# Coldcard Hardware Wallet Firmware RNG Vulnerability (Yasmarang Fallback) Leads to ~$116M Bitcoin Theft

> A build configuration error in Coinkite's Coldcard hardware wallet firmware v4.0.1 (March 2021) caused seed generation on Mk2/Mk3 devices to fall back to MicroPython's deterministic Yasmarang software PRNG instead of the STM32 hardware TRNG, reducing effective key strength from 128 bits to as low as ~40 bits. Four coordinated attack waves between July 30 and August 3, 2026 swept approximately 1,816 BTC (~$116M) from over 5,200 addresses. Newer Mk4/Q/Mk5 devices were also vulnerable but with ~72-bit effective entropy. No CVE has been assigned.

- **Published:** 2026-08-05T00:00:00Z
- **Last reviewed:** 2026-08-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1904
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-coldcard-weak-rng-bitcoin-theft-tl-2026-1904.webp?v=8a5fac5e (Threadlinqs threat intel: Coldcard v4.0.1 Weak RNG Wallet Theft: Detection & IOCs (TL-2026-1904) — Critical severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-1904
- **Severity:** CRITICAL
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20 (3 shown free below)

## Description

A critical firmware RNG vulnerability in Coinkite's Coldcard hardware wallet product line, introduced in firmware version 4.0.1 (released March 2021), caused BIP39 seed generation on affected devices to use MicroPython's deterministic Yasmarang software pseudo-random number generator (PRNG) instead of the STM32 hardware true random number generator (TRNG). The root cause was a preprocessor macro misuse during the libNgU/libsecp256k1 firmware migration: the board configuration set MICROPY_HW_ENABLE_RNG to 0 (because Coldcard provided its own hardware RNG wrapper via ckcc.rng_bytes()), but libNgU's random.c used #ifndef MICROPY_HW_ENABLE_RNG (checking if the macro exists) instead of #if !MICROPY_HW_ENABLE_RNG (checking its value). Since 0 is technically defined, the #ifndef guard never fired, and MicroPython's Yasmarang fallback silently replaced the hardware TRNG at link time. The Yasmarang PRNG was seeded from only three sources: the low 32 bits of the MCU UID (a fixed per-device identifier), the SysTick counter register (observable timing state with ~80K-120K possible values), and RTC time registers (correlated with boot time). XOR of the MicroPython fallback output with libNgU's own separate Yasmarang instance (seeded with public, hardcoded constants) provided no entropy benefit, as XOR of two deterministic streams remains deterministic. For Mk2/Mk3 devices running firmware v4.0.0 through v4.1.9, wallet generation became effectively deterministic if the UID, timer state, and call history were known — reducing key strength from the intended 128 bits to approximately 40 bits, trivially brute-forceable with modern computing hardware including consumer GPUs. For Mk4/Q/Mk5 devices, a limited 32-bit secure-element reseed during boot provided approximately 72 bits of effective entropy — still far below the 128-bit security target and within enumerable range (~2^32 candidate outputs)

At least 15 separate attackers exploited this vulnerability in four coordinated attack waves between July 30 and August 3, 2026. The first wave on July 30 swept approximately 594 BTC (~$38M at the time) from 501 single-signature wallets within a 25-minute window (01:10-01:56 UTC), consolidating funds into address bc1qnk4zh9qcnap2mycp56qjrgza3cc8ylrh8fecp0. Sweep transactions used a hardcoded 30 sat/vB fee rate with no change output, indicating automated tooling. Galaxy Research tracked subsequent waves: the second and third waves expanded the theft to approximately 1,596 BTC from ~7,300 addresses. A fourth wave on August 3 moved approximately 449 BTC at a sweep rate of 13.8 transfers per block — 45 times the normal baseline of 0.3 transfers per block — and used Replace-By-Fee (RBF), giving victims a narrow window to outbid the attacker. Total confirmed losses reached approximately 1,816 BTC (~$116M) from over 5,200 addresses, making this the third-largest crypto hack of 2026. Transaction construction differed across waves, confirming multiple independent attacker clusters racing in parallel across the vulnerable key space. Galaxy Research shared attacker and victim addresses with US federal law enforcement.

