Threat reportVulnerabilityTL-2026-1840
Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin Wallet Theft ($70.2M Drained)
Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin (TL-2026-1840) is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-08-03. It has no confirmed attribution, affects Coinkite Coldcard Mk2, maps to 10 MITRE ATT&CK techniques (T1027, T1078, T1082), and is covered by 9 detection rules and 10 indicators of compromise.
- CVSS
- 9.5/10Critical
- CVEs
- 0None referenced
- Techniques
- 10MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-1840
- Threat ID
- TL-2026-1840
- Severity
- CRITICAL
- CVSS
- 9.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, finance, individuals
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin
Malware and tooling: Entropy, Automated Key-Derivation Sweep Bot
How Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin works
A critical C preprocessor macro misuse in Coldcard hardware wallet firmware (introduced March 2021) caused the device to generate BIP-39 seed phrases using MicroPython's deterministic Yasmarang PRNG instead of the STM32 hardware true random number generator. On July 30, 2026, attackers exploited this weakness in a 41-minute automated sweep (blocks 960,183-960,191), draining 1,082.65 BTC (~$70.2M) from 1,196 addresses. Two additional waves through August 1 brought total losses to 1,367.05 BTC (~$88.6M) across 4,585 addresses. Coinkite released emergency firmware patches ~30 hours post-attack, but updating cannot retroactively fix already-generated weak seeds.
## Vulnerability Root Cause
The Coldcard firmware RNG vulnerability stems from a subtle C preprocessor build-configuration bug introduced during the libngu/MicroPython migration of wallet generation in 2021. The production board configuration headers (COLDCARD board variant) define `MICROPY_HW_ENABLE_RNG` as `(0)` because Coldcard provides its own hardware-RNG wrapper (`ckcc.rng_bytes`) exposed to Python. However, the libngu cryptographic library checks for the macro's presence using `#ifndef` (which only verifies the macro exists) rather than `#if` (which would check that it is set to a non-zero value). Since `(0)` is still "defined," the guard passes silently. Simultaneously, MicroPython correctly interprets `(0)` as disabled and compiles in its deterministic Yasmarang software PRNG fallback. The result: `ngu.random.bytes(32)` — the function used for wallet seed generation — produces output from a fully deterministic PRNG.
On Mk2 and Mk3 devices, the Yasmarang fallback is seeded using only the MCU UID, SysTick timer value, and RTC registers — fixed/observable values with no cryptographic entropy. After initialization, no new entropy is ever collected; every subsequent output is a deterministic state transition. To compound the issue, libngu XORs its own separate Yasmarang generator (initialized from hardcoded public constants: pad=0x0a8ce26f, n=69, d=233) on top of MicroPython's output. XORing two deterministic PRNGs cannot create entropy.
On Mk4, Q, and Mk5 devices, a boot-time secure-element reseed was added (commit 01cb43f7, March 2022) that collects 32 bytes from SE1 and 8 bytes from SE2, hashes them with SHA256d, then truncates the digest to just the first 4 bytes (32 bits) before reseeding one Yasmarang state word via `ngu.random.reseed(n)`. This yields at most 2^32 possible output streams for any fixed fallback state — brute-forceable with modest computational resources.
## Attack Execution
The attacker pre-computed private keys offline by enumerating the constrained entropy space and matching candidate wallet addresses against the Bitcoin UTXO set. They used a paid account at a well-known blockchain data provider (per Block engineer Clay Garrett's investigation) to pre-identify victim addresses with funds. The provider's internal logs matched the attacker's workflow with "extraordinary specificity," though there is no evidence of knowing participation.
Wave 1 (July 30, 01:10-01:51 UTC) swept 1,082.65 BTC from 1,196 addresses with identical 30 sat/vB fees — 30-75x the week's median fee of 0.4-1.0 sat/vB — and no change outputs, confirming the attacker already possessed the private keys. The sweep hit high-value wallets early, including a ~$1.8M single-address victim. Funds consolidated to four addresses (562.02 BTC, 398.48 BTC, 89.62 BTC, and 32.45 BTC) that remain unmoved. Affected derivation paths spanned BIP-84 (native SegWit, 1,183 addresses), BIP-49 (7 addresses), and BIP-44 (legacy, 6 addresses), indicating systematic scanning across HD wallet derivation trees.
