COLDCARD Hardware Wallet RNG Flaw Exploited to Steal $88 Million in Bitcoin

A critical logic flaw in COLDCARD hardware wallet firmware has allowed attackers to exploit a weak random number generator (RNG) and steal an estimated $88.6 million in Bitcoin from thousands of compromised addresses. The COLDCARD wallet vulnerability stems from an improper check in the device’s firmware that caused seed generation to bypass the onboard hardware true random number generator (TRNG) and fall back to a deterministic software pseudo-random number generator (PRNG). Because the fallback relied on predictable hardware parameters and timestamps, attackers were able to precalculate wallet seeds offline and sweep funds across 4,585 wallet addresses.

Automated Sweeps Draining $88.6 Million

Digital asset research firm Galaxy Research identified the first wave of malicious transactions on July 30, roughly 30 hours before manufacturer Coinkite publicly released an advisory. In that initial 41-minute attack window, the threat actors drained 1,083 BTC (valued at approximately $70.2 million) from 1,196 distinct addresses. By August 1, second and third waves of transactions pushed the total loss to 1,367 BTC ($88.6 million) across 4,585 addresses.

Blockchain analytics firm Chainalysis noted that the threat actor specifically prioritized high-value addresses during the initial minutes of the campaign, stealing approximately $30 million within the first 10 minutes alone—including $1.8 million from a single wallet. This pattern strongly indicates that the attacker conducted extensive off-chain recon and address matching prior to broadcasting a single transaction.

The execution was heavily automated. Every sweep transaction shared an identical, static fee rate of 30.0 satoshis per virtual byte (sat/vB)—a massive 30x to 75x overpayment compared to the network median of 0.4 to 1.0 sat/vB at the time—and left zero change outputs. The high transaction fees ensured rapid confirmation in the Bitcoin mempool, preventing affected wallet owners from front-running or replacing the transactions once the campaign commenced.

Root Cause: Flawed RNG Fallback Logic

Following reports of widespread wallet drains, Block’s Bitcoin Engineering and Security teams collaborated with external researchers to audit the device’s firmware repository, reporting their findings to Coinkite on July 30.

The audit revealed an integration error in COLDCARD’s random generation code (ngu.random). While the hardware architecture includes an onboard STM32 hardware TRNG designed to generate high-entropy cryptographic seeds, a bug in the firmware’s evaluation logic failed to activate the hardware peripheral. Instead, the device silently dropped back to MicroPython’s fallback generator, known as Yasmarang.

In standard cryptographic applications, seed phrase generation (such as BIP-39 mnemonic creation) requires 128 to 256 bits of true physical entropy. However, MicroPython’s Yasmarang fallback generator is not cryptographically secure. On the COLDCARD, it seeded itself using low-entropy, static, or easily guessable variables: the unique microcontroller identifier (MCU ID) of the STM32 chip and device system timing values.

How Attackers Exploited Deterministic Entropy

Cryptographic wallets derive hierarchical deterministic (HD) key trees from a primary master seed. Because the entropy source was constrained to a small, predictable set of inputs (chip IDs and clock states), the search space for generating seed phrases collapsed from $2^{256}$ or $2^{128}$ possibilities down to a finite, compute-feasible set.

To execute the attack, the threat actor:

1. Reconstructed the MicroPython Yasmarang PRNG output state offline using range sweeps over potential STM32 chip IDs and boot timestamps.
2. Derived the resulting BIP-39 seed phrases and public addresses for standard derivation paths (e.g., Native SegWit, Nested SegWit, Taproot).
3. Cross-referenced these generated public addresses against the live Bitcoin UTXO (Unspent Transaction Output) set to identify active wallets containing balances.
4. Pre-calculated the corresponding private keys for matched addresses and staged the automated broadcast script to sweep the funds simultaneously.

While applying a custom BIP-39 passphrase adds a secondary salt layer, it does not repair the underlying weak seed; if an attacker can guess or brute-force a weak passphrase or if no passphrase was set, the private keys remain vulnerable.

Affected Hardware, Firmware, and Exceptions

The vulnerability impacts several generations of COLDCARD hardware devices running specific firmware ranges:

• Mk2 and Mk3: Firmware versions 4.0.1 through 4.1.9 (Fixed in 4.2.0+)
• Mk4 and Mk5 (Standard): Firmware versions prior to 5.6.0 (Fixed in 5.6.0+)
• Mk4 and Mk5 (Edge): Firmware versions prior to 6.6.0X (Fixed in 6.6.0X+)
• Q Devices (Standard): Firmware versions prior to 1.5.0Q (Fixed in 1.5.0Q+)
• Q Devices (Edge): Firmware versions prior to 6.6.0QX (Fixed in 6.6.0QX+)

Coinkite confirmed that non-COLDCARD products—including TAPSIGNER, OPENDIME, and SATSCARD—are unaffected as they operate on completely independent codebases. Additionally, wallets where the initial seed generation was supplemented by at least 50 physical, fair, and private dice rolls are not vulnerable to this specific RNG implementation flaw, as the manual entropy overrides the software RNG state.

Coinkite has destroyed all inventory awaiting shipment that contained affected firmware versions and emailed affected customers directly.

Immediate Remediation and Seed Migration

Flashing updated firmware stops future weak seed generation but does not repair existing seeds generated under vulnerable firmware releases. Any wallet created on an affected firmware version remains vulnerable indefinitely until funds are moved.

Affected users must perform a full manual seed migration:

1. Update device firmware to version 4.2.0 (Mk2/Mk3), 5.6.0 / 6.6.0X (Mk4/Mk5), or 1.5.0Q / 6.6.0QX (Q series) or higher.
2. Verify existing seed backups and securely record a newly generated seed on the patched firmware (optionally supplementing with physical dice rolls).
3. Confirm the new receiving wallet address directly on the COLDCARD device display.
4. Perform a small test transaction to the new address before sweeping all remaining balances.
5. Retain original backup seeds until all transfers are confirmed on-chain.