Coldcard RNG Flaw Tied To $88M Bitcoin Theft

Security researchers have connected a firmware vulnerability in Coldcard hardware wallets to a string of thefts that drained an estimated 88.6 million USD in Bitcoin from thousands of victims. The flaw sits in the device's random number generator, the component responsible for creating the secret seed that underpins a wallet's private keys, and it appears to have let attackers reconstruct victims' wallets offline before sweeping their funds.

Digital asset research firm Galaxy Research first flagged the activity after spotting a coordinated wave of transactions on July 30 that drained roughly 1,083 BTC, worth about 70.2 million USD at the time, from 1,196 addresses in a single 41-minute window. That sweep took place roughly 30 hours before Coinkite, the company behind Coldcard, published its initial advisory.

Every transaction in the batch used the same hardcoded fee rate of 30 satoshis per virtual byte, a figure 30 to 75 times higher than the network's median that week, and none of the transactions produced a change output. Galaxy researchers said this pattern pointed to an automated script sweeping keys the attacker already controlled rather than legitimate owners moving their own coins.

Galaxy Research subsequently identified two additional waves of theft on August 1, pushing the running total to approximately 1,367 BTC, worth close to 88.6 million USD, stolen from 4,585 addresses. As of Galaxy's most recent update, the stolen Bitcoin remained sitting in attacker-controlled wallets rather than being moved through mixers or exchanges.

Separately, blockchain analytics firm Chainalysis reported that the attacker appeared to prioritize the wallets holding the largest balances, extracting about 30 million USD within the first ten minutes of the operation and pulling 1.8 million USD from a single victim. Chainalysis said the pattern suggested the attacker had already identified and studied high-value targets before launching the thefts, rather than discovering them at random.

Block's Bitcoin Engineering and Security teams began investigating after seeing reports of Coldcard users losing funds, and they worked with outside researchers to trace the problem to its root cause. According to their analysis, Coldcard firmware contains an integration error that causes the device's ngu.random function to rely on MicroPython's deterministic Yasmarang fallback generator instead of the STM32 chip's dedicated hardware random number generator.

Coldcard ships its own hardware RNG wrapper and disables MicroPython's built-in implementation by design, but a library used by the firmware checks only whether the disabling flag is defined, not its value. That oversight let the build compile successfully while quietly binding wallet generation to the software fallback.

The consequences differ across device generations. On Mk2 and Mk3 units running firmware versions 4.0.0 through 4.1.9, no cryptographic entropy reaches the random number generator, so wallet creation becomes fully deterministic once an attacker knows the device's identifier, its internal timer state, and how many times the generator has been called.

Newer Mk4, Mk5, and Q devices add a reseeding step that pulls entropy from a secure element, but Block found that step passes along only four bytes of that entropy, capping the effective randomness at roughly 32 bits rather than the 128 or 256 bits a properly generated seed should carry. Because a wallet's public address or extended public key can serve as a verification oracle, an attacker can generate candidate seeds offline, derive their corresponding addresses, and check them against balances visible on the blockchain until a match confirms the correct private key.

Block's report traces the regression to a firmware change made in March 2021, when Coldcard's seed-generation code was rewritten to call the flawed library function instead of the device's hardware RNG wrapper. The bug, therefore, affected wallets created across roughly five years of firmware releases before it was caught.

Coinkite's advisory lists the specific firmware ranges exposed to the issue, along with the corrected releases users need to install:

• Mk2 and Mk3 devices running firmware versions 4.0.1 through 4.1.9 are affected; the fix is available in version 4.2.0 or later. Standard
• Mk4 and Mk5 devices are affected before version 5.6.0, and their Edge counterparts are affected before version 6.6.0X.
• Standard Q devices are affected before version 1.5.0Q, and Q Edge devices are affected before version 6.6.0QX.

Coinkite noted that its Tapsigner, Opendime, and Satscard products run on separate codebases and are not affected. The company also said that seeds supplemented with at least 50 fair, independent, and privately conducted dice rolls are not considered at risk from this issue alone, since the dice entropy was hashed together with the device-generated seed. A strong, unique BIP-39 passphrase similarly raises the bar for an attacker, though Coinkite still recommends migrating affected wallets even when a passphrase was used.

Installing the updated firmware does not repair a seed that was already generated under the flawed code; it only ensures that any new seed created afterward is generated securely. Anyone whose wallet was created during the affected window needs to move their funds to a freshly generated seed to be fully protected.

Coinkite's response and recommended steps

Coinkite said it destroyed all Coldcard units awaiting shipment that still carried the vulnerable firmware, and it reached out to customers whose devices had already shipped by email, providing the security advisory along with migration instructions. The company described its investigation as ongoing and said a more detailed technical review would follow.

Users who believe their wallet may be affected are advised to move carefully rather than rush the process, since a hurried migration can introduce new risks of its own. Coinkite's recommended sequence includes the following steps:

• Confirm the existing seed backup and wallet fingerprint before making any changes, then install the corrected firmware for the specific device model.
• Generate a brand-new seed on the updated firmware, record its backup, and verify a receive address directly on the device screen.
• Send a small test transaction to the new wallet to confirm it works correctly, then transfer the remaining balance and retain the old backup until the full migration is confirmed.

Anyone still using an affected Coldcard for meaningful sums of Bitcoin should treat firmware updates as the first step rather than the final one and complete the full migration process before considering their funds secure. The incident is a reminder that even purpose-built hardware wallets can carry serious software defects, and that verifying a device's cryptographic foundations is just as important as protecting a physical backup or PIN.