Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft
A firmware flaw in Coldcard hardware wallets, caused by a March 2021 integration error, allowed an attacker to steal approximately $70.2 million in Bitcoin from 1,196 addresses within 41 minutes.
A critical firmware vulnerability in Coldcard hardware wallets has been identified as the root cause behind a massive Bitcoin theft, where an attacker absconded with over $70 million worth of cryptocurrency in less than an hour. The incident, which saw 1,082.65 BTC siphoned from 1,196 addresses on July 30th, has been meticulously traced by Galaxy Research and Block to a specific integration error within Coldcard's firmware.
The core of the vulnerability lies in a March 2021 firmware update that incorrectly routed the generation of wallet seeds. Instead of utilizing the secure hardware random number generator (RNG) provided by the STM32 microcontroller, the process was diverted to a deterministic software pseudorandom number generator (PRNG). This fundamental flaw meant that the seeds, the master keys to a user's cryptocurrency, were not generated with sufficient entropy, making them potentially predictable.
According to Block's analysis, an attacker who could ascertain or sufficiently constrain key parameters such as the device's unique identifier (UID), its timer state at the time of seed generation, and the history of prior random number generator calls, could offline reproduce candidate output streams. By deriving addresses from these candidate seeds and comparing them against public blockchain data, the attacker could identify and target wallets with predictable seeds.
Coinkite, the Canadian manufacturer of Coldcard wallets, responded swiftly by releasing emergency firmware updates on July 31st for all affected models and release tracks. However, the company stressed that installing the patched firmware does not retroactively secure seeds that were generated on vulnerable firmware versions. Users whose seeds may have been compromised are strongly advised to generate entirely new seeds on the updated firmware and transfer their existing holdings to the new, secure wallets.
Restoring an old, potentially compromised seed onto updated firmware or a different wallet does not rectify the underlying weakness. The vulnerability persists with the seed itself, meaning any wallet derived from it remains at risk. To date, no public reconstruction of a victim's seed has been definitively linked to the drained addresses, though the pattern of the theft has been identified.
Block traced the specific production configuration error to the MICROPY_HW_ENABLE_RNG setting being defined as zero in Coldcard's build configuration. This occurred because Coinkite intended to use its own hardware-RNG wrapper. However, the libngu library, responsible for RNG functions, checked for the existence of the macro rather than its enabled state, inadvertently binding the build to MicroPython's fallback PRNG, Yasmarang. This fallback was initialized using the chip's unique ID and timer registers, failing to collect fresh entropy after initialization.
Coinkite estimates that the effective entropy for seeds generated on affected devices was significantly reduced – around 40 bits for Mk3 models and approximately 72 bits for Mk4, Mk5, and Q models, falling far short of the 128 bits expected for a secure BIP-39 seed. While Block did not provide a single practical entropy figure, they warned that the effective security levels were well below cryptographic standards. The cost of brute-forcing these seeds depends heavily on the attacker's knowledge of the device UID, boot timing, and prior RNG call history.
The vulnerability affects specific firmware versions across different Coldcard models: Mk2 and Mk3 versions 4.0.0 through 4.1.9 are vulnerable, with versions 4.0.1 through 4.1.9 listed by Coinkite as affected and 4.2.0 as fixed. For Mk4 and Mk5, any version prior to 5.6.0 is at risk, and for the Q model, versions prior to 1.5.0Q are vulnerable. Edge builds also have specific vulnerable ranges. Coinkite suggests that seeds generated using at least 50 independent dice rolls might be safe, but still recommends migrating funds as a precaution. The use of a strong BIP-39 passphrase creates a separate, secure wallet, but replacing the compromised seed is still advised.