Coldcard Hardware Wallet Firmware RNG Vulnerability (Yasmarang Fallback) Leads to ~$116M Bitcoin Theft

Key facts

Detection coverage

As of 2026-08-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1904 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Coldcard Vulnerable Firmware Exploitation — GPU Private Key Recovery Scanning

Detects execution of GPU-accelerated BIP32 private key recovery tooling targeting Coldcard hardware wallets affected by the Yasmarang PRNG fallback vulnerability (CWE-338, ~40-bit effective entropy). The attack tooling uses CUDA kernels performing PBKDF2-HMAC-SHA512 key stretching followed by secp256k1 elliptic curve operations to enumerate the ~2^32 candidate seed space. This detection covers sysmon process-creation events for known exploit tools (ColdCard-38M-PoC GPU scanner, custom BIP32 brute-forcers) and Python scripts importing bitcoin-related crypto libraries (ecdsa, secp256k1, bip32utils) with high iteration PBKDF2 or parallel GPU operations indicative of key-recovery attacks. Covers the exploitation phase where attackers derive private keys from seeds generated under the deterministic Yasmarang PRNG.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195, T1588.006, T1110.003, T1059.006, T1552.004
• Data sources: sysmon_process_creation, windows_security_eventlog_4688, endpoint_detection_response
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (CommandLine IN ("*ColdCard-38M*", "*coldcard*bruteforce*", "*coldcard*rng*scan*") )
  OR
  (Image="*python*" CommandLine="*bip32*") 
  OR
  (Image="*python*" CommandLine="*secp256k1*" CommandLine="*pbkdf2*")
  OR
  (Image="*python*" (CommandLine="*cuda*" OR CommandLine="*gpu*" OR CommandLine="*numba*") CommandLine="*wallet*")
  OR
  (Image="*python*" CommandLine="*ecdsa*" CommandLine="*private*key*")
  OR
  (Image="*python*" CommandLine="*bip39*" CommandLine="*bruteforce*")
  OR
  (Image="*python*" CommandLine="*seed*recover*" CommandLine="*mnemonic*")
  OR
  (Image="*python*" ParentImage="*pip*" CommandLine="*bip32utils*")
  OR
  (Image IN ("*cudabip32*", "*keyscanner*") CommandLine="*--derive*")
)
| eval threat_id="TL-2026-1904", threat_name="Coldcard RNG Vulnerability GPU Key Recovery"
| table _time, host, user, Image, CommandLine, ParentImage, threat_id, threat_name
| sort - _time

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(7d)
| where
    (ProcessCommandLine has_any ("ColdCard-38M", "coldcard_bruteforce", "coldcard_rng_scan"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("bip32", "secp256k1"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("pbkdf2", "wallet", "derive"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("cuda", "wallet", "recover"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("ecdsa", "private"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("bip39", "bruteforce", "seed"))
    or (FileName has_any ("cudabip32", "keyscanner") and ProcessCommandLine has "--derive")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc

Sigma

title: Coldcard RNG Vulnerability GPU Key Recovery Tool Execution
id: a7e83d0c-9b12-4a15-b89c-2f1e8e3c4a01
status: experimental
description: Detects execution of GPU-accelerated BIP32 private key recovery tools targeting Coldcard hardware wallets affected by the Yasmarang PRNG fallback (CWE-338). Detects Python scripts performing secp256k1/PBKDF2 operations with GPU/crypto wallet libraries indicative of offline key-recovery attacks.
references:
    - https://github.com/DK27ss/ColdCard-38M-PoC
    - https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware
    - https://attack.mitre.org/techniques/T1110/003/
author: Threadlinqs Team
date: 2026-08-06
tags:
    - attack.credential_access
    - attack.t1110.003
    - attack.t1195
    - attack.t1552.004
    - attack.t1059.006
    - cve.2026.99999
    - attack.tool.coldcard_poctool
logsource:
    category: process_creation
    product: windows
detection:
    selection_coldcard_tools:
        CommandLine|contains:
            - 'ColdCard-38M'
            - 'coldcard_bruteforce'
            - 'coldcard_rng_scan'
            - 'cudabip32'
            - 'keyscanner --derive'
            - 'bip32_seed_recover'
    selection_python_crypto:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'pbkdf2'
            - 'secp256k1'
            - 'bip'
    selection_python_gpu:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'cuda'
            - 'wallet'
            - 'derive'
        CommandLine|contains:
            - 'recover'
            - 'bruteforce'
            - 'scan'
    selection_bip39_bruteforce:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'bip39'
            - 'mnemonic'
        CommandLine|contains:
            - 'bruteforce'
            - 'recover'
    condition: 1 of selection_*
falsepositives:
    - Legitimate cryptocurrency wallet development and testing
    - Authorized security research on hardware wallet vulnerabilities
    - Penetration testing engagements with explicit scope covering hardware wallets
level: high

