Threat reportVulnerabilityTL-2026-1822
COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million Bitcoin Theft
COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million (TL-2026-1822), also tracked as COLDCARD RNG Flaw, is a critical-severity software vulnerability, first published 2026-08-02. It has no confirmed attribution, affects Coinkite COLDCARD Mk2, maps to 16 MITRE ATT&CK techniques (T1005, T1082, T1119), and is covered by 9 detection rules and 23 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 16MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 23Indicators of compromise
Key facts for TL-2026-1822
- Threat ID
- TL-2026-1822
- Also known as
- COLDCARD RNG Flaw, Coldcard Entropy Bug, Coldcard Seed Generation Vulnerability, Coldcard Yasmarang Fallback
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, cryptocurrency, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million
Malware and tooling: Yasmarang PRNG, libngu
How COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million works
A 2021 firmware regression caused COLDCARD hardware wallets to derive seed entropy from MicroPython's deterministic Yasmarang PRNG instead of the STM32 hardware RNG, due to a preprocessor guard that tested only whether MICROPY_HW_ENABLE_RNG was defined, not whether it was non-zero. An attacker exploited the resulting predictable seeds to drain roughly 1,367 BTC (~$88.6M) from 4,585 addresses across three waves beginning July 30, 2026, about 30 hours before Coinkite's public disclosure and patched-firmware release.
On March 1, 2021, commit b18723dd ("First pass w/ libNgU") in the Coldcard/firmware repository changed wallet seed generation in shared/seed.py from ckcc.rng_bytes() — a direct call into the STM32 microcontroller's true hardware random number generator — to ngu.random.bytes(), which routes through Coinkite's libngu library. Inside libngu's random.c, a guard reading '#ifndef MICROPY_HW_ENABLE_RNG' was intended to fail the build if no hardware RNG was configured, but the board configuration set MICROPY_HW_ENABLE_RNG to 0 rather than leaving it undefined. Because '#ifndef' tests only macro existence and not its value, the check passed, and firmware shipped from v4.0.0 (released March 17, 2021) onward silently linked MicroPython's software-only Yasmarang PRNG in place of the hardware TRNG for all seed generation and related cryptographic material.
Yasmarang seeded itself once, at first use, from non-cryptographic values: the low 32 bits of the device's fixed manufacturing UID XORed with the SysTick millisecond counter, plus the RTC time-of-day and sub-second registers. Because the UID is a static identifier (not a secret) and the timer/RTC values are constrained to a small, boot-time-correlated range, Block's Bitcoin Engineering and Security team calculated effective entropy of roughly 40 bits for Mk2/Mk3 devices on firmware v4.0.1-4.1.9 (no reseed at all) versus the intended 128 bits. A March 2022 fix (commit 01cb43f7) added a secure-element-based reseed for Mk4/Mk5/Q devices, mixing 40 bytes of SE1/SE2 hardware entropy via SHA-256d — but only the first 4 bytes (32 bits) of that digest were actually applied to reseed a single Yasmarang state word, capping those devices at roughly 72 bits of effective entropy even after the 'fix'. The flaw was not limited to wallet seeds: paper-wallet keys, seed XOR split masks, cloning/USB-encryption ECDH keys, Key Teleport secrets, Web2FA TOTP/ECDH material, and Secure Notes passwords all drew from the same compromised ngu.random stream.
Researchers (independently, via Block's engineering team and Galaxy Research) disclosed the flaw to Coinkite on July 30, 2026. Roughly 30 hours before Coinkite's public advisory, an attacker who had apparently already reverse-engineered or independently discovered the same weakness executed a 41-minute sweep on July 30 draining approximately 1,083 BTC (~$70.2M, with Chainalysis noting ~$30M taken in the first ten minutes) from 1,196 addresses. Every sweep transaction shared an identical, non-default 30 sat/vB fee rate and left no change output, a fingerprint Galaxy Research read as evidence of automated, scripted draining (with Galaxy characterizing the operation as "deliberate and programmatic, probably orchestrated with a large language model"). Individual victims reported similar sweeps in the preceding days, including a Canadian coach whose 18.25 BTC was swept from an offline, safety-deposit-box-stored device in a seven-minute window on July 29. Two further waves on August 1-2 brought the cumulative total to roughly 1,367.05 BTC (~$88.6M) across 4,585 addresses, with stolen coins averaging 3.18 years of prior dormancy, suggesting deliberate targeting of high-value, long-held wallets rather than opportunistic sweeping. Galaxy Research identified approximately 600 suspected attacker-controlled addresses and reported them to federal investigators and blockchain-compliance firms; no attacker cash-out infrastructure, exchange accounts, or specific attacker addresses have been publicly disclosed.
