From here in 2036, the strangest thing about the Coldcard failure is how quiet it was. No exchange froze withdrawals. No executive sat in front of a Senate committee. I had self-custody filed under solved, and I would like to be honest about how long that filing lasted. A wallet that thousands of people had bought precisely so that nobody else could touch their money handed some of it away. The instruction to do that had been sitting in the firmware, in plain view, for five years.
What the wallets actually solved
Start with the case I got wrong, and take it at its strongest.
A hardware wallet is a small device that generates your secret key and then never lets it leave. You approve a payment on the device, the signed transaction goes out, and the key stays on a chip that never touches the internet. That is a real mechanism, not a slogan. It removes a whole class of failure: the exchange that halts withdrawals, the platform that lends out your balance, the company whose collapse turns your holdings into a claim in a queue. Buy the device once and the counterparty is gone.
By 2025 that argument had stopped being ideology and become a product line. Hardware wallet sales rose about 31 percent that year, and retail buyers took the clear majority of units as ordinary savers moved balances off exchanges.3 That number deserves a careful read. It was not traders hedging their books. It was people with a few thousand dollars and no appetite for reading a bankruptcy docket, choosing a hundred-dollar object over a corporate promise. The community's one-line version, repeated so often it stopped sounding like an argument, was that if they are not your keys they are not your coins.
That concedes a great deal, and I want to be plain about it. Every device sold to those buyers did the job it advertised. The keys stayed offline, no custodian could freeze them, and measured against the risk it was built to remove, the object worked. The pitch was not wrong.
The instant a key is born
Here is the mechanism of the failure, with the cryptography stripped out. A wallet's security comes down to one moment. The device invents your secret key by generating a large random number, and if that number is genuinely unpredictable, guessing it is hopeless, because there are more possible keys than there are atoms available to check them. A key is poured once, like concrete. Whatever quality goes in at that instant sets hard, and no amount of careful storage afterwards improves it.
In March 2021, a single change to Coldcard's firmware quietly swapped the part of the code that produced that randomness.4 Instead of drawing on the dedicated hardware chip built to generate unpredictable numbers, the device began calling a software routine that mixed together things an attacker could reconstruct: the serial number, an internal timer, the record of earlier calls. The routine stirred those inputs thoroughly, but stirring is not the same as creating. Start with a small set of possible inputs and you end with a small set of possible outputs, however violent the mixing.
So keys meant to draw on 128 bits of randomness were drawing on far fewer, and on some older models the effective randomness fell to roughly 40 bits.5 Here is what that means in practice. Forty bits describes a space small enough that a determined attacker with ordinary computing hardware can generate every possible key and check them all. Nobody reached through the internet to take these coins. The wallets were guessed, offline, at leisure, by anyone patient enough to run the list, and the device had been publishing the boundaries of its own secret since 2021.
Forty bits is the figure I still find hard to sit with, because it is not a near miss. It is the distance between impossible and an afternoon of ordinary computing.
When the flaw went public at the end of July 2026, one early sweep drained about $38 million in bitcoin in roughly twenty-five minutes.1 Within days the total researchers could attribute to the same weakness had climbed toward $130 million, and phishing crews were already impersonating wallet makers to finish the job on anyone still confused.2 Five years, then twenty-five minutes.
Figure 1. A recovered Mk3 unit at a Denver forensics shop, 2036. Investigators spent the late 2020s cataloguing which serial numbers had generated guessable keys. The chip built to produce randomness sat on the board, wired and working, and unused.
Filed in four separate drawers
Nobody at the time was reading these as one story, because they were not filed together. They sat in four drawers, in four different professions.
Drawer one: a firmware commit in March 2021, logged as routine maintenance.4 Drawer two: a sales chart showing hardware wallet units up about 31 percent in 2025, logged as adoption.3 Drawer three: a habit in how these devices were reviewed, logged as quality assurance. A code review can confirm that a good randomness source sits on the board and appears to work. It rarely confirms that the production firmware, the exact bytes on the exact device, calls the source that was validated rather than a broken substitute. That is the gap Kraken's security chief pointed to afterwards, and it is the part worth keeping.6 Drawer four: the standing estimate that between 2.3 and 3.7 million coins were already gone for good, a large share of them through self-custody mistakes made years earlier, logged as user error.7
Pull those four together and the throughline is not subtle. Adoption was climbing fastest in exactly the category where verification was weakest, among buyers whose losses were already assumed to be their own fault, running code that almost nobody outside the vendor had matched to the shipped device.
There was no phrase for this in 2026. From here we call it a randomness supply chain, and the name is ours, applied backwards. The thing itself was already assembled and running.
This is the part I misread hardest. I treated the hardware wallet as the end of a story, the point where counterparty risk was finally retired. It was the beginning of a different one. The device did not remove the trusted third party. It swapped one you could name and sue for several you had never been introduced to: the firmware team's build process, the assumption that public source matched shipped bytes, the untested belief that the chip on the board was the chip in use. Nobody had checked.
Figure 2. Seed backups logged as evidence in a 2036 recovery case. Careful storage protected these phrases perfectly. It could not protect a phrase that was weak the moment it was born.
After the twenty-five minutes
This is why the episode belongs in the ledger of lost bitcoin rather than the ledger of ordinary theft. The older losses were human: forgotten passwords, discarded drives, phrases written down and misplaced.7 Those coins were lost by their owners, over years, one at a time. The Coldcard coins were lost at the factory. An owner could follow every instruction in every guide, stamp the backup into steel, store it in two locations, check the address twice, and still be holding a key that had been drawn from a short list before the box was ever opened.
That is the reversal, and it is worth stating slowly.
Self-custody did not remove the trusted third party. It moved it somewhere quieter, into a code path no owner could open, and left you to find it after the money was gone.
The people who came out best had refused to trust any single device completely. They spread keys across different makers, or added a passphrase the firmware never saw, or split control so that no one machine held the whole secret. They pointed at their own tools the suspicion that self-custody had taught them to point at exchanges. What that looks like, in practice, is an old habit returning to a market that thought it had outgrown it: value kept in more than one place, no single instrument left as the only thing standing between an owner and zero. That is not a new idea, only an old one returned in a smaller box.
The durable lesson is not about one vendor or one commit, and I would rather not spend it on either. It is this: removing a middleman never deletes the trust, it relocates it, and the new address is always harder to inspect than the old one. Every system built to take a custodian out of the loop should be read the same way, by asking what quietly took the custodian's place and who has ever tested it. The 31 percent who bought in during 2025 were the most careful cohort in the market, and carefulness was not the variable that mattered.3 Ask where the trust went.
Author's Note. This is a 2036 retrospective. The Coldcard entropy flaw, the affected firmware versions, the dollar figures, the entropy reduction, and the lost-coin and adoption estimates are all drawn from real 2026 reporting and earlier data, cited below. The forensic scenes in the figures, the specific shops, and the framing of who "came out best" are illustrative reconstructions, not reports of specific events. The correspondent's first person marks the difference between what was knowable in 2026 and what is obvious from 2036; it records changes of mind, not events. Nothing here is security advice for any particular device.