COLDCARD flaw linked to $88.6 million Bitcoin theft

A vulnerability in COLDCARD hardware wallet firmware likely enabled the theft of an estimated $88.6 million in Bitcoin from thousands of wallets whose seeds were generated with a flawed random number generator.

Galaxy Research said it identified an initial wave of transactions on July 30 that likely exploited the issue. The 41-minute attack drained approximately 1,083 BTC, then worth $70.2 million, from 1,196 addresses. It took place roughly 30 hours before Coinkite publicly disclosed the flaw.

Every transaction used the same hardcoded fee rate of 30 satoshis per virtual byte and included no change output. That pattern led Galaxy to conclude that the theft was automated rather than a series of owner-initiated transfers.

“Signature: every sweep paid an identical hardcoded 30.0 sat/vB — a 30-75x overpay vs the 0.4-1.0 sat/vB median that week — and left no change output. That looks like an automated tool spending keys it already held, not owners moving funds.”

On August 1, Galaxy identified second and third waves, raising the estimated total to 1,367 BTC, worth approximately $88.6 million, stolen from 4,585 addresses. The Bitcoin remained in attacker-controlled addresses when Galaxy published its report.

Chainalysis said the attacker prioritized high-value wallets, taking approximately $30 million during the first ten minutes and $1.8 million from one victim. That pattern suggested the attacker had identified and studied the affected wallets before starting the thefts.

Recommended reading

Hidden Word prompts can spread through Microsoft Copilot

×

Transactions for stolen COLDCARD assets over time Source: Chainalysis

How the COLDCARD RNG flaw exposed wallet seeds

Block’s Bitcoin Engineering and Security teams began investigating after reports of Bitcoin being stolen from COLDCARD wallets. Working with other researchers, the teams traced the problem to an integration error in the wallet’s random-number-generation code and disclosed their findings to Coinkite on July 30.

According to Block, COLDCARD firmware caused ngu.random to use MicroPython’s deterministic Yasmarang fallback instead of the device’s STM32 hardware RNG. COLDCARD has a separate hardware random-number generator, but an incorrect firmware check directed seed generation to the deterministic software generator.

The fallback relied on the device’s microcontroller identifier and system-timing values. Block said those inputs are not cryptographically secure and may be observable or reconstructable. An attacker could therefore generate likely wallet seeds offline, derive their Bitcoin addresses, and compare them with addresses visible on the blockchain. A matching address would reveal the seed needed to generate the wallet’s private keys.

Affected firmware versions and migration steps

Coinkite says affected seeds include those generated on:

• Mk2 and Mk3: firmware versions 4.0.1 through 4.1.9
• Mk4 and Mk5: standard versions before 5.6.0 or Edge versions before 6.6.0X
• Q devices: standard versions before 1.5.0Q or Edge versions before 6.6.0QX

Fixed firmware is available as 4.2.0 or later for Mk2 and Mk3, 5.6.0 or later for standard Mk4 and Mk5 devices, 1.5.0Q or later for standard Q devices, and 6.6.0X or 6.6.0QX for the corresponding Edge releases.

Updating firmware does not repair a seed that was already generated. Coinkite recommends that affected users:

• Verify their existing backup.
• Install the fixed firmware.
• Generate and securely record a new seed.
• Verify the new wallet address on the device.
• Send a small test transaction.
• Move the remaining funds after confirming the test.

The old backup should be retained until the migration is complete and confirmed.

Seeds supplemented with at least 50 fair, independent, and private dice rolls are not considered at risk from this flaw alone, according to Coinkite. A strong, unique BIP-39 passphrase also makes exploitation harder, but users should still migrate because a passphrase does not repair the underlying seed.

Coinkite says its TAPSIGNER, OPENDIME, and SATSCARD products are unaffected because they use different codebases. The company also destroyed all COLDCARD devices awaiting shipment with the affected firmware and emailed customers whose devices had already shipped with migration instructions.

×