Coinkite published its advisory and fixed firmware (4.2.0 for Mk2/Mk3; 5.6.0/6.6.0X for Mk4/Mk5; 1.5.0Q/6.6.0QX for Q) on August 1, 2026, scoping confirmed risk to Mk2/Mk3 devices running v4.0.1-4.1.9 and Mk4/Mk5/Q devices on pre-fix firmware. Critically, the firmware update does not retroactively repair already-generated seeds: any seed produced on vulnerable firmware remains exactly as weak as it was the day it was created, and Coinkite is urging affected users to generate an entirely new seed and migrate funds. Coinkite's guidance notes that seeds generated with at least 50 fair, independent, private dice rolls, or protected by a strong unique BIP-39 passphrase, are not considered at risk from this issue alone. TAPSIGNER, OPENDIME, and SATSCARD use unrelated codebases and are unaffected. The incident follows a pattern of similar weak-PRNG wallet vulnerabilities — Milk Sad (2023), the Trust Wallet browser extension flaw (2023), and the Ill Bloom disclosure (2026, ~$5M+ stolen across six blockchains) — all sharing the same root failure class: a PRNG that functions correctly as code but is not cryptographically secure being used where a CSPRNG was required.
MITRE ATT&CK techniques used in TL-2026-1822
Collection
T1005 Data from Local System; T1119 Automated Collection
Discovery
T1082 System Information Discovery
Initial Access
T1195.003 Compromise Hardware Supply Chain
Credential Access
T1552 Unsecured Credentials; T1552.004 Private Keys
Resource Development
T1587 Develop Capabilities; T1587.004 Exploits; T1588 Obtain Capabilities; T1588.006 Vulnerabilities
Reconnaissance
T1592.004 Client Configurations; T1593.003 Code Repositories; T1596.005 Scan Databases
defense-impairment
T1600 Weaken Encryption; T1600.001 Reduce Key Space
Impact
Affected products and versions in COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million
- Coinkite — COLDCARD Mk2
Vulnerable versions: 4.0.1; 4.1.9; range 4.0.1-4.1.9
Fixed in: 4.2.0 and later - Coinkite — COLDCARD Mk3
Vulnerable versions: 4.0.1; 4.1.9; range 4.0.1-4.1.9
Fixed in: 4.2.0 and later - Coinkite — COLDCARD Mk4
Vulnerable versions: all production firmware before standard 5.6.0 / Edge 6.6.0X (32-bit reseed only, ~72-bit effective entropy)
Fixed in: 5.6.0 (standard) and later; 6.6.0X (Edge) and later - Coinkite — COLDCARD Mk5
Vulnerable versions: all production firmware before standard 5.6.0 / Edge 6.6.0X (32-bit reseed only, ~72-bit effective entropy)
Fixed in: 5.6.0 (standard) and later; 6.6.0X (Edge) and later - Coinkite — COLDCARD Q
Vulnerable versions: all production firmware before standard 1.5.0Q / Edge 6.6.0QX (32-bit reseed only, ~72-bit effective entropy)
Fixed in: 1.5.0Q (standard) and later; 6.6.0QX (Edge) and later
Remediation for COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million
Patches
- COLDCARD Mk2/Mk3 firmware 4.2.0 or later
- COLDCARD Mk4/Mk5 standard firmware 5.6.0 or later / Edge firmware 6.6.0X or later
- COLDCARD Q standard firmware 1.5.0Q or later / Edge firmware 6.6.0QX or later
Immediate actions
- Immediately move funds from any wallet whose seed was generated on COLDCARD Mk2/Mk3 firmware v4.0.1-4.1.9, or on Mk4/Mk5/Q firmware prior to 5.6.0/1.5.0Q/6.6.0X/6.6.0QX, to a brand-new seed generated on patched firmware.
- Do not reuse or re-import the old seed anywhere — the weak entropy is a property of the seed itself and is not corrected by a firmware update.
