COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million Bitcoin Theft — Threadlinqs Intelligence
As of 2026-08-02, COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million Bitcoin Theft is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 23 indicators of compromise.
Threat ID: TL-2026-1822 · Severity: CRITICAL · Status: ACTIVE · Category: VULNERABILITY
A 2021 firmware regression caused COLDCARD hardware wallets to derive seed entropy from MicroPython's deterministic Yasmarang PRNG instead of the STM32 hardware RNG, due to a preprocessor guard that
On March 1, 2021, commit b18723dd ("First pass w/ libNgU") in the Coldcard/firmware repository changed wallet seed generation in shared/seed.py from ckcc.rng_bytes() — a direct call into the STM32 microcontroller's true hardware random number generator — to ngu.random.bytes(), which routes through Coinkite's libngu library. Inside libngu's random.c, a guard reading '#ifndef MICROPY_HW_ENABLE_RNG' was intended to fail the build if no hardware RNG was configured, but the board configuration set MICROPY_HW_ENABLE_RNG to 0 rather than leaving it undefined. Because '#ifndef' tests only macro existence and not its value, the check passed, and firmware shipped from v4.0.0 (released March 17, 2021) onward silently linked MicroPython's software-only Yasmarang PRNG in place of the hardware TRNG for all seed generation and related cryptographic material.
Yasmarang seeded itself once, at first use, from non-cryptographic values: the low 32 bits of the device's fixed manufacturing UID XORed with the SysTick millisecond counter, plus the RTC time-of-day and sub-second registers. Because the UID is a static identifier (not a secret) and the timer/RTC values are constrained to a small, boot-time-correlated range, Block's Bitcoin Engineering and Security team calculated effective entropy of roughly 40 bits for Mk2/Mk3 devices on firmware v4.0.1-4.1.9 (no reseed at all) versus the intended 128 bits. A March 2022 fix (commit 01cb43f7) added a secure-element-based reseed for Mk4/Mk5/Q devices, mixing 40 bytes of SE1/SE2 hardware entropy via SHA-256d — but only the first 4 bytes (32 bits) of that digest were actually applied to reseed a single Yasmarang state word, capping those devices at roughly 72 bits of effective entropy even after the 'fix'. The flaw was not limited to wallet seeds: paper-wallet keys, seed XOR split masks, cloning/USB-encryption ECDH keys, Key Teleport secrets, Web2FA TOTP/ECDH material, and Secure Notes passwords all drew from the same compromised ngu.random stream.
Researchers (independently, via Block's engineering team and Galaxy Research) disclosed the flaw to Coinkite on July 30, 2026. Roughly 30 hours before Coinkite's public advisory, an attacker who had apparently already reverse-engineered or independently discovered the same weakness executed a 41-minute sweep on July 30 draining approximately 1,083 BTC (~$70.2M, with Chainalysis noting ~$30M taken in the first ten minutes) from 1,196 addresses. Every sweep transaction shared an identical, non-default 30 sat/vB fee rate and left no change output, a fingerprint Galaxy Research read as evidence of automated, scripted draining (with Galaxy characterizing the operation as "deliberate and programmatic, probably orchestrated with a large language model"). Individual victims reported similar sweeps in the preceding days, including a Canadian coach whose 18.25 BTC was swept from an offline, safety-deposit-box-stored device in a seven-minute window on July 29. Two further waves on August 1-2 brought the cumulative total to roughly 1,367.05 BTC (~$88.6M) across 4,585 addresses, with stolen coins averaging 3.18 years of prior dormancy, suggesting deliberate targeting of high-value, long-held wallets rather than opportunistic sweeping. Galaxy Research identified approximately 600 suspected attacker-controlled addresses and reported them to federal investigators and blockchain-compliance firms; no attacker cash-out infrastructure, exchange accounts, or specific attacker addresses have been publicly disclosed.
Coinkite published its advisory and fixed firmware (4.2.0 for Mk2/Mk3; 5.6.0/6.6.0X for Mk4/Mk5; 1.5.0Q/6.6.0QX for Q) on August 1, 2026, scoping confirmed risk to Mk2/Mk3 devices running v4.0.1-4.1.9 and Mk4/Mk5/Q devices on pre-fix firmware. Critically, the firmware update does not retroactively repair already-generated seeds: any seed produced on vulnerable firmware remains exactly as weak as it was the day it was created, and Coinkite is urging affected users to ge
Weaknesses (CWE)
CWE-338, CWE-330, CWE-1241, CWE-670
Target sectors: finance, cryptocurrency, consumer
Target regions: Global
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 23 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1592.004, T1596.005, T1593.003, T1588, T1588.006, T1587, T1587.004, T1195.003, T1600, T1600.001
