# Coldcard Firmware RNG Flaw Enables Coordinated Bitcoin Wallet Theft ($70.2M Drained)

> A critical C preprocessor macro misuse in Coldcard hardware wallet firmware (introduced March 2021) caused the device to generate BIP-39 seed phrases using MicroPython's deterministic Yasmarang PRNG instead of the STM32 hardware true random number generator. On July 30, 2026, attackers exploited this weakness in a 41-minute automated sweep (blocks 960,183-960,191), draining 1,082.65 BTC (~$70.2M) from 1,196 addresses. Two additional waves through August 1 brought total losses to 1,367.05 BTC (~$88.6M) across 4,585 addresses. Coinkite released emergency firmware patches ~30 hours post-attack, but updating cannot retroactively fix already-generated weak seeds.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1840
- **ID:** TL-2026-1840
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

## Vulnerability Root Cause

The Coldcard firmware RNG vulnerability stems from a subtle C preprocessor build-configuration bug introduced during the libngu/MicroPython migration of wallet generation in 2021. The production board configuration headers (COLDCARD board variant) define `MICROPY_HW_ENABLE_RNG` as `(0)` because Coldcard provides its own hardware-RNG wrapper (`ckcc.rng_bytes`) exposed to Python. However, the libngu cryptographic library checks for the macro's presence using `#ifndef` (which only verifies the macro exists) rather than `#if` (which would check that it is set to a non-zero value). Since `(0)` is still "defined," the guard passes silently. Simultaneously, MicroPython correctly interprets `(0)` as disabled and compiles in its deterministic Yasmarang software PRNG fallback. The result: `ngu.random.bytes(32)` — the function used for wallet seed generation — produces output from a fully deterministic PRNG.

On Mk2 and Mk3 devices, the Yasmarang fallback is seeded using only the MCU UID, SysTick timer value, and RTC registers — fixed/observable values with no cryptographic entropy. After initialization, no new entropy is ever collected; every subsequent output is a deterministic state transition. To compound the issue, libngu XORs its own separate Yasmarang generator (initialized from hardcoded public constants: pad=0x0a8ce26f, n=69, d=233) on top of MicroPython's output. XORing two deterministic PRNGs cannot create entropy.

On Mk4, Q, and Mk5 devices, a boot-time secure-element reseed was added (commit 01cb43f7, March 2022) that collects 32 bytes from SE1 and 8 bytes from SE2, hashes them with SHA256d, then truncates the digest to just the first 4 bytes (32 bits) before reseeding one Yasmarang state word via `ngu.random.reseed(n)`. This yields at most 2^32 possible output streams for any fixed fallback state — brute-forceable with modest computational resources.

## Attack Execution

The attacker pre-computed private keys offline by enumerating the constrained entropy space and matching candidate wallet addresses against the Bitcoin UTXO set. They used a paid account at a well-known blockchain data provider (per Block engineer Clay Garrett's investigation) to pre-identify victim addresses with funds. The provider's internal logs matched the attacker's workflow with "extraordinary specificity," though there is no evidence of knowing participation.

Wave 1 (July 30, 01:10-01:51 UTC) swept 1,082.65 BTC from 1,196 addresses with identical 30 sat/vB fees — 30-75x the week's median fee of 0.4-1.0 sat/vB — and no change outputs, confirming the attacker already possessed the private keys. The sweep hit high-value wallets early, including a ~$1.8M single-address victim. Funds consolidated to four addresses (562.02 BTC, 398.48 BTC, 89.62 BTC, and 32.45 BTC) that remain unmoved. Affected derivation paths spanned BIP-84 (native SegWit, 1,183 addresses), BIP-49 (7 addresses), and BIP-44 (legacy, 6 addresses), indicating systematic scanning across HD wallet derivation trees.