- Prioritize migrating high-value and long-dormant wallets first; on-chain analysis shows the attacker specifically targeted these.
- Verify new firmware version and checksum before generating a replacement seed, then test with a small transaction before transferring full balances.
Workarounds
- Seeds generated with at least 50 fair, independent, private dice rolls are not considered at risk from this RNG issue alone per Coinkite's advisory.
- A strong, unique BIP-39 passphrase applied atop a weak device-generated seed adds an independent barrier an attacker must separately discover.
Longer-term hardening
- Prefer hardware wallets/procedures that let users supply and verify at least 50 fair, independent dice rolls as an independent entropy source.
- Layer a strong, unique BIP-39 passphrase on top of the device-generated seed so device-side RNG weaknesses alone cannot expose funds.
- For organizational custody, require a quorum of independently-sourced, unaffected devices in multisig rather than trusting any single device's on-board RNG.
- Firmware vendors should add build-time verification that hardware RNG symbols are actually linked (not merely macro-defined) as a CI gate, given this exact class of #ifndef-vs-value bug.
Weaknesses (CWE) in COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million
Timeline of COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million
- The flawed '#ifndef MICROPY_HW_ENABLE_RNG' guard in libngu's random.c already exists in the codebase, testing macro existence rather than its value.
- Commit b18723dd ("First pass w/ libNgU") changes wallet seed generation in shared/seed.py from ckcc.rng_bytes() (STM32 hardware RNG) to ngu.random.bytes(), which resolves to the deterministic Yasmarang software fallback.
- COLDCARD firmware v4.0.0 ships to Mk2/Mk3 devices with the vulnerable RNG code path active.
- Commit 01cb43f7 adds a secure-element-based reseed for ngu.random on Mk4/Q/Mk5, but only 4 of 40 bytes of SE entropy actually reach the Yasmarang reseed state.
- COLDCARD Mk4 firmware v5.0.0 ships with the insufficient 32-bit reseed mitigation, capping effective entropy at roughly 72 bits.
- A Canadian coach reports 18.25 BTC (~$1.6M CAD) swept from his COLDCARD-protected wallets in a seven-minute window, despite keys never touching the internet.
- Coinkite publishes an initial public security advisory acknowledging the RNG issue, ahead of fixed firmware availability.
- First theft wave: approximately 1,083 BTC (~$70.2M) drained from 1,196 addresses in a 41-minute window, using a uniform 30 sat/vB fee rate and no change outputs; Chainalysis notes ~$30M taken in the first ten minutes.
- Researchers (Block's Bitcoin Engineering and Security team and Galaxy Research) disclose the RNG root cause to Coinkite, roughly 30 hours ahead of public disclosure.
- A second wave of draining transactions is identified, adding to the observed losses following the initial July 30 sweep.
- Coinkite updates its advisory (2:35pm EDT) with links to fixed firmware (4.2.0 for Mk2/Mk3; 5.6.0/6.6.0X for Mk4/Mk5; 1.5.0Q/6.6.0QX for Q).
- BleepingComputer and other outlets publish consolidated coverage of the RNG root cause and the $88.6M theft, citing Block, Galaxy Research, and Chainalysis.
- Galaxy Research flags roughly 600 suspected attacker-controlled addresses and shares findings with federal investigators and blockchain-compliance firms; lead analyst Alex Thorn states the victim-address investigation database continues to grow.
- Galaxy Research identifies a third wave draining 207.73 BTC, bringing the cumulative total to approximately 1,367 BTC (~$88.6M) across 4,585 addresses.
Sources cited for COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million
- COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft
- Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware
- Coldcard Security Advisory (Mk3 seed generation warning)
- Technical Deep Dive into the Entropy Issue
- Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes
- Coldcard Bitcoin Exploit Balloons to $88 Million as Attackers Keep Draining Wallets
- First pass w/ libNgU (commit b18723d)
- Seed RNG with RNG from both SE's (commit 01cb43f7)
- Coldcard Hardware Wallet Hacked via Firmware Bug That Bypassed RNG for Five Years
- Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep
- Ill Bloom: Crypto Wallet Vulnerability
- Critical Coldcard flaw: what happened, who is affected, and what to do
- When random.bytes() runs but doesn't work
Detection coverage for TL-2026-1822
As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1822 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.