The $88 Million Drain
On July 30, the first major wave of attacks began, exploiting a critical **Coldcard RNG flaw**. In just 41 minutes, approximately 1,083 BTC, valued at about $70.2 million at the time, vanished from 1,196 addresses. This occurred roughly 30 hours *before* Coinkite, Coldcard's manufacturer, publicly disclosed the flaw. By August 1, subsequent attack waves brought the total stolen to 1,367 Bitcoin, exceeding $88.6 million from 4,585 affected addresses.
The attacker operated efficiently, though not subtly. Every transaction used an identical, hardcoded fee rate of 30 satoshis per virtual byte and left no change output, indicating an automated tool. They prioritized high-value targets; $30 million was gone in the first ten minutes, with one victim losing $1.8 million. This precision suggests the attacker operated with a pre-identified list of targets, likely compiled through extensive blockchain analysis.
How the Coldcard RNG Flaw Undermined Your Seed
The core problem stemmed from an RNG integration error within the Coldcard firmware. Specifically, the ngu.random function, intended to draw true randomness from the STM32 hardware RNG, instead fell back to MicroPython's deterministic Yasmarang generator. This critical oversight occurred due to an incorrect check in the firmware, effectively bypassing the secure hardware component designed for entropy generation.
The Yasmarang fallback generator utilized the device's microcontroller identifier and system timing values. These are not cryptographically secure; their predictability allowed attackers to generate possible wallet seeds offline. Unlike true random numbers, these values offer a limited and discernible range, making them susceptible to brute-force attacks given sufficient computational power.
This bug meant that seeds generated on affected Coldcard firmware versions had significantly reduced entropy. For Mk4, Mk5, and Q devices, the intended 128 bits of entropy dropped to approximately 72 bits. This diminished randomness allowed an attacker to generate a much smaller set of possible wallet seeds offline, then cross-reference these against the Bitcoin blockchain to identify addresses holding funds. Once a match was found, deriving the private key became straightforward, turning a theoretical vulnerability into a practical exploit.
The affected firmware versions span a wide range: Mk2 and Mk3 from 4.0.1 through 4.1.9; Mk4 and Mk5 before standard version 5.6.0 or Edge version 6.6.0X; and Q devices before standard version 1.5.0Q or Edge version 6.6.0QX. Block's Bitcoin Engineering and Security teams, among others, were instrumental in identifying and disclosing this to Coinkite on July 30. The subtlety of this **Coldcard RNG flaw** meant it lay dormant for an extended period, evading detection through conventional auditing methods.
Implications for Self-Custody
The practical impact is clear: seeds generated on affected firmware versions were vulnerable. This is not merely a theoretical vulnerability; it is a demonstrated exploit that has resulted in millions in losses. The "not your keys, not your coins" principle relies on the integrity of key generation. When a trusted device fails at this fundamental level, it directly impacts the security model of self-custody, eroding user confidence in hardware wallets.
This incident has sparked discussion regarding the nature of product-level failures versus fundamental flaws in Bitcoin or self-custody. While the flaw is specific to Coldcard's implementation, it highlights the critical dependency on the integrity of hardware components for secure key generation, even for users adhering to best practices. It underscores that even the most robust security models can be undermined by a single, subtle implementation error within a trusted device.
The speed and scale of the initial attack wave raise questions within the community about the discovery and exploitation of such subtle, long-dormant flaws. This suggests a need to re-evaluate current auditing methodologies, particularly concerning the detection of advanced computational attacks on entropy sources. The incident also emphasizes the ongoing importance of independent security research and white-hat efforts in uncovering such deep-seated vulnerabilities.
What Coinkite is Doing, and What You Need to Do
Coinkite has responded by releasing patched firmware: Mk2 and Mk3 require 4.2.0 or later; standard Mk4 and Mk5 need 5.6.0 or later; and standard Q devices need 1.5.0Q or later (or Edge releases 6.6.0X/6.6.0QX). The company also destroyed all Coldcard devices awaiting shipment that contained affected firmware and contacted customers whose devices had already shipped via email with a security advisory and migration instructions.
Crucially, updating firmware *does not* remediate seeds generated on a vulnerable version; users must migrate their funds.
Coinkite's recommended migration process involves several critical steps. Users should first verify their existing seed backup. Following this, they must install the fixed firmware. A new seed should then be generated and securely recorded on the updated device. It is essential to verify the new wallet address on the device and perform a small test transaction to the new wallet before moving all remaining funds. Users are advised to retain their old backup until the migration is fully confirmed.
If a seed was supplemented with at least 50 fair, independent, and private dice rolls, it is not considered at risk from this flaw alone. A strong, unique BIP-39 passphrase also complicates exploitation, but it does not repair the underlying seed. Migration remains the most secure path for anyone potentially affected by the **Coldcard RNG flaw**.
Coinkite's data retention policy showed a notable discrepancy: security alerts were sent to customer emails retained since 2019, which contradicts co-founder Rodolfo Novak's earlier statements about deleting data after 90 days. This inconsistency in data handling practices is noteworthy, adding another layer of scrutiny to the incident's aftermath.
Lessons from the Coldcard RNG Flaw for Hardware Wallet Security
The **Coldcard RNG flaw** demonstrates that even established hardware can harbor fundamental, subtle bugs for extended periods. This incident highlights the necessity for more rigorous and continuous auditing, including formal verification and advanced static analysis tools, to detect subtle entropy issues that traditional reviews might miss, especially given the increasing sophistication of attack vectors. Formal verification, for instance, mathematically proves the correctness of algorithms, which could have caught the deterministic fallback.
The incident reinforces the importance of layered defenses and a deep understanding of underlying mechanisms. While a strong BIP-39 passphrase and additional dice rolls enhance entropy, the primary lesson is that any single point of failure, even within a trusted device's core functions, presents a potential exploit vector. Moving forward, hardware wallet security must prioritize verifiable and provable randomness, alongside continuous scrutiny of implementation details and a commitment to transparency in security disclosures. The ongoing vigilance required to secure self-custodied assets has never been clearer.
