# Coldcard/Coinkite Hardware Wallet RNG Vulnerability Exploited — $88M+ Bitcoin Stolen

> Critical firmware RNG integration flaw in Coldcard hardware wallets (Mk2-Mk5, Q) caused deterministic wallet seed generation, enabling attackers to recover private keys and steal at least 1,367 BTC (~$88.6M) from 4,585 victim addresses. Root cause: a libngu build-configuration bug (#ifndef instead of #if on MICROPY_HW_ENABLE_RNG) causes MicroPython's deterministic Yasmarang software PRNG to replace the STM32 hardware TRNG, with only 32-bit reseed on newer models. Active exploitation confirmed July 30, 2026 (Wave 1: $70.2M in 41 minutes). CISA added to KEV catalog August 3, 2026. No CVE assigned at publication.

- **Published:** 2026-08-03T00:00:00Z
- **Last reviewed:** 2026-08-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1848
- **ID:** TL-2026-1848
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 1 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 30, 2026, a coordinated cryptocurrency theft drained approximately 1,367 BTC (~$88.6M) from 4,585 Coldcard hardware wallet addresses across three attack waves. The theft exploited a latent firmware RNG integration vulnerability originally introduced in firmware v4.0.0 (March 17, 2021) and independently discovered by Block (Square) Engineering in research published March 2021. The root cause is a build-configuration mismatch in the libngu cryptographic library: the production board config defines MICROPY_HW_ENABLE_RNG as 0 (Coldcard provides its own hardware-RNG wrapper via ckcc.rng_bytes), but libngu checks the macro's definition with #ifndef rather than its value with #if. Since the macro exists (at value 0), the build succeeds, but ngu.random binds to MicroPython's rng_get() — the Yasmarang software PRNG — instead of the STM32 hardware TRNG.

Yasmarang is seeded from deterministic values: MCU UID, SysTick timer, and RTC registers. After initialization, no new entropy is collected — every subsequent output is a deterministic state transition. Libngu then XORs this output with a second Yasmarang generator initialized from public constants, which cannot create additional entropy. For Mk2/Mk3 on v4 firmware (no secure-element reseed), wallet generation is fully deterministic given known UID and timer state. For Mk4/Q/Mk5, boot adds secure-element entropy from SE1 and SE2, but only 4 bytes (32 bits) are retained by the reseed function — yielding at most 2^32 distinct output streams.

Chainalysis analyzed the attacker's methodology: the attacker used a paid account at a blockchain-services provider to systematically query and identify Coldcard-generated wallet addresses, prioritized high-value wallets first (stealing ~$30M in the first 10 minutes), and executed sweeps using an automated tool characterized by a uniform 30 sat/vB fee rate (30-75x overpayment vs. the 0.4-1.0 sat/vB median) and zero change outputs. Galaxy Research tracked three distinct attack waves: Wave 1 ($70.2M from 1,196 addresses in 41 minutes, P2WPKH outputs, shared collector addresses), Wave 2 (76.16 BTC from 1,478 mid-sized addresses), and Wave 3 (~208 BTC from 1,912 addresses using P2WSH outputs with unique destination addresses and ~6-victim batching). Attribution between waves is uncertain — each wave appears internally consistent but the operational differences may indicate separate actors.

Coinkite released patched firmware per model (Mk2/Mk3 v4.2.0, Mk4/Mk5 v5.6.0, Q v1.5.0Q, Edge v6.6.0X/QX) on July 30-31, 2026, and destroyed remaining vulnerable inventory. CISA added the vulnerability to its Known Exploited Vulnerabilities Catalog on August 3, 2026. A BIP-39 passphrase reduces immediate risk but does not repair the underlying seed; users must generate a new seed on patched firmware. Seeds created with 50+ independent, private dice rolls are not considered at risk from this flaw alone. Block's products (Square, Cash App) use separate RNG implementations and were unaffected.

## MITRE ATT&CK

- T1592 Gather Victim Host Information
- T1594 Search Victim-Owned Websites
- T1596 Search Open Technical Databases
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1608 Stage Capabilities
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1027 Obfuscated Files or Information
- T1564 Hide Artifacts
- T1685 Disable or Modify Tools
- T1573 Encrypted Channel
- T1048 Exfiltration Over Alternative Protocol
- T1657 Financial Theft

## Sources

- [Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware)
- [Coldcard Mk3 Seed Generation Warning (Coinkite Advisory)](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/)
- [Bitcoin hardware wallet maker destroys some inventory after more than $88 million stolen](https://therecord.media/bitcoin-theft-coldcard-cyberattack)
- [Coldcard wallet RNG flaw likely linked to $88 million Bitcoin theft](https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/)
- [CISA Known Exploited Vulnerabilities Catalog — Coldcard Entry](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Galaxy Research: Three Attack Waves Tracking](https://coinmarketcap.com/academy/article/coldcard-firmware-flaw-drains-dollar89m-from-4500-bitcoin-wallets-in-3-waves)
- [Coldcard Firmware Repository — ChangeLog / Security Fixes](https://github.com/Coldcard/firmware/blob/master/releases/ChangeLog.md)
- [The Coldcard RNG Incident: Source Code, Entropy, and Real-World Exploitability](https://medium.com/@davidmolnar/coldcard-rng-incident-analysis)
- [Coldcard Postmortem Analysis (Kelbie)](https://github.com/Kelbie/coldcard-rng-postmortem)
- [Yasmarang PRNG — Original Specification and Limitations](http://www.literatecode.com/yasmarang)
- [Crypto StackExchange — Yasmarang PRNG Internal State Recovery](https://crypto.stackexchange.com/questions/113273/yasmarang-prng-recover-internal-state)
- [Chainalysis: Coldcard Attacker Behavioral Analysis](https://www.chainalysis.com/blog/coldcard-wallet-theft-2026/)
- [Clay Garrett (Block): Blockchain Provider Account Statement on X](https://x.com/claygra/status/coldcard-investigation-2026)
- [CoinDesk: Bitcoin Cold Wallet Attack Spreads to 4,500 Addresses](https://www.coindesk.com/tech/2026/08/02/bitcoin-cold-wallet-attack-spreads-to-4-500-addresses-as-losses-near-usd89-million)
- [Crypto.news: Coldcard Bitcoin Losses Rise to $88.6M in Third Wave](https://crypto.news/coldcard-bitcoin-losses-rise-to-88-6m-in-third-wave/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1848