Known false positives:

• Legitimate cryptocurrency wallet development and testing with BIP32/BIP39 libraries
• Authorized security research and penetration testing on hardware wallet firmware
• GPU-based cryptocurrency mining software incorrectly matching on 'cuda' and 'wallet' keywords

Tuning notes: Baseline legitimate cryptocurrency wallet development teams in the organization. Exclude known security research endpoints with documented authorization. Consider adding image hash allowlists for approved Python crypto development environments. For GPU compute clusters used in legitimate ML/AI workloads, filter by known hash of approved Python environments and monitor for anomalous child processes.

• 🔒 Coldcard Exploit Tool Download and Installation — GitHub PoC Repository Access · unlock with TL Creds
• 🔒 Wasabi Wallet CoinJoin Mixing — Coldcard Stolen Fund Laundering Detection · unlock with TL Creds
• 🔒 Sanctioned Cryptocurrency Mixer Detection — Tornado Cash Deposit Pattern · unlock with TL Creds
• 🔒 Coldcard Yasmarang PRNG Vulnerability — Vulnerability Scanning and Reconnaissance · unlock with TL Creds
• 🔒 Blockchain Consolidation Address Fund Movement — Continuous Monitoring · unlock with TL Creds
• 🔒 Multi-Hop Cryptocurrency Laundering Chain — THORChain to Tornado Cash Correlation · unlock with TL Creds
• 🔒 Bitcoin Sweep Transaction Pattern — Coordinated Wallet Address Drain Detection · unlock with TL Creds
• 🔒 Cross-Chain Laundering — THORChain Bridge to Ethereum Detection · unlock with TL Creds

Indicators of compromise

As of 2026-08-05, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-1904.

Sample indicators (3 of 20)

• IP address: 185.220.101[.]42
• URL: hxxps://coldcardwatch[.]com
• URL: hxxps://github[.]com/DK27ss/ColdCard-38M-PoC

Defanged, TLP:CLEAR. Full set of 20 indicators: unlock with TL Creds.

Technical analysis

Four coordinated attack waves between July 30 and August 3, 2026 swept approximately 1,816 BTC (~$116M) from over 5,200 addresses. Newer Mk4/Q/Mk5 devices were also vulnerable but with ~72-bit effective entropy. No CVE has been assigned.

A critical firmware RNG vulnerability in Coinkite's Coldcard hardware wallet product line, introduced in firmware version 4.0.1 (released March 2021), caused BIP39 seed generation on affected devices to use MicroPython's deterministic Yasmarang software pseudo-random number generator (PRNG) instead of the STM32 hardware true random number generator (TRNG). The root cause was a preprocessor macro misuse during the libNgU/libsecp256k1 firmware migration: the board configuration set MICROPY_HW_ENABLE_RNG to 0 (because Coldcard provided its own hardware RNG wrapper via ckcc.rng_bytes()), but libNgU's random.c used #ifndef MICROPY_HW_ENABLE_RNG (checking if the macro exists) instead of #if !MICROPY_HW_ENABLE_RNG (checking its value). Since 0 is technically defined, the #ifndef guard never fired, and MicroPython's Yasmarang fallback silently replaced the hardware TRNG at link time. The Yasmarang PRNG was seeded from only three sources: the low 32 bits of the MCU UID (a fixed per-device identifier), the SysTick counter register (observable timing state with ~80K-120K possible values), and RTC time registers (correlated with boot time). XOR of the MicroPython fallback output with libNgU's own separate Yasmarang instance (seeded with public, hardcoded constants) provided no entropy benefit, as XOR of two deterministic streams remains deterministic. For Mk2/Mk3 devices running firmware v4.0.0 through v4.1.9, wallet generation became effectively deterministic if the UID, timer state, and call history were known — reducing key strength from the intended 128 bits to approximately 40 bits, trivially brute-forceable with modern computing hardware including consumer GPUs. For Mk4/Q/Mk5 devices, a limited 32-bit secure-element reseed during boot provided approximately 72 bits of effective entropy — still far below the 128-bit security target and within enumerable range (~2^32 candidate outputs)

