Coldcard Hardware Wallet RNG Flaw Linked to $88 Million Bitcoin Theft

Block's engineering team traced a firmware integration error in Coldcard hardware wallets back to a March 2021 code change that routed seed generation to a deterministic software PRNG instead of the STM32 hardware RNG. Galaxy Research has linked the flaw to three waves of Bitcoin sweeps totaling 1,367 BTC worth roughly $88.6 million across 4,585 addresses. Coinkite shipped emergency firmware on July 31, but installing it does not repair seeds already generated on vulnerable firmware.

A firmware bug in Coldcard, the Bitcoin-only hardware wallet made by Canadian company Coinkite, has been linked to the theft of an estimated $88.6 million in Bitcoin. The vulnerability, first disclosed on July 30, 2026, traces back to a code change made in March 2021 that accidentally routed wallet seed generation away from the device's hardware random number generator and toward a predictable software fallback.

Block's Bitcoin Engineering and Security team published a root-cause analysis on their engineering blog, detailing how a single macro check in the libngu cryptographic library caused the build to bind to MicroPython's Yasmarang software PRNG instead of the STM32 hardware RNG that Coldcard was supposed to use. The flaw affected Coldcard Mk2 and Mk3 devices running firmware versions 4.0.0 through 4.1.9, and all production firmware on Mk4, Mk5, and Q models.

On-chain analysis firm Galaxy Research mapped the exploitation, identifying an initial sweep of 1,196 Bitcoin addresses in 41 minutes on July 30 that drained 1,082.65 BTC worth approximately $70.2 million. Two subsequent waves brought the total to 1,367.05 BTC across 4,585 addresses. Galaxy has reported roughly 600 suspected attacker-controlled addresses to federal investigators and compliance firms.

Key Takeaways

• A March 2021 firmware change in Coldcard hardware wallets accidentally routed seed generation to a deterministic software PRNG instead of the hardware RNG.
• Block's engineering team published a root-cause analysis showing libngu checked whether a macro was defined, not whether it was enabled, binding the build to MicroPython's Yasmarang fallback.
• Galaxy Research linked the flaw to three waves of Bitcoin sweeps totaling 1,367 BTC worth roughly $88.6 million across 4,585 addresses.
• Coinkite shipped emergency firmware on July 31 (v4.2.0 for Mk2/Mk3, v5.6.0 for Mk4), but installing it does not repair seeds already generated on vulnerable firmware.
• Seeds generated with at least 50 fair, independent, private dice rolls are not at risk from this bug. Strong BIP-39 passphrases add a barrier but Coinkite still recommends migration.
• Mk1 devices and older Mk2/Mk3 firmware through v3.2.2 are not affected because they used the hardware RNG directly.

What the vulnerability is

Coldcard wallets generate Bitcoin seed phrases using the STM32 microcontroller's hardware random number generator. The hardware RNG reads from physical entropy sources inside the chip, producing output that cannot be predicted even if you know the device's configuration.

In March 2021, Coinkite changed how wallet entropy is generated. The commit that introduced the change (b18723dd, dated March 1) switched wallet seed generation from calling rng_bytes(), which reached the board-local hardware RNG implementation, to calling random.bytes(32) through libngu's random module. The change first appeared in released firmware v4.0.0 on March 17, 2021.

The problem is that libngu selects its entropy source using a preprocessor check that looks for the existence of a macro called MICROPY_HW_ENABLE_RNG, not its value. Coldcard's production board configuration defines this macro as zero because the company supplies its own hardware-RNG wrapper. The #ifndef check in libngu passes because the macro exists. But MicroPython's conditional compilation uses the macro's value: when it is zero, MicroPython compiles the Yasmarang software fallback instead of the hardware RNG.

Yasmarang is a deterministic pseudo-random number generator. It initializes its state from the MCU's unique ID (low 32 bits), the SysTick timer register, and the RTC time and subsecond registers. After that single initialization, every output is a predictable function of those starting values and the number of prior calls. No new entropy is collected.

How an attacker exploits it

Block's analysis shows that an attacker who can determine or sufficiently constrain the device UID, timer state, and prior RNG-call history can reproduce the fallback stream offline. A wallet xpub, Bitcoin address, or generated public key serves as a validation oracle: generate candidate seeds, derive addresses, and check them against the public blockchain.