Wave 2 (July 31) drained 76.16 BTC from 1,478 addresses using the same collector addresses and P2WPKH outputs as Wave 1, occurring ~27 hours later. Wave 3 (~Aug 1) evolved the methodology significantly: the attacker abandoned shared collector addresses in favor of 293 separate P2WSH vaults (hiding spending conditions), batched ~6.37 victims per sweep transaction, scanned only the default BIP-84 derivation path, and used varying fee rates. This divergence may represent either an anti-forensic tooling upgrade by the same operator or an independent second attacker exploiting the same vulnerable key space.
## Impact Timeline
The regression first shipped in firmware v4.0.0 on March 17, 2021 — meaning all Coldcard wallet seeds generated across Mk2, Mk3, Mk4, Mk5, and Q devices over 5+ years of production firmware are potentially compromised. Coinkite CEO Rodolfo "NVK" Novak issued a public apology on July 31, taking "full accountability" and suggesting the vulnerability may have been discovered using AI — an observation that has sparked industry debate about AI-assisted vulnerability discovery in hardware security. Emergency firmware patches were released for all models (Mk2/Mk3: v4.2.0; Mk4/Mk5: v5.6.0 standard, v6.6.0X Edge; Q: v1.5.0Q standard, v6.6.0QX Edge). However, firmware updates cannot retroactively repair seeds generated on vulnerable versions; affected users must migrate to newly generated seeds on patched hardware. Coinkite states that seeds supplemented with at least 50 fair, independent dice rolls are not exposed by this flaw alone, and strong BIP-39 passphrases provide additional (though not complete) protection.
All ~1,367 BTC stolen across all three waves remained unspent in attacker-controlled addresses as of August 3 reporting — an unusual pattern that may indicate the attacker is waiting for attention to subside or lacks sufficient laundering infrastructure.
## Industry Impact
The supply-chain implications are severe: this is a firmware-level cryptographic weakness that persisted for over five years across an entire hardware wallet product line. Rival manufacturers (Trezor, Ledger, Tangem) quickly distanced themselves, confirming their products are unaffected. The incident undermines trust in self-custody hardware wallets, with some analysts questioning the viability of hardware-based cold storage when firmware build processes can silently introduce catastrophic cryptographic failures.
MITRE ATT&CK techniques used in TL-2026-1840
Defense Evasion
T1027 Obfuscated Files or Information
Initial Access
Discovery
T1082 System Information Discovery
Collection
Impact
Persistence
Credential Access
T1555 Credentials from Password Stores
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin
- Coinkite — Coldcard Mk2
Vulnerable versions: 4.0.0; 4.0.1; 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; 4.1.6; 4.1.7
Fixed in: 4.2.0 - Coinkite — Coldcard Mk3
Vulnerable versions: 4.0.0; 4.0.1; 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; 4.1.6; 4.1.7
Fixed in: 4.2.0 - Coinkite — Coldcard Mk4
Vulnerable versions: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5; 5.1.0; 5.2.0; 5.3.0; 5.4.0
Fixed in: 5.6.0 - Coinkite — Coldcard Mk5
Vulnerable versions: 5.0.0; 5.0.1; 5.0.2; 5.0.3; 5.0.4; 5.0.5; 5.1.0; 5.2.0; 5.3.0; 5.4.0
Fixed in: 5.6.0 - Coinkite — Coldcard Q
Vulnerable versions: 1.0.0Q; 1.1.0Q; 1.2.0Q; 1.3.0Q; 1.4.0Q
Fixed in: 1.5.0Q - Coinkite — Coldcard Edge
Vulnerable versions: 6.0.0X; 6.1.0X; 6.2.0X; 6.3.0X; 6.4.0X; 6.5.0X
Fixed in: 6.6.0X; 6.6.0QX
Remediation for Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin
Patches
- Mk2/Mk3: Update to firmware v4.2.0 or later
- Mk4/Mk5: Update to firmware v5.6.0 (Standard) or v6.6.0X (Edge) or later
- Coldcard Q: Update to firmware v1.5.0Q (Standard) or v6.6.0QX (Edge) or later
Immediate actions
- Move all funds from Coldcard wallets seeded on vulnerable firmware (Mk2/Mk3 v4.0.0-v4.1.9; Mk4/Mk5 before v5.6.0; Q before v1.5.0Q)
- Generate a completely new seed on updated firmware (do not reuse the old seed)
