Coldcard Firmware Flaw Leads to $88 Million Bitcoin Theft

The root cause is a failure in the device's random number generation path that silently substitutes a deterministic software generator for the dedicated STM32 hardware RNG.

The Deterministic Seed Path

The vulnerability sits in ngu.random, a routine that should consume entropy from COLDCARD's onboard hardware RNG. Block's analysis shows that a check in the firmware caused this call to fall back to MicroPython's Yasmarang generator — a deterministic routine seeded from the microcontroller's identifier and system timing values. Because those inputs are not cryptographically unpredictable and may be reconstructable, an attacker could enumerate plausible seeds offline, derive the corresponding Bitcoin addresses, and match them against on-chain addresses to recover private keys.

That mechanic shifts the threat model from physical tampering to pure offline computation: once a vulnerable device generated a seed, the resulting wallet became searchable by anyone with the firmware source and sufficient compute, even though the device itself remained air-gapped.

The Attack Signature

Galaxy Research traced an initial wave on July 30 that drained approximately 1,083 BTC (~$70.2 million) from 1,196 addresses over a 41-minute window — roughly 30 hours before Coinkite's public disclosure. Every transaction carried an identical 30 sat/vB fee, several multiples above the 0.4–1.0 sat/vB median for the week, and produced no change outputs. Chainalysis corroborated the pattern, noting that the operator prioritized high-value wallets — about $30 million in the first ten minutes and $1.8 million from a single victim — consistent with pre-staged targeting rather than opportunistic sweeping.

Two subsequent waves, observed by August 1, brought the total to roughly 1,367 BTC across 4,585 addresses. At the time of Galaxy's report, the proceeds remained in attacker-controlled addresses.

Affected Firmware and the Repair Boundary

Coinkite's advisory lists vulnerable firmware as: Mk2 and Mk3 versions 4.0.1 through 4.1.9; Mk4 and Mk5 devices before standard 5.6.0 or Edge 6.6.0X; Q devices before standard 1.5.0Q or Edge 6.6.0QX. Patched builds — 4.2.0+ for Mk2/Mk3, 5.6.0+ for Mk4/Mk5, 1.5.0Q+ for Q, and 6.6.0X / 6.6.0QX for Edge — close the RNG path but do not retroactively replace seeds already generated on a vulnerable build. Wallets created under those versions remain exposed regardless of subsequent firmware updates; the only remediation is migration of funds to a seed produced by a known-good entropy source.

Long-Term Implications

The incident illustrates how a single integration oversight at an entropy boundary can convert an air-gapped cold-storage device into a remotely enumerable target. For protocol architects, it underscores the case for explicit fail-closed behavior in RNG subsystems — a deterministic fallback should never silently substitute for an unavailable hardware source. From a regulatory angle, the 41-minute gap between exploit and public disclosure is likely to feed ongoing pressure for coordinated vulnerability handling and binding hardware certification baselines across consumer-grade custody products.