The search space depends on the device and firmware version. For Coldcard Mk2 and Mk3 running firmware v4.0.0 through v4.1.9, Block estimates an upper bound of approximately 2^40.7 candidate states if the UID and call history are known, and roughly 2^16.3 if the RTC register is stable during cold boot. For Mk4, Mk5, and Q devices, a secure-element reseed was added, but it hashes 32 bytes from one secure element and 8 bytes from another, retains only the first four bytes of the digest, and replaces only a single 32-bit state word. This limits the secure-element contribution to at most 2^32 distinguishable output streams.

Coldcard's own entropy estimates place effective security at roughly 40 bits on the Mk3 and about 72 bits on the Mk4, Mk5, and Q models. A standard 12-word BIP-39 seed requires 128 bits of entropy. The gap is significant.

What Galaxy Research found

Galaxy Research's on-chain analysis identified the initial attack wave on July 30, 2026. An attacker swept 1,196 Bitcoin addresses in 41 minutes, moving 1,082.65 BTC. The transaction pattern used a consistent 30 sat/vB fee and a no-change signature style that Galaxy said was distinctive enough to identify the operator, though the firm warned the pattern alone does not prove theft rather than a legitimate owner moving coins.

Two subsequent waves were identified afterward, bringing the total to 1,367.05 BTC across 4,585 addresses. Galaxy has reported approximately 600 suspected attacker-controlled addresses to federal investigators, compliance firms, and cybersecurity investigators. The firm cautioned that its findings are based on on-chain analysis and that it has not computationally confirmed that every identified address was generated with weak Coldcard entropy.

Galaxy also noted that no other Bitcoin transactions in the 30 days preceding the July 30 sweep shared the same signature pattern, suggesting this was not part of a broader campaign using the same technique.

Who is affected

Exposure depends on the firmware version running when the seed was created, not the device's manufacturing date or the firmware version installed today. Upgrading firmware does not retroactively repair an existing seed.

The affected firmware window is:

• Coldcard Mk2 and Mk3: firmware versions 4.0.0 through 4.1.9. These devices have no secure-element reseed, making them fully deterministic if the UID, timer state, and call history are known or constrainable.
• Coldcard Mk4, Mk5, and Q: all production firmware. These devices include a secure-element reseed, but Block's analysis shows it contributes at most 32 bits of additional entropy.
• Coldcard Mk1: not affected. All released firmware through v3.0.6 predates the regression.
• Coldcard Mk2 and Mk3 on firmware through v3.2.2: not affected. These versions used the direct ckcc.rng_bytes path to the STM32 hardware RNG.

Coinkite shipped emergency firmware on July 31. The fixed versions are 4.2.0 for Mk2/Mk3, 5.6.0 for Mk4, 1.5.0Q for Q, 6.6.0X for Mk4 Edge, and 6.6.0QX for Q Edge. Standard and Edge are separate release tracks. Users should not generate a new seed on any of these models until the update is installed.

Other affected functionality

The same ngu.random path is used throughout Coldcard's firmware, not just for wallet seed generation. Block's analysis flagged several other features that consume the same vulnerable RNG stream:

Paper wallet private keys. Generating a standalone Bitcoin private key and address uses my_random_bytes(32) directly as the secp256k1 private key. There is no BIP-39 step. The public address provides a validation oracle, so recovering the private key compromises only that paper wallet, not the main wallet.

Random seed XOR masks. The "random split" feature generates mask shares from ngu.random. If an attacker obtains one share, they can enumerate candidate masks, derive candidate original seeds, and validate against an address or xpub.

Cloning and USB encryption. Both generate ephemeral ECDH private keys from the RNG. A captured transcript contains the public keys needed to test candidate states. Recovering the key compromises the cloned backup or session confidentiality.

Key Teleport. This feature transfers secrets between devices using ECDH keys and a secondary password generated from the RNG. A captured exchange could allow an attacker to test candidate RNG states and potentially decrypt the teleported seed.

Secure Notes passwords. The password generator uses ngu.random for its word-based and dense-password options. Calling it twice does not double entropy.

Web2FA. This feature uses the RNG for TOTP material and ECDH keys, which could weaken the second factor or expose captured request contents.

Coinkite also confirmed that multisig arrangements only help when the quorum includes at least one device from an unaffected codebase. TAPSIGNER, OPENDIME, and SATSCARD use different implementations and are not affected.