At least 15 separate attackers exploited this vulnerability in four coordinated attack waves between July 30 and August 3, 2026. The first wave on July 30 swept approximately 594 BTC (~$38M at the time) from 501 single-signature wallets within a 25-minute window (01:10-01:56 UTC), consolidating funds into address bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0. Sweep transactions used a hardcoded 30 sat/vB fee rate with no change output, indicating automated tooling. Galaxy Research tracked subsequent waves: the second and third waves expanded the theft to approximately 1,596 BTC from ~7,300 addresses. A fourth wave on August 3 moved approximately 449 BTC at a sweep rate of 13.8 transfers per block — 45 times the normal baseline of 0.3 transfers per block — and used Replace-By-Fee (RBF), giving victims a narrow window to outbid the attacker. Total confirmed losses reached approximately 1,816 BTC (~$116M) from over 5,200 addresses, making this the third-largest crypto hack of 2026. Transaction construction differed across waves, confirming multiple independent attacker clusters racing in parallel across the vulnerable key space. Galaxy Research shared attacker and victim addresses with US federal law enforcement.

Post-theft laundering activity remained minimal as of August 5, 2026: 64.9 BTC was deposited to Wasabi Wallet, and approximately 200 ETH (~$374K) was sent to the sanctioned Tornado Cash contract on August 5 via THORChain cross-chain bridging. Most stolen funds (~90%) remained stationary in consolidation addresses at the time of reporting. The laundering pattern was described as exploratory rather than the fast, aggressive layering typical of state-sponsored groups like North Korea's TraderTraitor. OP_RETURN fields on attacker-controlled addresses received numerous spam messages, including a laundering offer for a 10% fee, victims begging for fund return, and cryptocurrency scams.

Coinkite responded by releasing emergency firmware patches on August 1, 2026: Mk2/Mk3 v4.2.0, Mk4/Mk5 Standard v5.6.0, Q Standard v1.5.0Q, and Edge v6.6.0X/6.6.0QX. The company destroyed all remaining vulnerable inventory. Critically, firmware updates do not retroactively repair seeds generated under affected firmware — users must generate entirely new seeds and migrate funds. Coinkite advised that seeds generated with 50+ independent, private dice rolls or protected by a strong unique BIP-39 passphrase have reduced immediate exposure but are not a permanent fix. The company directly contacted affected customers and assisted with fund migration. Coinkite has suggested that the vulnerability may have been discovered through automated AI-driven code review of older firmware versions. Block's (formerly Square) Bitcoin Engineering and Security teams independently root-caused the vulnerability alongside external researchers and published a detailed advisory. Eight years of security audits had reviewed the code without catching the preprocessor logic error — as one analysis noted: everyone looked at the right code, but nobody checked whether it actually ran.

MITRE ATT&CK techniques by tactic:

Execution

T1059.004 Unix Shell; T1059.006 Python; T1106 Native API

Defense Evasion

T1070.006 Timestomp

Credential Access

T1110.003 Password Spraying; T1552.004 Private Keys

Initial Access

T1195 Supply Chain Compromise

Impact

T1485 Data Destruction; T1657 Financial Theft

Collection

T1560 Archive Collected Data

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1583 Acquire Infrastructure; T1588.002 Tool; T1588.006 Vulnerabilities

Reconnaissance

T1589.001 Credentials; T1595.002 Vulnerability Scanning; T1596 Search Open Technical Databases

Remediation

Patches

• Mk2/Mk3: Upgrade to firmware v4.2.0 or later
• Mk4/Mk5 Standard: Upgrade to firmware v5.6.0 or later
• Q Standard: Upgrade to firmware v1.5.0Q or later
• Mk4/Mk5 Edge: Upgrade to firmware v6.6.0X or later
• Q Edge: Upgrade to firmware v6.6.0QX or later