Wave 2 (July 31) drained 76.16 BTC from 1,478 addresses using the same collector addresses and P2WPKH outputs as Wave 1, occurring ~27 hours later. Wave 3 (~Aug 1) evolved the methodology significantly: the attacker abandoned shared collector addresses in favor of 293 separate P2WSH vaults (hiding spending conditions), batched ~6.37 victims per sweep transaction, scanned only the default BIP-84 derivation path, and used varying fee rates. This divergence may represent either an anti-forensic tooling upgrade by the same operator or an independent second attacker exploiting the same vulnerable key space.

## Impact Timeline

The regression first shipped in firmware v4.0.0 on March 17, 2021 — meaning all Coldcard wallet seeds generated across Mk2, Mk3, Mk4, Mk5, and Q devices over 5+ years of production firmware are potentially compromised. Coinkite CEO Rodolfo "NVK" Novak issued a public apology on July 31, taking "full accountability" and suggesting the vulnerability may have been discovered using AI — an observation that has sparked industry debate about AI-assisted vulnerability discovery in hardware security. Emergency firmware patches were released for all models (Mk2/Mk3: v4.2.0; Mk4/Mk5: v5.6.0 standard, v6.6.0X Edge; Q: v1.5.0Q standard, v6.6.0QX Edge). However, firmware updates cannot retroactively repair seeds generated on vulnerable versions; affected users must migrate to newly generated seeds on patched hardware. Coinkite states that seeds supplemented with at least 50 fair, independent dice rolls are not exposed by this flaw alone, and strong BIP-39 passphrases provide additional (though not complete) protection.

All ~1,367 BTC stolen across all three waves remained unspent in attacker-controlled addresses as of August 3 reporting — an unusual pattern that may indicate the attacker is waiting for attention to subside or lacks sufficient laundering infrastructure.

## Industry Impact

The supply-chain implications are severe: this is a firmware-level cryptographic weakness that persisted for over five years across an entire hardware wallet product line. Rival manufacturers (Trezor, Ledger, Tangem) quickly distanced themselves, confirming their products are unaffected. The incident undermines trust in self-custody hardware wallets, with some analysts questioning the viability of hardware-based cold storage when firmware build processes can silently introduce catastrophic cryptographic failures.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1078 Valid Accounts
- T1542 Pre-OS Boot
- T1027 Obfuscated Files or Information
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1119 Automated Collection
- T1485 Data Destruction

## Sources

- [Coldcard Firmware Flaw Lets Attackers Drain Bitcoin Wallets](https://gbhackers.com/coldcard-firmware-flaw/)
- [Predictable RNG Fallback and 32-bit Reseed in Coldcard Firmware](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware)
- [Coinkite Coldcard Security Advisory — Emergency Firmware Update](https://www.coinkite.com/)
- [Galaxy Research X Thread — Coldcard On-Chain Analysis](https://stacker.news/items/1537971)
- [Galaxy Maps Coldcard Bitcoin Losses After Wallet Incident](https://cointelegraph.com/news/coldcard-bitcoin-loss-estimate-70-million-galaxy-analysis)
- [Bitcoin Cold-Wallet Attack Spreads to 4,500 Addresses](https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million/)
- [Coldcard Losses Rise to $88.6M in Third Wave of Sweeps](https://crypto.news/coldcard-bitcoin-losses-rise-to-88-6m-in-third-wave/)
- [Block Traces $38M Coldcard Bitcoin Theft to Service Provider](https://www.cointrust.com/market-news/block-traces-38m-coldcard-bitcoin-theft-to-service-provider)
- [The $89 Million Coldcard Heist — How Weak Randomness Drained 4,585 Bitcoin Wallets](https://www.bleuken.com/the-89-million-coldcard-heist-how-weak-randomness-drained-4585-bitcoin-wallets/)
- [Coldcard Wallet Critical Firmware Bug Allows Massive Bitcoin Theft](https://www.bleepingcomputer.com/news/security/coldcard-wallet-critical-firmware-bug-allows-massive-bitcoin-theft/)
- [Bitcoin Holders Lose $88,600,000 in Coldcard Crypto Wallet Exploit](https://dailyhodl.com/2026/08/03/bitcoin-holders-lose-88600000-in-coldcard-crypto-wallet-exploit-galaxy-researchers/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1840