- Send a small test transaction before migrating the full balance
- Keep old seed backups until migration is fully confirmed
Workarounds
- Seeds generated with at least 50 fair independent dice rolls + strong BIP-39 passphrase may mitigate risk but migration is still recommended
- Tapsigner, Opendime, and Satscard products are NOT affected
Longer-term hardening
- Supplement hardware-wallet seed generation with at least 50 fair independent dice rolls
- Use strong unique BIP-39 passphrases as additional entropy layer
- Monitor cold wallets for unexpected outgoing transactions
- Consider multi-signature self-custody setups for significant holdings
- Review firmware update processes to ensure cryptographic integrity
Weaknesses (CWE) in Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin
Timeline of Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin
- Vulnerable libngu STM32 guard compiled using #ifndef macro check; Coldcard board config sets MICROPY_HW_ENABLE_RNG to (0)
- Commit b18723dd migrates Coldcard wallet seed generation from ckcc.rng_bytes to ngu.random.bytes(32), routing entropy through the vulnerable Yasmarang fallback
- Coldcard firmware v4.0.0 released with the vulnerable RNG path — all wallet seeds generated on this and subsequent versions are potentially compromised
- Commit 01cb43f7 adds 32-bit reseed API using secure-element entropy; Mk4 boot reseeding implemented but only 4 of 40 bytes retained — yielding at most 2^32 possible output streams
- First production Mk4 firmware v5.0.0 released with insufficient 32-bit secure-element reseed — not a complete fix
- Block engineers and researcher Clay Garrett first identify the theft pattern on-chain; Galaxy Research begins transaction flow analysis
- Wave 1: 1,082.65 BTC (~$70.2M) drained from 1,196 addresses in 41 minutes (01:10-01:51 UTC, Bitcoin blocks 960,183-960,191). Identical 30 sat/vB fees, no change outputs, 4 consolidation addresses. BIP-84 (1,183), BIP-49 (7), and BIP-44 (6) derivation paths targeted
- Block Engineering publishes full root-cause analysis: C preprocessor macro misuse (#ifndef instead of #if) caused MicroPython Yasmarang fallback to be used in place of STM32 hardware TRNG
- Wave 2: 76.16 BTC drained from 1,478 addresses using same collector addresses and P2WPKH outputs as Wave 1, occurring ~27 hours after Wave 1
- Coinkite releases emergency firmware patches for all affected models (Mk2/Mk3 v4.2.0; Mk4/Mk5 v5.6.0; Q v1.5.0Q). CEO Rodolfo 'NVK' Novak issues public apology
- Wave 3: 207.73 BTC drained from 1,912 addresses using 293 separate P2WSH vaults (hidden spending conditions), batched ~6.37 victims per sweep, only default BIP-84 derivation path
- Galaxy Research revises total losses to 1,367.05 BTC (~$88.6M) across 4,585 addresses across three attack waves; all stolen BTC remains unmoved in ~596 attacker-controlled addresses
- GBHackers, BleepingComputer, CoinDesk, Cointelegraph, CryptoNews, and other outlets publish comprehensive incident reports. No CVE assigned yet (pending)
Sources cited for Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin
- Coldcard Firmware Flaw Lets Attackers Drain Bitcoin Wallets
- Predictable RNG Fallback and 32-bit Reseed in Coldcard Firmware
- Coinkite Coldcard Security Advisory — Emergency Firmware Update
- Galaxy Research X Thread — Coldcard On-Chain Analysis
- Galaxy Maps Coldcard Bitcoin Losses After Wallet Incident
- Bitcoin Cold-Wallet Attack Spreads to 4,500 Addresses
- Coldcard Losses Rise to $88.6M in Third Wave of Sweeps
- Coldcard Bitcoin Loss Estimate $70 Million — Galaxy Analysis
- Block Traces $38M Coldcard Bitcoin Theft to Service Provider
- The $89 Million Coldcard Heist — How Weak Randomness Drained 4,585 Bitcoin Wallets
- Coldcard Wallet Critical Firmware Bug Allows Massive Bitcoin Theft
- Bitcoin Holders Lose $88,600,000 in Coldcard Crypto Wallet Exploit
Detection coverage for TL-2026-1840
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1840 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.