losses actually come from. Install only from official stores and check the developer name — fake “Sparrow Wallet” apps on Apple’s App Store are tied to $1.8M in stolen bitcoin, per a July lawsuit (Sparrow has no mobile app at all). Never screenshot a seed phrase — SparkKitty malware OCR-scans photo galleries on both iOS and Android. And keep seeds out of every cloud backup. On a modern phone the OS and the RNG are the strong parts. You are the attack surface.

Fix #3: multisig — with the caveat that matters now

The strongest post-exploit consensus is to stop depending on any single vendor. James Check now expects multisig to “become the default self-custody recommendation,” and Jameson Lopp‘s version is vendor diversification, since real firmware verification “is simply not feasible for 99.9%” of users. Multisig is how you get both: k-of-n keys, where compromising one key gets an attacker nothing.

But Coldcard added a footnote the industry now has to say out loud: multisig only helps if the keys are independent. A 2-of-3 built from three flawed Coldcards was three guessable keys. Unchained told clients to rotate any Coldcard-generated key in their vaults — the exposure was “most severe” for anyone with two.

The rule is diversity across devices, vendors, and locations: three keys on three different manufacturers’ hardware (or two hardware + one phone), stored in different places. And back up the wallet descriptor (the xpubs and script details) alongside every key — without it, even healthy seeds may not reconstruct a multisig wallet.

For a DeFi reader, the center of gravity is SAFE — and it’s worth spelling out why it’s considered the standard: live since 2019, $60B+ in assets secured across 58M+ deployed accounts and 400+ networks, with ten-plus audits and a formally verified core that gets re-audited before every release. No smart-contract wallet is more battle-tested.

Which is exactly why Bybit matters: $1.5B left a Safe multisig in February 2025 with the contracts working perfectly — every signer blind-signed what a compromised frontend showed them. Multisig distributes keys, not judgment. So the DeFi translation of the vendor-diversity rule: give your Safe’s signer keys different homes — one on a Ledger, one on a Keystone, one as a passkey — so no single vendor’s firmware or one compromised frontend habit owns the quorum.

• Squads fills the same role on Solana — $15B+ secured and the first formally verified program there.

• On the Bitcoin side the tooling is mature and mostly free — Sparrow, Electrum, Nunchuk, Liana (timelocked recovery paths that double as inheritance) — with collaborative custody from Unchained or Casa at $250/yr and AnchorWatch adding Lloyd’s insurance for size.

Fix #4: MPC — no single dice roll to get wrong

MPC/TSS wallets take a different route to the same goal: the private key never exists whole, anywhere. Key shares are generated on separate devices or parties through distributed key generation, and signing happens as a threshold protocol between them.

What makes MPC interesting specifically after Coldcard is that DKG pools entropy from multiple independent RNGs — there is no single random draw whose failure dooms the wallet.

For individuals, Zengo is the long-running consumer example (2-of-2 shares, no seed phrase, and — by Zengo’s own count — no wallet breached since 2018; though its acquisition by eToro this April is a reminder that seedless recovery depends on the company’s continuity).

A DeFi caveat before you commit: Zengo’s chain support is curated — BTC, ETH, Solana, BNB, Tron and major tokens, not every EVM network — and dApp access runs through WalletConnect rather than a native extension flow, which reviewers still find second-best for complex DeFi.

Think of it as clean MPC custody for holdings, not a daily DeFi driver. Institutions default to Fireblocks, BitGo, Copper, or Anchorage. The tradeoffs are real: proprietary share formats, vendor-dependent recovery, and no on-chain visibility into the quorum policy.

And MPC has had its own Coldcard-style scares — Fireblocks’ BitForge disclosures found share-extraction flaws across 15+ providers in 2023. The math was fine; implementations weren’t. Sound familiar?

The habits that catch everything else

A computer that does one thing. Infostealer malware is industrial now — one dump reported in January 2026 exposed 149 million records, much of it hunting seeds and wallet files. A cheap laptop used only for crypto — ideally on Linux, ideally air-gapped running Sparrow or Electrum offline with PSBTs crossing by QR or microSD — removes your browsing life from your signing life. Download wallets only from canonical sites and verify signatures.

Read before you sign. Verify the full receive address on your device’s screen — not the first and last four characters. Address poisoning (dusting your history with lookalike addresses) took $68M in one WBTC transfer in 2024 and $50M in USDT last December; never copy an address out of transaction history. On EVM, refuse blind signing: use wallets with built-in simulation (Rabby ships it natively; MetaMask’s screening runs on Blockaid), prefer hardware that decodes calldata via the ERC-7730 clear-signing standard, and treat any signature request you don’t understand as hostile — permit-style signatures accounted for 38% of the losses in 2025’s million-dollar-plus phishing cases. Sweep your approvals at revoke.cash periodically. Test-send before large transfers.

And the quiet ones. Seed backups on metal, never in a photo, note app, or password manager. Consider a BIP39 passphrase — exposed Coldcard seeds behind strong passphrases stayed out of attackers’ reach. Do a full recovery drill before funding a wallet. Keep holdings private: wrench attacks hit a record ~70 incidents in 2025 per Jameson Lopp’s public tracker, and ship hardware wallets to a pickup point — Ledger’s 2020 address leak still fuels doorstep extortion. On exchanges: hardware-key 2FA and time-delayed withdrawal allowlists.

The takeaway

Three of the worst security failures of this cycle each broke a different link: Coldcard broke key generation, Bybit broke transaction verification, BitForge broke MPC implementation. No wallet, chain, or company removes trust — every architecture just relocates it. The only strategy that addresses all three is layering and diversification: entropy you contributed, keys on hardware from different vendors, signatures you can actually read, and machines that do one job.

If you do nothing else this week: check whether any seed in your setup was born on a Coldcard between March 2021 and July 31, 2026 — including keys inside multisigs — and if so, rotate it. The attackers already have the list.

Premium Content: Earn >10% Fixed APR on Stablecoins