Threat reportVulnerabilityTL-2026-1848
Coldcard/Coinkite Hardware Wallet RNG Vulnerability Exploited — $88M+ Bitcoin Stolen
Coldcard/Coinkite Hardware Wallet RNG Vulnerability (TL-2026-1848), also tracked as Coldcard RNG Fallback Vulnerability, is a critical-severity software vulnerability, first published 2026-08-03. It has no confirmed attribution, affects Coinkite Coldcard Mk2, maps to 15 MITRE ATT&CK techniques (T1027, T1048, T1059), and is covered by 9 detection rules and 1 indicator of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 1Indicators of compromise
Key facts for TL-2026-1848
- Threat ID
- TL-2026-1848
- Also known as
- Coldcard RNG Fallback Vulnerability, COLDCARD RNG Integration Error
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, financial-services, blockchain, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 1
Malware and tooling in Coldcard/Coinkite Hardware Wallet RNG Vulnerability
Malware and tooling: Automated Sweep Tool (unnamed), Entropy
How Coldcard/Coinkite Hardware Wallet RNG Vulnerability works
Critical firmware RNG integration flaw in Coldcard hardware wallets (Mk2-Mk5, Q) caused deterministic wallet seed generation, enabling attackers to recover private keys and steal at least 1,367 BTC (~$88.6M) from 4,585 victim addresses. Root cause: a libngu build-configuration bug (#ifndef instead of #if on MICROPY_HW_ENABLE_RNG) causes MicroPython's deterministic Yasmarang software PRNG to replace the STM32 hardware TRNG, with only 32-bit reseed on newer models. Active exploitation confirmed July 30, 2026 (Wave 1: $70.2M in 41 minutes). CISA added to KEV catalog August 3, 2026. No CVE assigned at publication.
On July 30, 2026, a coordinated cryptocurrency theft drained approximately 1,367 BTC (~$88.6M) from 4,585 Coldcard hardware wallet addresses across three attack waves. The theft exploited a latent firmware RNG integration vulnerability originally introduced in firmware v4.0.0 (March 17, 2021) and independently discovered by Block (Square) Engineering in research published March 2021. The root cause is a build-configuration mismatch in the libngu cryptographic library: the production board config defines MICROPY_HW_ENABLE_RNG as 0 (Coldcard provides its own hardware-RNG wrapper via ckcc.rng_bytes), but libngu checks the macro's definition with #ifndef rather than its value with #if. Since the macro exists (at value 0), the build succeeds, but ngu.random binds to MicroPython's rng_get() — the Yasmarang software PRNG — instead of the STM32 hardware TRNG.
Yasmarang is seeded from deterministic values: MCU UID, SysTick timer, and RTC registers. After initialization, no new entropy is collected — every subsequent output is a deterministic state transition. Libngu then XORs this output with a second Yasmarang generator initialized from public constants, which cannot create additional entropy. For Mk2/Mk3 on v4 firmware (no secure-element reseed), wallet generation is fully deterministic given known UID and timer state. For Mk4/Q/Mk5, boot adds secure-element entropy from SE1 and SE2, but only 4 bytes (32 bits) are retained by the reseed function — yielding at most 2^32 distinct output streams.
Chainalysis analyzed the attacker's methodology: the attacker used a paid account at a blockchain-services provider to systematically query and identify Coldcard-generated wallet addresses, prioritized high-value wallets first (stealing ~$30M in the first 10 minutes), and executed sweeps using an automated tool characterized by a uniform 30 sat/vB fee rate (30-75x overpayment vs. the 0.4-1.0 sat/vB median) and zero change outputs. Galaxy Research tracked three distinct attack waves: Wave 1 ($70.2M from 1,196 addresses in 41 minutes, P2WPKH outputs, shared collector addresses), Wave 2 (76.16 BTC from 1,478 mid-sized addresses), and Wave 3 (~208 BTC from 1,912 addresses using P2WSH outputs with unique destination addresses and ~6-victim batching). Attribution between waves is uncertain — each wave appears internally consistent but the operational differences may indicate separate actors.
Coinkite released patched firmware per model (Mk2/Mk3 v4.2.0, Mk4/Mk5 v5.6.0, Q v1.5.0Q, Edge v6.6.0X/QX) on July 30-31, 2026, and destroyed remaining vulnerable inventory. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on August 3, 2026. A BIP-39 passphrase reduces immediate risk but does not repair the underlying seed; users must generate a new seed on patched firmware. Seeds created with 50+ independent, private dice rolls are not considered at risk from this flaw alone. Block's products (Square, Cash App) use separate RNG implementations and were unaffected.
