A vulnerability in the random number generation (RNG) component of COLDCARD hardware wallet firmware is suspected to be linked to the theft of approximately $88.6 million in Bitcoin from thousands of wallets. The flaw allowed attackers to potentially reconstruct wallet seeds generated by affected devices.
Digital asset research firm Galaxy Research identified an initial wave of transactions on July 30, draining about 1,083 BTC, valued at $70.2 million, from 1,196 addresses. This 41-minute attack occurred roughly 30 hours before Coinkite, the manufacturer of COLDCARD, publicly disclosed the vulnerability. Galaxy noted that every transaction in this wave used an identical, hardcoded fee rate of 30 satoshis per virtual byte and left no change output, suggesting the use of an automated tool by the attackers.
By August 1, Galaxy Research identified subsequent waves of theft, increasing the estimated total to 1,367 Bitcoin, worth approximately $88.6 million, stolen from 4,585 addresses. The stolen Bitcoin remained in attacker-controlled addresses at the time of Galaxy's report. Separately, Chainalysis observed that attackers prioritized high-value wallets, with about $30 million stolen in the first ten minutes and $1.8 million taken from a single victim, indicating prior identification and study of affected wallets.
Block's Bitcoin Engineering and Security teams, along with other researchers, analyzed the COLDCARD firmware after reports of thefts surfaced. They traced the issue to an integration error in the device's RNG code, disclosing their findings to Coinkite on July 30. The COLDCARD firmware, specifically versions 4.0.1 through 4.1.9 for Mk2 and Mk3 devices, and versions prior to 5.6.0 (standard) or 6.6.0X (Edge) for Mk4, Mk5, and Q devices, contained an error. This error caused the `ngu.random` function to default to MicroPython's deterministic Yasmarang fallback generator instead of the intended STM32 hardware RNG.
The fallback generator relied on the device's microcontroller identifier and system timing values, which are not considered cryptographically secure sources of randomness and could be observable or reconstructable. This allowed attackers to generate potential wallet seeds offline, determine their corresponding Bitcoin addresses, and compare them against addresses visible on the blockchain. A match would confirm the correct seed, enabling the generation of private keys needed to access and steal funds.
Coinkite has released new firmware versions to address the flaw: 4.2.0 or later for Mk2 and Mk3, 5.6.0 or later for standard Mk4 and Mk5 devices, 1.5.0Q or later for standard Q devices, and 6.6.0X or 6.6.0QX for corresponding Edge releases. However, updating the firmware does not remediate seeds generated with the flawed software.
Affected users are advised to verify their existing backup, install the fixed firmware, generate and securely record a new seed, verify the new wallet address on the device, send a small test transaction, and then move their remaining funds. The old backup should be retained until the migration is complete and confirmed.
Coinkite stated that seeds supplemented with at least 50 fair, independent, and private dice rolls are not considered at risk from this specific flaw. While a strong, unique BIP-39 passphrase can make exploitation more difficult, users should still migrate their funds as it does not fix the underlying seed vulnerability. Coinkite's TAPSIGNER, OPENDIME, and SATSCARD products are unaffected due to different codebases. Coinkite also confirmed that all COLDCARD devices awaiting shipment with the vulnerable firmware were destroyed, and customers whose devices had already shipped were contacted via email with a security advisory and migration instructions.