Post-theft laundering activity remained minimal as of August 5, 2026: 64.9 BTC was deposited to Wasabi Wallet, and approximately 200 ETH (~$374K) was sent to the sanctioned Tornado Cash contract on August 5 via THORChain cross-chain bridging. Most stolen funds (~90%) remained stationary in consolidation addresses at the time of reporting. The laundering pattern was described as exploratory rather than the fast, aggressive layering typical of state-sponsored groups like North Korea's TraderTraitor. OP_RETURN fields on attacker-controlled addresses received numerous spam messages, including a laundering offer for a 10% fee, victims begging for fund return, and cryptocurrency scams.

Coinkite responded by releasing emergency firmware patches on August 1, 2026: Mk2/Mk3 v4.2.0, Mk4/Mk5 Standard v5.6.0, Q Standard v1.5.0Q, and Edge v6.6.0X/6.6.0QX. The company destroyed all remaining vulnerable inventory. Critically, firmware updates do not retroactively repair seeds generated under affected firmware — users must generate entirely new seeds and migrate funds. Coinkite advised that seeds generated with 50+ independent, private dice rolls or protected by a strong unique BIP-39 passphrase have reduced immediate exposure but are not a permanent fix. The company directly contacted affected customers and assisted with fund migration. Coinkite has suggested that the vulnerability may have been discovered through automated AI-driven code review of older firmware versions. Block's (formerly Square) Bitcoin Engineering and Security teams independently root-caused the vulnerability alongside external researchers and published a detailed advisory. Eight years of security audits had reviewed the code without catching the preprocessor logic error — as one analysis noted: everyone looked at the right code, but nobody checked whether it actually ran.

## MITRE ATT&CK

- T1588.006 Vulnerabilities
- T1588.002 Tool
- T1583 Acquire Infrastructure
- T1589.001 Credentials
- T1596 Search Open Technical Databases
- T1595.002 Vulnerability Scanning
- T1195 Supply Chain Compromise
- T1059.006 Python
- T1059.004 Unix Shell
- T1106 Native API
- T1070.006 Timestomp
- T1110.003 Password Spraying
- T1552.004 Private Keys
- T1560 Archive Collected Data
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Coldcard Vulnerable Firmware Exploitation — GPU Private Key Recovery Scanning** (`TL-2026-1904-SPL-001`)

