Coldcard Hardware Wallet RNG Flaw Enables $88.6M Bitcoin Theft from 4,585 Addresses — Threadlinqs Intelligence
As of 2026-08-03, Coldcard Hardware Wallet RNG Flaw Enables $88.6M Bitcoin Theft from 4,585 Addresses is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 26 indicators of compromise.
Threat ID: TL-2026-1829 · Severity: CRITICAL · Status: ACTIVE · Category: VULNERABILITY
A March 2021 code defect silently disabled the STM32 hardware RNG on Coinkite Coldcard wallets (Mk2/Mk3/Mk4/Mk5/Q), collapsing seed entropy to roughly 40-72 bits. Attackers exploited the weakness to
On March 1, 2021, a code change in Coinkite's libngu cryptographic library introduced a defect in the macro guard controlling Coldcard hardware wallets' random number generator (RNG) selection. The check tested only whether the MICROPY_HW_ENABLE_RNG configuration macro was defined, not whether it was enabled -- and because the Coldcard board configuration defines the macro while setting it to zero, the #ifndef guard silently passed and the firmware bound to MicroPython's deterministic Yasmarang software fallback PRNG instead of the intended STM32 true hardware RNG. Firmware 4.0.0, released March 17, 2021, introduced the affected wallet-generation code path, and the defect persisted undetected in production firmware for roughly five years.
The Yasmarang fallback is seeded from fixed or highly-constrained values -- the low 32 bits of the microcontroller's UID XORed with the SysTick counter, plus the RTC time-of-day and subsecond registers -- none of which constitute cryptographic entropy. A March 2022 attempt (firmware v5.0.0, Mk4) to mitigate the flaw via secure-element reseeding introduced a second defect: ngu.random.reseed() only accepts a 32-bit integer, so only 4 bytes of a SHA256d digest computed from two secure-element RNG reads reach the reseed call, overwriting a single Yasmarang state word rather than initializing a proper DRBG. The practical result is an effective entropy ceiling of roughly 40 bits on Mk2/Mk3 (pre-reseed) and roughly 72 bits on Mk4/Mk5/Q (post-reseed) -- far short of the 128 bits a standard 12-word BIP-39 mnemonic is expected to provide.
Because a wallet's public key, address, or xpub functions as a free candidate-validation oracle against the public Bitcoin blockchain, an attacker can enumerate the constrained fallback-PRNG state space offline, derive secp256k1 keys and addresses for each candidate, and check them against known on-chain addresses -- recovering the private key the moment a match is found, entirely without ever touching the victim's device. Galaxy Research identified an automated, large-scale sweep of 1,196 addresses (1,082.65 BTC, ~$70.2M) in a 41-minute window on July 30, 2026, roughly 30 hours before Coinkite's public disclosure -- indicating the flaw, or an equivalent one, had already been independently discovered and weaponized. Chainalysis found the attacker prioritized high-value wallets, extracting roughly $30M in the first ten minutes alone. Two further waves on August 1, 2026 brought the cumulative total to 1,367.05 BTC (~$88.6M) across 4,585 addresses; the third wave (207.7294 BTC) used materially different transaction construction (P2WSH batch outputs to individually specified destinations, default-derivation-path-only targeting) from waves 1-2, leaving Galaxy Research unable to confirm whether one attacker evolved their tooling or a second actor independently exploited the same weakness. Reported attacker-controlled addresses (~600) remain unspent as of the latest reporting.
Coinkite shipped emergency firmware (4.2.0 for Mk2/Mk3; 5.6.0/6.6.0X for Mk4/Mk5; 1.5.0Q/6.6.0QX for Q) on July 31, 2026, but the fix only prevents new seeds from being generated with weak entropy -- it cannot repair a seed already generated on vulnerable firmware. Any funds secured by a Coldcard-generated seed from firmware predating the patch, and not supplemented with at least 50 independent dice rolls or a strong BIP-39 passphrase at generation time, must be migrated to a freshly generated seed. Beyond wallet seeds, the same weak-RNG code path affects paper-wallet key generation, cloning/USB-encryption ECDH keys, Key Teleport ephemeral keys, Web2FA TOTP secrets and per-request nonces, Secure Notes dense-password generation (which calls generate_seed() twice against the same small-state generator), and seed XOR masks used in Coldcard's multi-part seed-split feature; functions calling the hardware RNG directly (ckcc.rng_bytes) were never affected. Coldcard Mk1 firmware (through v3.0.6) predates th
Weaknesses (CWE)
CWE-330, CWE-338, CWE-337
Target sectors: finance, cryptocurrency
Target regions: Global
Detections & IOCs
As of 2026-08-08, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 26 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1587.004, T1587.001, T1588.005, T1588.006, T1588.002, T1596.005, T1592.004, T1592.002, T1552.004, T1110