Immediate actions

• Treat any Coldcard seed created between March 2021 and August 2026 as compromised regardless of current firmware version
• Generate a new seed on updated firmware (Mk2/Mk3: v4.2.0+, Mk4/Mk5 Standard: v5.6.0+, Q Standard: v1.5.0Q+, Edge: v6.6.0X/6.6.0QX+)
• Verify the new wallet fingerprint and a receive address before migrating funds
• Migrate funds beginning with a small test transaction before transferring the remainder
• Monitor consolidation addresses on blockchain explorers for ongoing movement (bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0 and related addresses)

Workarounds

• Seeds created with 50+ independent, private dice rolls may have sufficient additional entropy (but still migrate as precaution)
• A strong, unique BIP-39 passphrase reduces immediate exposure but does not fully repair a compromised seed
• Replace-By-Fee (RBF) can be attempted if a sweep transaction is still in the mempool

Longer-term hardening

• Adopt defense-in-depth with multisignature setups combining independently designed devices and independently generated entropy
• Consider hardware wallets with dual-vendor secure elements and verified TRNG integration
• Implement regular firmware entropy self-tests that detect PRNG fallback conditions
• Use strong, unique BIP-39 passphrases as an additional layer
• Follow Coinkite and Block engineering advisories for ongoing firmware security updates

Affected and fixed versions

• Coinkite — Coldcard Mk2
  Vulnerable versions: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4
  Fixed in: 4.2.0+
• Coinkite — Coldcard Mk3
  Vulnerable versions: 4.0.0; 4.0.1; 4.0.2; 4.0.3; 4.0.4; 4.1.0; 4.1.1; 4.1.2; 4.1.3; 4.1.4
  Fixed in: 4.2.0+
• Coinkite — Coldcard Mk4
  Vulnerable versions: Before 5.6.0 Standard; Before 6.6.0X Edge
  Fixed in: 5.6.0+ Standard; 6.6.0X+ Edge
• Coinkite — Coldcard Mk5
  Vulnerable versions: Before 5.6.0 Standard; Before 6.6.0X Edge
  Fixed in: 5.6.0+ Standard; 6.6.0X+ Edge
• Coinkite — Coldcard Q
  Vulnerable versions: Before 1.5.0Q Standard; Before 6.6.0QX Edge
  Fixed in: 1.5.0Q+ Standard; 6.6.0QX+ Edge

