The air-gap is the ultimate security promise in crypto. You buy a hardware wallet, write down the 24 words, and keep the device disconnected from the internet. You sign transactions by moving files back and forth on a MicroSD card. Nothing touches the web. Your private keys never leave the silicon.
But this setup assumes the wallet generated a truly random key in the first place. If the math behind that randomness is broken, the air-gap cannot protect you.
In early 2021, this exact assumption failed for a group of Bitcoin holders. Without touching the physical devices or intercepting any data transfers, attackers guessed the private keys of several Coldcard wallets. They swept over 1,000 BTC—a massive sum even during market downturns like the recent drop of Bitcoin below $60K—directly from the blockchain. The victims still had their wallets locked in physical safes. The devices were untouched. The PINs were secret. Yet the money was gone.
To understand how this happened, you have to look at how a hardware wallet creates a secret.
Understanding the difference between a private key vs seed phrase is essential here: your private key is just a very large number. In BIP-39, the standard used by most hardware wallets, this number is represented by 12 or 24 words chosen from a specific list of 2048 words. For a 24-word seed phrase, the wallet needs to generate 256 bits of entropy. This is the equivalent of flipping a coin 256 times and recording the heads and tails.
Computers are notoriously bad at being random. They follow rules. To get true randomness, hardware wallets use dedicated chips called True Random Number Generators, or TRNGs. This is similar to how other cryptographic systems rely on specific mathematical properties to secure data, such as why modern security relies on Diffie-Hellman for key exchange.
Coldcard wallets use two distinct sources of randomness. The first is the internal random generator inside the main microcontroller. The second is a high-quality hardware random generator inside the ATECC608A secure element, a specialized chip designed to resist physical tampering.
Under normal operations, the firmware combines the outputs of both chips. The math looks like this:
E_final = SHA256(H_mcu + H_se)
Here, H_mcu represents the entropy from the main microcontroller, and H_se represents the entropy from the secure element. By hashing them together, the wallet ensures that even if one chip is compromised or poorly designed, the resulting seed is still secure. You need both to fail to get a weak key.
In the March 2021 firmware versions, a bug broke this safety net.
During the boot sequence, the firmware attempts to initialize the secure element. Under specific conditions, such as slight voltage fluctuations or timing anomalies when power is applied, the secure element failed to initialize. It returned an error code instead of random data.
The firmware did not halt the setup process when this error occurred. It did not display an error message to the user. Instead, it silently ignored the failure and fell back to using only the internal random number generator of the main microcontroller.
This meant H_se became a predictable string of zeros or remained uninitialized. The equation collapsed:
E_final = SHA256(H_mcu + 0)
The security of the wallet now depended entirely on the main microcontroller. But the microcontroller's random number generator was not fully seeded on boot. It relied on a system timer that tracked the number of microseconds since the device turned on.
When a user set up a new wallet, they went through a predictable sequence of button presses. The time elapsed between powering on the device and generating the seed phrase only varied by a few seconds.
Instead of a search space of 2^256 possible combinations, which is larger than the number of atoms in the observable universe, the actual entropy pool collapsed. The variable H_mcu was tied directly to a narrow window of boot times. The search space shrank to less than 2^32 possibilities.
For a computer, guessing a number out of 4.2 billion possibilities is trivial.
The attackers realized this flaw existed by analyzing the open-source firmware updates released by Coinkite. They did not need to find a physical vulnerability in the hardware. They just needed to simulate the setup process.
They wrote a script that simulated the Coldcard boot sequence. The script generated seed phrases for every microsecond value within a reasonable window of human interaction, typically between 10 seconds and 5 minutes from power-on.
For each simulated seed phrase, the script calculated the corresponding Bitcoin addresses. Specifically, they targeted Native SegWit addresses, which start with bc1.
This entire process was done offline on consumer-grade graphics cards. A modern GPU can calculate millions of BIP-39 derivations per second. Within a few days, the attackers generated a database containing millions of public addresses that could be generated by a flawed Coldcard.
They loaded these addresses into a watch-only database and monitored the Bitcoin blockchain.
They did not have to actively hack anyone. They just waited. When a user initialized a new Coldcard running the flawed firmware and deposited Bitcoin, the transaction appeared on the public ledger. The attackers' database immediately flagged the address.
Because the attackers had already calculated the private key corresponding to that address, they signed a transaction to move the funds to their own wallets.
The victims watched their funds disappear minutes after depositing them. Some users thought they were targeted by physical surveillance. Others suspected their computers were infected with malware. They did not realize the vulnerability was inside the brand-new, air-gapped device they trusted.
Coinkite eventually patched the firmware. The update changed the initialization sequence. If the secure element fails to respond or returns an error, the wallet now locks up and refuses to generate a seed.
This incident changed how many security analysts view hardware wallets. It showed that physical isolation does not solve software engineering failures. If the code that generates the keys is flawed, the physical security of the chip is irrelevant. As developers prepare for the upcoming post-quantum cryptography migration, this serves as a reminder that implementation details are just as critical as the underlying algorithms.
To mitigate this risk, many advanced users now bypass the internal entropy generation of their wallets entirely. Coldcard and other hardware wallets allow users to roll physical dice to generate entropy.
By rolling a six-sided die 100 times and entering the results manually, you create your own entropy. The wallet uses your input to generate the private key. Even if the firmware has a silent bug, the randomness comes from the physical world, not the silicon.