Detects execution of GPU-accelerated BIP32 private key recovery tooling targeting Coldcard hardware wallets affected by the Yasmarang PRNG fallback vulnerability (CWE-338, ~40-bit effective entropy). The attack tooling uses CUDA kernels performing PBKDF2-HMAC-SHA512 key stretching followed by secp256k1 elliptic curve operations to enumerate the ~2^32 candidate seed space. This detection covers sysmon process-creation events for known exploit tools (ColdCard-38M-PoC GPU scanner, custom BIP32 brute-forcers) and Python scripts importing bitcoin-related crypto libraries (ecdsa, secp256k1, bip32utils) with high iteration PBKDF2 or parallel GPU operations indicative of key-recovery attacks. Covers the exploitation phase where attackers derive private keys from seeds generated under the deterministic Yasmarang PRNG.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195, T1588.006, T1110.003, T1059.006, T1552.004
- **Data sources:** sysmon_process_creation, windows_security_eventlog_4688, endpoint_detection_response
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(
  (CommandLine IN ("*ColdCard-38M*", "*coldcard*bruteforce*", "*coldcard*rng*scan*") )
  OR
  (Image="*python*" CommandLine="*bip32*") 
  OR
  (Image="*python*" CommandLine="*secp256k1*" CommandLine="*pbkdf2*")
  OR
  (Image="*python*" (CommandLine="*cuda*" OR CommandLine="*gpu*" OR CommandLine="*numba*") CommandLine="*wallet*")
  OR
  (Image="*python*" CommandLine="*ecdsa*" CommandLine="*private*key*")
  OR
  (Image="*python*" CommandLine="*bip39*" CommandLine="*bruteforce*")
  OR
  (Image="*python*" CommandLine="*seed*recover*" CommandLine="*mnemonic*")
  OR
  (Image="*python*" ParentImage="*pip*" CommandLine="*bip32utils*")
  OR
  (Image IN ("*cudabip32*", "*keyscanner*") CommandLine="*--derive*")
)
| eval threat_id="TL-2026-1904", threat_name="Coldcard RNG Vulnerability GPU Key Recovery"
| table _time, host, user, Image, CommandLine, ParentImage, threat_id, threat_name
| sort - _time
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(7d)
| where
    (ProcessCommandLine has_any ("ColdCard-38M", "coldcard_bruteforce", "coldcard_rng_scan"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("bip32", "secp256k1"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("pbkdf2", "wallet", "derive"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("cuda", "wallet", "recover"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("ecdsa", "private"))
    or (InitiatingProcessFileName has "python" and ProcessCommandLine has_all ("bip39", "bruteforce", "seed"))
    or (FileName has_any ("cudabip32", "keyscanner") and ProcessCommandLine has "--derive")
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName
| order by Timestamp desc
```

### Sigma