MITRE ATT&CK techniques used in TL-2026-1848
Defense Evasion
T1027 Obfuscated Files or Information; T1564 Hide Artifacts
Exfiltration
T1048 Exfiltration Over Alternative Protocol
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Initial Access
Command and Control
Resource Development
T1587 Develop Capabilities; T1588 Obtain Capabilities; T1608 Stage Capabilities
Reconnaissance
T1592 Gather Victim Host Information; T1594 Search Victim-Owned Websites; T1596 Search Open Technical Databases
Impact
defense-impairment
Affected products and versions in Coldcard/Coinkite Hardware Wallet RNG Vulnerability
- Coinkite — Coldcard Mk2
Vulnerable versions: 4.0.0; 4.0.1; 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; 4.1.6; 4.1.7
Fixed in: 4.2.0 and later - Coinkite — Coldcard Mk3
Vulnerable versions: 4.0.0; 4.0.1; 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4; 4.1.5; 4.1.6; 4.1.7
Fixed in: 4.2.0 and later - Coinkite — Coldcard Mk4
Vulnerable versions: All production firmware v5.0.0 through v5.5.x
Fixed in: 5.6.0 and later (Standard); 6.6.0X and later (Edge) - Coinkite — Coldcard Mk5
Vulnerable versions: All production firmware (same construction as Mk4)
Fixed in: 5.6.0 and later (Standard); 6.6.0X and later (Edge) - Coinkite — Coldcard Q
Vulnerable versions: All production firmware
Fixed in: 1.5.0Q and later (Standard); 6.6.0QX and later (Edge)
Remediation for Coldcard/Coinkite Hardware Wallet RNG Vulnerability
Patches
- Mk2/Mk3: Upgrade to firmware v4.2.0 or later
- Mk4/Mk5 (Standard): Upgrade to firmware v5.6.0 or later
- Mk4/Mk5 (Edge): Upgrade to firmware v6.6.0X or later
- Q (Standard): Upgrade to firmware v1.5.0Q or later
- Q (Edge): Upgrade to firmware v6.6.0QX or later
- TAPSIGNER, OPENDIME, SATSCARD are on different codebases and do NOT require patching for this vulnerability
Immediate actions
- Do NOT generate a new seed on any affected device before updating firmware
- Install patched firmware: Mk2/Mk3 → v4.2.0+, Mk4/Mk5 → v5.6.0+, Q → v1.5.0Q+, Edge → v6.6.0X/QX+
- Generate a completely new seed on the updated device
- Verify the new wallet address displays correctly on the device screen
- Send a small test transaction to confirm the new seed is functional
- Move ALL remaining funds from the old seed to the new wallet
Workarounds
- Seeds created with 50+ independent, private dice rolls (≥128 bits contributed entropy) are NOT at risk from this flaw alone
- A strong, unique BIP-39 passphrase reduces immediate risk but is NOT a substitute for migration to a new seed
- Coinkite provides a 7-step one-device migration procedure for Mk2/Mk3 v4.2.0+ using the same physical device
- Keep the old backup until migration is fully confirmed
- Do NOT dispose of affected devices — they may be needed if funds are recovered (Coinkite legal team coordinating with law enforcement)
Longer-term hardening
- Establish hardware wallet firmware integrity verification as part of procurement process
- Implement independent RNG validation testing for critical hardware security products
- Consider hardware wallets with cryptographically audited TRNG implementations and published third-party reviews
- Monitor CISA KEV and vendor advisories for hardware wallet security disclosures
Weaknesses (CWE) in Coldcard/Coinkite Hardware Wallet RNG Vulnerability
Timeline of Coldcard/Coinkite Hardware Wallet RNG Vulnerability
- Vulnerable #ifndef guard on the MICROPY_HW_ENABLE_RNG macro exists in the libngu source, built into production firmware. The guard checks macro definition rather than value — meaning setting the macro to 0 still satisfies the conditional and binds RNG to the Yasmarang fallback.
- Commit b18723dd migrates Coldcard wallet seed generation from ckcc.rng_bytes (which calls the STM32 hardware TRNG directly) to random.bytes(32), which routes through MicroPython's ngu.random — hitting the Yasmarang fallback. This extended the vulnerable code path to all wallet generation.
