# COLDCARD Hardware Wallet RNG Flaw Linked to $88.6 Million Bitcoin Theft

> A 2021 firmware regression caused COLDCARD hardware wallets to derive seed entropy from MicroPython's deterministic Yasmarang PRNG instead of the STM32 hardware RNG, due to a preprocessor guard that tested only whether MICROPY_HW_ENABLE_RNG was defined, not whether it was non-zero. An attacker exploited the resulting predictable seeds to drain roughly 1,367 BTC (~$88.6M) from 4,585 addresses across three waves beginning July 30, 2026, about 30 hours before Coinkite's public disclosure and patched-firmware release.

- **Published:** 2026-08-02T00:00:00Z
- **Last reviewed:** 2026-08-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1822
- **ID:** TL-2026-1822
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On March 1, 2021, commit b18723dd ("First pass w/ libNgU") in the Coldcard/firmware repository changed wallet seed generation in shared/seed.py from ckcc.rng_bytes() — a direct call into the STM32 microcontroller's true hardware random number generator — to ngu.random.bytes(), which routes through Coinkite's libngu library. Inside libngu's random.c, a guard reading '#ifndef MICROPY_HW_ENABLE_RNG' was intended to fail the build if no hardware RNG was configured, but the board configuration set MICROPY_HW_ENABLE_RNG to 0 rather than leaving it undefined. Because '#ifndef' tests only macro existence and not its value, the check passed, and firmware shipped from v4.0.0 (released March 17, 2021) onward silently linked MicroPython's software-only Yasmarang PRNG in place of the hardware TRNG for all seed generation and related cryptographic material.

Yasmarang seeded itself once, at first use, from non-cryptographic values: the low 32 bits of the device's fixed manufacturing UID XORed with the SysTick millisecond counter, plus the RTC time-of-day and sub-second registers. Because the UID is a static identifier (not a secret) and the timer/RTC values are constrained to a small, boot-time-correlated range, Block's Bitcoin Engineering and Security team calculated effective entropy of roughly 40 bits for Mk2/Mk3 devices on firmware v4.0.1-4.1.9 (no reseed at all) versus the intended 128 bits. A March 2022 fix (commit 01cb43f7) added a secure-element-based reseed for Mk4/Mk5/Q devices, mixing 40 bytes of SE1/SE2 hardware entropy via SHA-256d — but only the first 4 bytes (32 bits) of that digest were actually applied to reseed a single Yasmarang state word, capping those devices at roughly 72 bits of effective entropy even after the 'fix'. The flaw was not limited to wallet seeds: paper-wallet keys, seed XOR split masks, cloning/USB-encryption ECDH keys, Key Teleport secrets, Web2FA TOTP/ECDH material, and Secure Notes passwords all drew from the same compromised ngu.random stream.

Researchers (independently, via Block's engineering team and Galaxy Research) disclosed the flaw to Coinkite on July 30, 2026. Roughly 30 hours before Coinkite's public advisory, an attacker who had apparently already reverse-engineered or independently discovered the same weakness executed a 41-minute sweep on July 30 draining approximately 1,083 BTC (~$70.2M, with Chainalysis noting ~$30M taken in the first ten minutes) from 1,196 addresses. Every sweep transaction shared an identical, non-default 30 sat/vB fee rate and left no change output, a fingerprint Galaxy Research read as evidence of automated, scripted draining (with Galaxy characterizing the operation as "deliberate and programmatic, probably orchestrated with a large language model"). Individual victims reported similar sweeps in the preceding days, including a Canadian coach whose 18.25 BTC was swept from an offline, safety-deposit-box-stored device in a seven-minute window on July 29. Two further waves on August 1-2 brought the cumulative total to roughly 1,367.05 BTC (~$88.6M) across 4,585 addresses, with stolen coins averaging 3.18 years of prior dormancy, suggesting deliberate targeting of high-value, long-held wallets rather than opportunistic sweeping. Galaxy Research identified approximately 600 suspected attacker-controlled addresses and reported them to federal investigators and blockchain-compliance firms; no attacker cash-out infrastructure, exchange accounts, or specific attacker addresses have been publicly disclosed.

Coinkite published its advisory and fixed firmware (4.2.0 for Mk2/Mk3; 5.6.0/6.6.0X for Mk4/Mk5; 1.5.0Q/6.6.0QX for Q) on August 1, 2026, scoping confirmed risk to Mk2/Mk3 devices running v4.0.1-4.1.9 and Mk4/Mk5/Q devices on pre-fix firmware. Critically, the firmware update does not retroactively repair already-generated seeds: any seed produced on vulnerable firmware remains exactly as weak as it was the day it was created, and Coinkite is urging affected users to generate an entirely new seed and migrate funds. Coinkite's guidance notes that seeds generated with at least 50 fair, independent, private dice rolls, or protected by a strong unique BIP-39 passphrase, are not considered at risk from this issue alone. TAPSIGNER, OPENDIME, and SATSCARD use unrelated codebases and are unaffected. The incident follows a pattern of similar weak-PRNG wallet vulnerabilities — Milk Sad (2023), the Trust Wallet browser extension flaw (2023), and the Ill Bloom disclosure (2026, ~$5M+ stolen across six blockchains) — all sharing the same root failure class: a PRNG that functions correctly as code but is not cryptographically secure being used where a CSPRNG was required.

## MITRE ATT&CK

- T1592.004 Client Configurations
- T1596.005 Scan Databases
- T1593.003 Code Repositories
- T1588 Obtain Capabilities
- T1588.006 Vulnerabilities
- T1587 Develop Capabilities
- T1587.004 Exploits
- T1195.003 Compromise Hardware Supply Chain
- T1600 Weaken Encryption
- T1600.001 Reduce Key Space
- T1552 Unsecured Credentials
- T1552.004 Private Keys
- T1082 System Information Discovery
- T1005 Data from Local System
- T1119 Automated Collection
- T1657 Financial Theft

## Sources

- [COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft](https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/)
- [Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware)
- [Coldcard Security Advisory (Mk3 seed generation warning)](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/)
- [Technical Deep Dive into the Entropy Issue](https://blog.coinkite.com/entropy-technical-backgrounder/)
- [Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes](https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html)
- [Coldcard Bitcoin Exploit Balloons to $88 Million as Attackers Keep Draining Wallets](https://decrypt.co/374817/coldcard-bitcoin-exploit-88-million-attackers-draining-wallets)
- [First pass w/ libNgU (commit b18723d)](https://github.com/Coldcard/firmware/commit/b18723dddb6d751c39978e4364b56b2414f68b47)
- [Seed RNG with RNG from both SE's (commit 01cb43f7)](https://github.com/Coldcard/firmware/commit/01cb43f7e87cc806963a74cbe0fcb4155f23a2a3)
- [Coldcard Hardware Wallet Hacked via Firmware Bug That Bypassed RNG for Five Years](https://www.techtimes.com/articles/322392/20260731/coldcard-hardware-wallet-hacked-via-firmware-bug-that-bypassed-rng-five-years.htm)
- [Major bitcoin wallet flaw drains 594 BTC in 25-minute sweep](https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep)
- [Ill Bloom: Crypto Wallet Vulnerability](https://illbloom.org/)
- [Critical Coldcard flaw: what happened, who is affected, and what to do](https://wizardsardine.com/blog/coldcard-rng-vulnerability/)
- [When random.bytes() runs but doesn't work](https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1822