Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin Wallet Theft ($70.2M Drained) — Threadlinqs Intelligence
As of 2026-08-03, Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin Wallet Theft ($70.2M Drained) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 10 indicators of compromise.
Threat ID: TL-2026-1840 · Severity: CRITICAL · CVSS: 9.5 · Status: ACTIVE · Category: VULNERABILITY
A critical C preprocessor macro misuse in Coldcard hardware wallet firmware (introduced March 2021) caused the device to generate BIP-39 seed phrases using MicroPython's deterministic Yasmarang PRNG
## Vulnerability Root Cause
The Coldcard firmware RNG vulnerability stems from a subtle C preprocessor build-configuration bug introduced during the libngu/MicroPython migration of wallet generation in 2021. The production board configuration headers (COLDCARD board variant) define `MICROPY_HW_ENABLE_RNG` as `(0)` because Coldcard provides its own hardware-RNG wrapper (`ckcc.rng_bytes`) exposed to Python. However, the libngu cryptographic library checks for the macro's presence using `#ifndef` (which only verifies the macro exists) rather than `#if` (which would check that it is set to a non-zero value). Since `(0)` is still "defined," the guard passes silently. Simultaneously, MicroPython correctly interprets `(0)` as disabled and compiles in its deterministic Yasmarang software PRNG fallback. The result: `ngu.random.bytes(32)` — the function used for wallet seed generation — produces output from a fully deterministic PRNG.
On Mk2 and Mk3 devices, the Yasmarang fallback is seeded using only the MCU UID, SysTick timer value, and RTC registers — fixed/observable values with no cryptographic entropy. After initialization, no new entropy is ever collected; every subsequent output is a deterministic state transition. To compound the issue, libngu XORs its own separate Yasmarang generator (initialized from hardcoded public constants: pad=0x0a8ce26f, n=69, d=233) on top of MicroPython's output. XORing two deterministic PRNGs cannot create entropy.
On Mk4, Q, and Mk5 devices, a boot-time secure-element reseed was added (commit 01cb43f7, March 2022) that collects 32 bytes from SE1 and 8 bytes from SE2, hashes them with SHA256d, then truncates the digest to just the first 4 bytes (32 bits) before reseeding one Yasmarang state word via `ngu.random.reseed(n)`. This yields at most 2^32 possible output streams for any fixed fallback state — brute-forceable with modest computational resources.
## Attack Execution
The attacker pre-computed private keys offline by enumerating the constrained entropy space and matching candidate wallet addresses against the Bitcoin UTXO set. They used a paid account at a well-known blockchain data provider (per Block engineer Clay Garrett's investigation) to pre-identify victim addresses with funds. The provider's internal logs matched the attacker's workflow with "extraordinary specificity," though there is no evidence of knowing participation.
Wave 1 (July 30, 01:10-01:51 UTC) swept 1,082.65 BTC from 1,196 addresses with identical 30 sat/vB fees — 30-75x the week's median fee of 0.4-1.0 sat/vB — and no change outputs, confirming the attacker already possessed the private keys. The sweep hit high-value wallets early, including a ~$1.8M single-address victim. Funds consolidated to four addresses (562.02 BTC, 398.48 BTC, 89.62 BTC, and 32.45 BTC) that remain unmoved. Affected derivation paths spanned BIP-84 (native SegWit, 1,183 addresses), BIP-49 (7 addresses), and BIP-44 (legacy, 6 addresses), indicating systematic scanning across HD wallet derivation trees.
Wave 2 (July 31) drained 76.16 BTC from 1,478 addresses using the same collector addresses and P2WPKH outputs as Wave 1, occurring ~27 hours later. Wave 3 (~Aug 1) evolved the methodology significantly: the attacker abandoned shared collector addresses in favor of 293 separate P2WSH vaults (hiding spending conditions), batched ~6.37 victims per sweep transaction, scanned only the default BIP-84 derivation path, and used varying fee rates. This divergence may represent either an anti-forensic tooling upgrade by the same operator or an independent second attacker exploiting the same vulnerable key space.
## Impact Timeline
The regression first shipped in firmware v4.0.0 on March 17, 2021 — meaning all Coldcard wallet seeds generated across Mk2, Mk3, Mk4, Mk5, and Q devices over 5+ years of production firmware are potentially compromised. Coinkite CEO Rodolfo "NVK" Novak issued a public apology on July 31, taking "full accountability" and suggesting
Weaknesses (CWE)
CWE-338, CWE-330, CWE-326
Target sectors: cryptocurrency, finance, individuals
Target regions: Global
Detections & IOCs
As of 2026-08-23, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 10 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1592, T1587, T1588, T1078, T1542, T1027, T1555, T1082, T1119, T1485