- Coldcard firmware v4.0.0 releases to production for Mk2/Mk3 devices, carrying the vulnerable wallet generation path. Mk2/Mk3 on v4 firmware have no cryptographic entropy mixed into ngu.random — wallet generation is fully deterministic given known UID and timer state.
- Commit 01cb43f7 adds 32-bit reseed API and Mk4 boot reseeding. The reseed reads 32 bytes from SE1 (ATECC608C TRNG) and 8 bytes from SE2 (DS28C36B ROM-options page), SHA-256d hashes them, then retains only 4 bytes (32 bits) — yielding at most 2^32 distinct output streams.
- First production Mk4 firmware v5.0.0 ships with the 32-bit reseed. Mk4/Q/Mk5 all inherit this construction — the reseed provides only 32 bits of secure-element entropy, far below the 128-bit cryptographic expectation.
- Coinkite publishes preliminary Mk3 seed generation advisory warning users not to generate new seeds on affected firmware. Block Engineering publishes full technical postmortem: 'Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware.'
- Block (Square) Bitcoin Engineering and Security teams detect reports of Coldcard user fund losses and investigate. Independently identify the root cause: libngu build configuration RNG integration error. Disclose findings to Coinkite.
- Wave 1 attack: 1,082.65 BTC (~$70.2M) drained from 1,196 Coldcard wallet addresses in 41 minutes (01:10-01:51 UTC). Attacker prioritized high-value wallets first, stealing ~$30M in the first 10 minutes. Used P2WPKH outputs with shared collector addresses, processed one victim per transaction, uniform 30 sat/vB fee rate, no change outputs. Chainalysis identifies attacker used a paid blockchain-services provider account to systematically query source addresses.
- Coinkite releases patched firmware: Mk2/Mk3 v4.2.0, Mk4/Mk5 v5.6.0, Q v1.5.0Q, Edge v6.6.0X and v6.6.0QX. Firmware update does NOT repair previously generated seeds — users must generate new seeds on patched firmware.
- Wave 3 attack: ~208 BTC stolen from 1,912 addresses. Tactics significantly different: used P2WSH outputs (capable of multisig/timelock conditions), sent each victim's coins to unique destination addresses (not shared collectors), batched ~6 victims per transaction, scanned only the default derivation path.
- Wave 2 attack: 76.16 BTC stolen from 1,478 mid-sized wallet addresses. Shared collector addresses used. Internal behavior consistent with Wave 1 operator.
- Galaxy Research publishes full transaction analysis identifying three attack waves totaling 1,367 BTC from 4,585 addresses. Shares ~600 suspected attacker addresses with federal investigators. Funds remain unmoved in attacker-controlled wallets.
- Clay Garrett (Block Bitcoin Engineering Lead) reveals on X that the attacker used a paid account at a well-known blockchain-services provider to query source addresses during the sweeps. Provider name withheld. Authorities notified.
- CISA adds the Coldcard RNG vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog. The Record publishes comprehensive report. Coinkite confirms destruction of remaining vulnerable inventory.
Sources cited for Coldcard/Coinkite Hardware Wallet RNG Vulnerability
- Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware
- Coldcard Mk3 Seed Generation Warning (Coinkite Advisory)
- Bitcoin hardware wallet maker destroys some inventory after more than $88 million stolen
- Coldcard wallet RNG flaw likely linked to $88 million Bitcoin theft
- CISA Known Exploited Vulnerabilities Catalog — Coldcard Entry
- Galaxy Research: Three Attack Waves Tracking
- Coldcard Firmware Repository — ChangeLog / Security Fixes
- The Coldcard RNG Incident: Source Code, Entropy, and Real-World Exploitability
- Coldcard Postmortem Analysis (Kelbie)
- Yasmarang PRNG — Original Specification and Limitations
- Crypto StackExchange — Yasmarang PRNG Internal State Recovery
- Chainalysis: Coldcard Attacker Behavioral Analysis
- Clay Garrett (Block): Blockchain Provider Account Statement on X
- CoinDesk: Bitcoin Cold Wallet Attack Spreads to 4,500 Addresses
- Crypto.news: Coldcard Bitcoin Losses Rise to $88.6M in Third Wave
Detection coverage for TL-2026-1848
As of 2026-08-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1848 across Splunk SPL, Microsoft KQL and Sigma, covering 1 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.