Coldcard Hardware Wallet Seed Flaw Exploited in $70M Bitcoin Theft

An attacker drained 1,196 Bitcoin addresses in just 41 minutes on July 30, stealing 1,082.65 BTC valued at approximately $70.2 million. Galaxy Research mapped the rapid sweep and traced its origins to a severe seed generation vulnerability in Coldcard hardware wallets, the Bitcoin-only hardware security module produced by Canadian manufacturer Coinkite. The breach highlights how even air-gapped security devices can be compromised by build-system integration errors that silently degrade cryptographic randomness.

How the Seed PRNG Flaw Worked Under the Hood

The underlying vulnerability stems from a March 2021 firmware integration error. MicroPython—the runtime environment powering Coldcard’s device logic—includes a hardware random number generator (RNG) macro system. In Coldcard’s production configuration, MICROPY_HW_ENABLE_RNG was explicitly set to zero because Coinkite intended to supply its own proprietary hardware-RNG wrapper.

However, the supporting cryptographic library (libngu) contained a flaw in its macro check: it evaluated whether MICROPY_HW_ENABLE_RNG was defined (#ifdef) rather than checking whether its evaluated value was non-zero (#if MICROPY_HW_ENABLE_RNG). Because the macro existed in the build configuration—even though it was explicitly set to zero—libngu failed to engage the STM32 chip’s onboard hardware RNG.

Instead, the build fell back to MicroPython’s software pseudorandom number generator (PRNG), known as Yasmarang. Yasmarang is a deterministic software generator that, in this build environment, was initialized using only the STM32 chip’s unique identifier (UID) and internal hardware timer registers upon boot. Critically, Yasmarang collected no additional entropy from hardware noise sources after initialization. Every standard BIP-39 seed phrase generated on an affected device was derived entirely from this low-entropy deterministic state.

Brute-Forcing Weak Coldcard Seeds Offline

Because seed generation relied on a deterministic software PRNG seeded with limited hardware metadata, the effective entropy of generated wallet seeds dropped precipitously below standard cryptographic expectations. A standard 12-word BIP-39 seed requires 128 bits of entropy. Under this vulnerable firmware path, Coinkite estimated the effective entropy dropped to approximately 40 bits for Mk3 units and roughly 72 bits for Mk4, Mk5, and Q devices. Research from Block noted that while practical attack costs depend heavily on known device UID parameters, timer registers, and prior RNG calls, these low entropy bounds bring key space traversal within realistic offline brute-force capabilities.

Exploitation requires zero physical access to the target Coldcard hardware wallet. An attacker offline reconstructs candidate output streams by constraining device UIDs and timer states, calculating the deterministic Yasmarang PRNG sequence, and deriving the corresponding BIP-39 seed words. The attacker then derives the associated public Bitcoin addresses and cross-references them against public blockchain transaction histories and UTXO sets.

Once a match is identified, the attacker reconstructs the private key and signs sweeping transactions. Galaxy Research observed that during the July 30 incident, the attacker swept 1,196 addresses using an identical transaction profile: a fee rate of 30 sat/vB with zero change outputs. Galaxy noted that while this footprint pinpoints the single actor responsible, on-chain transaction sweeps look identical to legitimate user balance consolidations until key compromise is confirmed.

This incident follows separate research published by Coinspect in early July (dubbed “Ill Bloom”), which detailed weak-PRNG vulnerabilities in older software wallets responsible for draining over $5 million across Bitcoin, Ethereum, Tron, Rootstock, and Polygon since May.

Affected Devices and Firmware Scope

The vulnerability affects standard seed generation across multiple generations of Coldcard hardware:

• Coldcard Mk2 and Mk3: Vulnerable on firmware versions 4.0.0 (and 4.0.1) through 4.1.9. Fixed in version 4.2.0.
• Coldcard Mk4 and Mk5: Vulnerable on edge builds prior to version 6.6.0X.
• Coldcard Q: Vulnerable on edge builds prior to version 6.6.0QX.

Coinkite’s secondary product lines, including TAPSIGNER, OPENDIME, and SATSCARD, utilize entirely separate codebases and are unaffected.

Wallets generated using manual entropy—specifically seeds created using at least 50 fair, independent, and private physical dice rolls—are not vulnerable to this software PRNG flaw in isolation, as the manual dice entropy overrides the automated generator. Additionally, applying a strong, unique BIP-39 passphrase creates an isolated wallet structure that cannot be accessed by seed words alone, though Coinkite still advises replacing the base seed.

Critical Remediation Steps for Coldcard Owners

Coinkite released emergency firmware updates on July 31 across all affected product lines. However, security team members and wallet operators must understand a critical limitation: installing the updated firmware does NOT fix or retroactively secure an existing wallet seed.

If a seed was generated on a vulnerable firmware version, its underlying entropy remains compromised regardless of current device firmware. Restoring a vulnerable seed onto patched firmware, another hardware wallet, or software wallet software carries the cryptographic weakness forward indefinitely.

To remediate the issue:

1. Verify Firmware and Entropy Source: Determine if the current wallet seed was generated on an affected firmware build without manual dice entropy (50+ rolls).
2. Flash Updated Firmware: Upgrade the Coldcard device to version 4.2.0 (Mk3), 6.6.0X (Mk4/Mk5), 6.6.0QX (Q), or later.
3. Generate a New Seed: Generate an entirely new BIP-39 seed on the patched device.
4. Migrate Funds: Transfer all assets from the old address space to the newly derived addresses.

Multi-signature wallet configurations only protect funds if the quorum was not constructed entirely from affected Coldcard devices running compromised firmware.