```yaml
title: Coldcard RNG Vulnerability GPU Key Recovery Tool Execution
id: a7e83d0c-9b12-4a15-b89c-2f1e8e3c4a01
status: experimental
description: Detects execution of GPU-accelerated BIP32 private key recovery tools targeting Coldcard hardware wallets affected by the Yasmarang PRNG fallback (CWE-338). Detects Python scripts performing secp256k1/PBKDF2 operations with GPU/crypto wallet libraries indicative of offline key-recovery attacks.
references:
    - https://github.com/DK27ss/ColdCard-38M-PoC
    - https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware
    - https://attack.mitre.org/techniques/T1110/003/
author: Threadlinqs Team
date: 2026-08-06
tags:
    - attack.credential_access
    - attack.t1110.003
    - attack.t1195
    - attack.t1552.004
    - attack.t1059.006
    - cve.2026.99999
    - attack.tool.coldcard_poctool
logsource:
    category: process_creation
    product: windows
detection:
    selection_coldcard_tools:
        CommandLine|contains:
            - 'ColdCard-38M'
            - 'coldcard_bruteforce'
            - 'coldcard_rng_scan'
            - 'cudabip32'
            - 'keyscanner --derive'
            - 'bip32_seed_recover'
    selection_python_crypto:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'pbkdf2'
            - 'secp256k1'
            - 'bip'
    selection_python_gpu:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'cuda'
            - 'wallet'
            - 'derive'
        CommandLine|contains:
            - 'recover'
            - 'bruteforce'
            - 'scan'
    selection_bip39_bruteforce:
        Image|endswith: '\python.exe'
        CommandLine|contains|all:
            - 'bip39'
            - 'mnemonic'
        CommandLine|contains:
            - 'bruteforce'
            - 'recover'
    condition: 1 of selection_*
falsepositives:
    - Legitimate cryptocurrency wallet development and testing
    - Authorized security research on hardware wallet vulnerabilities
    - Penetration testing engagements with explicit scope covering hardware wallets
level: high
```

**Known false positives:**

- Legitimate cryptocurrency wallet development and testing with BIP32/BIP39 libraries
- Authorized security research and penetration testing on hardware wallet firmware
- GPU-based cryptocurrency mining software incorrectly matching on 'cuda' and 'wallet' keywords

**Tuning notes:** Baseline legitimate cryptocurrency wallet development teams in the organization. Exclude known security research endpoints with documented authorization. Consider adding image hash allowlists for approved Python crypto development environments. For GPU compute clusters used in legitimate ML/AI workloads, filter by known hash of approved Python environments and monitor for anomalous child processes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Coldcard Exploit Tool Download and Installation — GitHub PoC Repository Access (locked: unlock with TL Creds)
- Wasabi Wallet CoinJoin Mixing — Coldcard Stolen Fund Laundering Detection (locked: unlock with TL Creds)
- Sanctioned Cryptocurrency Mixer Detection — Tornado Cash Deposit Pattern (locked: unlock with TL Creds)
- Coldcard Yasmarang PRNG Vulnerability — Vulnerability Scanning and Reconnaissance (locked: unlock with TL Creds)
- Blockchain Consolidation Address Fund Movement — Continuous Monitoring (locked: unlock with TL Creds)
- Multi-Hop Cryptocurrency Laundering Chain — THORChain to Tornado Cash Correlation (locked: unlock with TL Creds)
- Bitcoin Sweep Transaction Pattern — Coordinated Wallet Address Drain Detection (locked: unlock with TL Creds)
- Cross-Chain Laundering — THORChain Bridge to Ethereum Detection (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 20)

Defanged, TLP:CLEAR.

- IP address: `185.220.101[.]42`
- URL: `hxxps://coldcardwatch[.]com`
- URL: `hxxps://github[.]com/DK27ss/ColdCard-38M-PoC`

Full set of 20 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [The Largest Hardware Wallet Exploit of 2026: Inside the USD 116 Million Coldcard Hack](https://www.trmlabs.com/resources/blog/the-largest-hardware-wallet-exploit-of-2026-inside-the-usd-116-million-coldcard-hack)
- [Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware)
- [Coldcard RNG Bug Postmortem and PoC](https://github.com/DK27ss/ColdCard-38M-PoC)
- [Bitcoin Cold-Wallet Losses May Near $114 Million as Possible Fourth Sweep Emerges](https://www.coindesk.com/tech/2026/08/03/coldcard-wallet-losses-may-near-usd114-million-as-possible-fourth-sweep-emerges)
- [Coldcard Bitcoin Theft Tops $100M Across 3 Waves](https://cointelegraph.com/news/coldcard-bitcoin-theft-100-million-three-waves)
- [The Coldcard Hack Just Hit $116 Million. A Fourth Wave Is Still Draining](https://news.bitcoin.com/security/coldcard-hack-116-million-fourth-wave/)
- [Hackers Steal Over $130 Million by Exploiting Bug in Offline Hardware Wallets](https://techcrunch.com/2026/08/04/hackers-steal-over-130-million-by-exploiting-bug-in-offline-hardware-wallets/)
- [Coldcard Bitcoin Exploit Explained: Entropy, Keys, Bits](https://decrypt.co/374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits)
- [Coinkite Coldcard RNG Advisory and Firmware Updates](https://blog.coinkite.com/coldcard-rng-advisory/)
- [Coldcard Hacker Swaps BTC to ETH via THORChain and Tornado Cash](https://www.cryptotimes.io/2026/08/05/coldcard-hacker-swaps-bitcoin-to-eth-via-thorchain-and-tornado-cash/)
- [Coldcard Hacker Gets Brazen Bitcoin Laundering Offer Onchain](https://news.bitcoin.com/crypto-news/coldcard-hacker-gets-brazen-bitcoin-laundering-offer-onchain/)
- [Coldcard RNG Vulnerability Postmortem and Forensics](https://github.com/Kelbie/coldcard-rng-postmortem)
- [TRM Labs 2026 Crypto Hack Report](https://www.trmlabs.com/resources/blog/crypto-hack-report-2026)
- [Coldcard Watch — Live Stolen BTC Tracker](https://coldcardwatch.com/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1904