What users should do

Coinkite's advisory gives users three scenarios to evaluate against their own setup.

Dice-roll exception. If you entered at least 50 fair and independent dice rolls when creating your seed, and the rolls were not recorded or exposed, Coinkite says the resulting seed is not at risk from this RNG issue alone. The device-generated entropy is hashed together with each dice roll, and 50 dice rolls (each providing roughly 2.58 bits of entropy) contribute far more than the bug compromises.

Passphrase users. A strong, unique BIP-39 passphrase creates a separate wallet that the seed words alone cannot reach. However, Coinkite says a short, common, patterned, quoted, or reused passphrase may be guessable. Even with a strong passphrase, migrate to a newly generated seed as soon as practical. Continue to protect the passphrase and do not enter it into a website or untrusted device.

Everyone else. If you cannot confirm you used 50+ private dice rolls, or you are uncertain about the number or privacy of those rolls, migrate. Restore your seed on a device running patched firmware or generate a new seed on patched firmware and move your coins. Restoring the old seed to updated firmware or another wallet carries the weakness forward.

Why this matters

This vulnerability surfaced during active exploitation, which is why Block published its analysis early rather than waiting for a full empirical confirmation. The flaw remained undetected for over five years, introduced by a single commit that changed one function call and was missed because the library's macro check did not validate the macro's value.

The incident follows Coinspect researcher Ill Bloom's findings in early July 2026, which linked a separate weak-PRNG flaw in older software wallets to more than $5 million drained from addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon. Together, these incidents highlight a recurring pattern: hardware and software wallets alike can carry entropy weaknesses for years before anyone notices, and the damage compounds while the vulnerability goes unpatched. For another take on market-side Bitcoin dynamics, see this week's crypto market recap.

Frequently Asked Questions

Q: Does updating Coldcard firmware fix my existing seed?
No. Firmware updates prevent future seeds from being generated with the vulnerable RNG, but they do not repair seeds already created on affected firmware. If your seed was generated between March 2021 and July 2026 on affected firmware, you should migrate your funds regardless of the firmware version currently installed.

Q: Is my Coldcard affected if I bought it recently?
It depends on which firmware version was running when you generated your seed, not when you bought the device. If you generated your seed on Mk2 or Mk3 firmware v4.0.0 through 4.1.9, or on any Mk4/Mk5/Q firmware before the July 31 emergency patches, your seed is potentially vulnerable. Check the firmware version that was active at the time of seed generation.

Q: Will a BIP-39 passphrase protect my funds?
A strong, unique passphrase creates an additional barrier that an attacker must also discover. But Coinkite does not consider a passphrase a complete fix and still recommends migrating to a new seed. If your passphrase is short, common, patterned, quoted, or reused, treat your funds as at risk and migrate immediately.

Q: Are TAPSIGNER or OPENDIME wallets affected?
No. TAPSIGNER, OPENDIME, and SATSCARD use different codebases and are not affected by this RNG flaw. However, if you use a Coldcard in a multisig arrangement with these devices, the arrangement is only secure if the quorum is not built entirely from affected Coldcard devices.

Q: Has the attacker been identified?
No. Galaxy Research mapped the on-chain activity and identified the transaction signature pattern, but has not named the attacker. The firm warned that the pattern identifies the operator, not the theft, because a sweep looks the same as if a coin owner chose to move coins.

Conclusion

The Coldcard RNG vulnerability is a reminder that security depends on the weakest link in the chain, not the strongest component. Coldcard's hardware RNG was never bypassed. A single misplaced preprocessor check in a dependency library routed seed generation to a deterministic software fallback, and the bug went undetected for over five years. By the time it was found, active exploitation had already drained an estimated $88.6 million across thousands of addresses.

Coinkite's emergency firmware patch stops new vulnerable seeds from being created. But for anyone who generated a seed during the affected window, the only real fix is to migrate to a new seed on patched firmware. The longer users wait, the more time an attacker has to refine their search strategies and test additional candidates against the expanding set of known addresses.

References

• The Hacker News: Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
• Block Engineering: Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware
• Coinkite: Coldcard Security Advisory
• Bleeping Computer: Coldcard Wallet RNG Flaw Likely Linked to $88 Million Bitcoin Theft