Timeline

• 2021-03-01 Commit b18723dd migrated Coldcard firmware to libNgU/libsecp256k1, replacing ckcc.rng_bytes() with ngu.random.bytes(). Build configuration MICROPY_HW_ENABLE_RNG set to 0; libNgU's #ifndef guard (checking existence rather than value) failed to catch the regression. Yasmarang software PRNG replaces hardware TRNG for seed generation.
• 2021-03-17 Coldcard firmware v4.0.0 (and subsequently v4.0.1) released containing the Yasmarang RNG fallback. All wallet seeds generated on affected firmware are compromised.
• 2026-07-30 First attack wave (01:10-01:56 UTC): ~594 BTC (~$38M) drained from 501 single-signature wallets into consolidation address locked-ioc-3. Sweep rate: 30 sat/vB fee rate, no change outputs, fully automated tooling.
• 2026-07-31 Second attack wave: ~208 BTC swept from ~1,918 additional addresses. Combined with Wave 1, total losses exceed $70M. Transaction construction differs from Wave 1, suggesting different attacker clusters.
• 2026-08-01 First OP_RETURN spam messages appear on attacker consolidation addresses, including a laundering offer for 10% fee with Telegram-based KYC/cashout services. Victims begin sending pleas for fund return.
• 2026-08-01 Coinkite publishes candid technical backgrounder acknowledging the flaw. Reports at least 15 separate attackers exploiting the vulnerability. Suggests vulnerability may have been discovered through AI-driven automated code review of older firmware.
• 2026-08-01 Coinkite releases emergency firmware patches: Mk2/Mk3 v4.2.0, Mk4/Mk5 Standard v5.6.0, Q Standard v1.5.0Q, Edge v6.6.0X/6.6.0QX. Company destroys remaining vulnerable inventory. Block Engineering publishes root-cause analysis of the Yasmarang bug.
• 2026-08-02 Galaxy Research confirms ~1,596 BTC (~$100M+) stolen across three waves from ~7,300 addresses. 90% of stolen funds remain stationary in consolidation addresses.
• 2026-08-02 Nostr post alerts Wasabi Wallet coordinators that Coldcard thief funds consolidated into single UTXO, requests blocking via Prison.txt DoS prevention system to prevent CoinJoin mixing.
• 2026-08-03 Suspected fourth wave: ~449 BTC from 462-709 victim addresses across 15 consecutive blocks. Sweep rate of 13.8 transfers/block — 45x normal baseline of 0.3 transfers/block. Attack uses Replace-By-Fee (RBF), giving victims narrow window to counter-sweep.
• 2026-08-04 TRM Labs publishes full forensic analysis of the Coldcard exploit. Total confirmed: ~1,816 BTC (~$116M) from 5,200+ addresses. Third-largest crypto hack of 2026. 2026 total across all crypto incidents: over $1.2B across 276 incidents.
• 2026-08-05 Sweeping may not be complete. Multiple independent attacker clusters still active. Law enforcement (US federal) briefed. Most stolen funds remain in first-hop consolidation addresses. Coldcardwatch.com tracks verified minimum of ~1,403 BTC across 4,725 addresses.
• 2026-08-05 CertiK detects cross-chain laundering: attacker bridges BTC to ETH via THORChain Rapid Swap (~2 BTC to 68 ETH, ~1 BTC to 34 ETH, etc.), routes through intermediary address 0x41B73268, then deposits two 200 ETH batches (~$374K total) into sanctioned Tornado Cash contract.

Sources cited

• Coinkite Coldcard RNG Advisory and Firmware Updates blog.coinkite.com · Advisory · 2026-08-01
• Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware engineering.block.xyz · Research · 2026-08-01
• TRM Labs 2026 Crypto Hack Report trmlabs.com · Research · 2026-08-04
• Coldcard Watch — Live Stolen BTC Tracker coldcardwatch.com · Research · 2026-08-01
• Coldcard RNG Bug Postmortem and PoC GitHub · Code repository · 2026-08-01
• Coldcard RNG Vulnerability Postmortem and Forensics GitHub · Code repository · 2026-08-02
• The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack trmlabs.com · Blog · 2026-08-04
• Bitcoin Cold-Wallet Losses May Near $114 Million as Possible Fourth Sweep Emerges coindesk.com · News · 2026-08-03
• Coldcard Bitcoin Theft Tops $100M Across 3 Waves cointelegraph.com · News · 2026-08-03
• The Coldcard Hack Just Hit $116 Million. A Fourth Wave Is Still Draining news.bitcoin.com · News · 2026-08-04
• Hackers Steal Over $130 Million by Exploiting Bug in Offline Hardware Wallets techcrunch.com · News · 2026-08-04
• Coldcard Bitcoin Exploit Explained: Entropy, Keys, Bits decrypt.co · News · 2026-08-04
• Coldcard Hacker Swaps BTC to ETH via THORChain and Tornado Cash cryptotimes.io · News · 2026-08-05
• Coldcard Hacker Gets Brazen Bitcoin Laundering Offer Onchain news.bitcoin.com · News · 2026-08-02

Related threats

• Coldcard Hardware Wallet RNG Flaw Enables $88.6M Bitcoin Theft from 4,585 Addresses
• 'Ill Bloom' Weak-Randomness Vulnerability in Legacy Crypto Wallets Actively Exploited to Drain $3.1M+

Related coverage of this activity

• Coldcard Mk2-Mk5 RNG flaw

Previous and next in vulnerability

• Samsung Bixby Exploit Chain — System-Level RCE via Samsung Members, Samsung Account, and Capsule Bypass (CVE-2025-21079, CVE-2025-58486, CVE-2025-58487) Previous report
• CVE-2026-12003: CPython on Windows VPATH uncontrolled search path (CWE-427) enables cross-account code execution and privilege escalation Next report