Coldcard Hardware Wallet $111M Bitcoin Theft: Weak RNG Private Key Vulnerability (Yasmarang PRNG Fallback) — Threadlinqs Intelligence
As of 2026-08-12, Coldcard Hardware Wallet $111M Bitcoin Theft: Weak RNG Private Key Vulnerability (Yasmarang PRNG Fallback) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 18 indicators of compromise.
Threat ID: TL-2026-1992 · Severity: CRITICAL · Status: ACTIVE · Category: VULNERABILITY
A five-year-dormant build-configuration bug in COLDCARD hardware wallet firmware silently routed private-key seed generation through Yasmarang, a non-cryptographic 1990s-era software PRNG, instead of
COLDCARD (Coinkite) hardware wallets Mk2 through Q were found to generate wallet seeds using a predictable software pseudo-random number generator instead of the device's dedicated hardware true-random-number generator (TRNG). The root cause is a build/link integration error introduced on 2021-03-01 (commit b18723dd) during a libNgU migration and first shipped in firmware v4.0.0 on 2021-03-17: COLDCARD's board configuration sets the macro MICROPY_HW_ENABLE_RNG to 0 because Coinkite supplies its own hardware-RNG wrapper (ckcc.rng_bytes), but libNgU's guard condition tests only whether the macro is DEFINED (#ifndef) rather than whether its VALUE is non-zero. Because the macro is defined-but-zero, libNgU believes the hardware path is active and binds to MicroPython's default rng_get() symbol, while MicroPython itself sees the zero value and compiles its Yasmarang software fallback instead of the STM32 hardware peripheral. Every call to COLDCARD's random number generator therefore silently routed through Yasmarang, a deterministic, non-cryptographic PRNG originally posted to 1990s programming forums.
Yasmarang's 128-bit internal state (variables pad, n, d, dat) is seeded from device-observable, low-entropy sources: the low 32 bits of the STM32 unique chip ID (UID) XORed with the SysTick countdown timer, the RTC time-of-day register, and the RTC sub-second register. On Mk2/Mk3 devices this reduces to a completely deterministic derivation with effective search space of roughly 2^40 (wafer-coordinate UID range of 0-72, SysTick range of roughly 80,000-120,000 counts, and RTC registers that resolved to zero in observed cases). Mk4/Mk5/Q devices mix in secure-element (SE1/SE2) entropy during a reseed() call, but the reseed implementation extracts only 4 bytes from a 32-byte SHA-256 digest to replace a single 32-bit Yasmarang state word, leaving the rest of the state unchanged and effective entropy at roughly 72 bits — still far short of the 128 bits a 12-word BIP-39 seed is designed to provide.
Attackers (multiple apparent operators/waves per Galaxy Research clustering, ~600 suspected attacker-controlled addresses) reconstructed the vulnerable derivation chain and ran GPU-accelerated brute-force campaigns: for each of ~424 million candidate 'pad' values (wafer-coordinate x SysTick cross product), they enumerated plausible button-press counts, then executed the full pipeline — SHA-256, BIP-39 wordlist conversion, 2,048-round PBKDF2-HMAC-SHA512, BIP-32 derivation at m/44'/0'/0'/0/0, and HASH160 address generation — comparing outputs against the known Bitcoin P2WPKH address set via Bloom-filter matching. A single Apple M1 GPU could exhaust Phase A's search space in roughly 8.6 days; data-center NVIDIA A100 clusters reduced this to hours. On 2026-07-30, an initial wave drained 1,196 addresses of 1,082.65 BTC (~$70.2M) within 41 minutes; subsequent waves through early August pushed confirmed losses to at least 1,719 BTC (~$111M) across 5,200+ addresses and 25+ distinct attack patterns, with Galaxy Research and TRM Labs estimating the total could exceed 1,816-2,300 BTC (~$116-130M) as unconfirmed cases are validated. 88% of drained funds came from addresses inactive for a year or more (median dormancy 3.5 years), consistent with old, never-migrated seeds. Stolen funds were consolidated into a small number of aggregation addresses and partially laundered through Tornado Cash, THORChain cross-chain bridging, and Wasabi Wallet CoinJoin mixing.
Coinkite issued a preliminary warning on 2026-07-30 and shipped patched firmware within 24 hours (2026-07-31): 4.2.0+ for Mk2/Mk3, 5.6.0+ for Mk4/Mk5 standard, 6.6.0X+ for Mk4/Mk5 Edge, 1.5.0Q+ for Q standard, 6.6.0QX+ for Q Edge. TAPSIGNER, OPENDIME, and SATSCARD products are unaffected. No CVE identifier has been assigned as of this writing. Independent firmware analysis and disclosure came from Block (Square) Engineering, which additionally documented the truncated-reseed weakness on Mk4/Mk5/Q. Coink
Weaknesses (CWE)
CWE-338, CWE-330
Target sectors: cryptocurrency, finance, consumer
Target regions: Global
Timeline
- Commit b18723dd introduces the RNG-fallback regression during a libNgU migration; the build guard checks macro existence (#ifndef) instead of value, causing MICROPY_HW_ENABLE_RNG=0 to silently select the Yasmarang software PRNG fallback instead of the STM32 hardware TRNG.
- COLDCARD firmware v4.0.0 ships publicly with the RNG regression, beginning five years of affected seed generation on Mk2/Mk3 devices.
- Initial exploitation wave drains 1,196 single-signature addresses of 1,082.65 BTC (~$70.2M) within a 41-minute window via GPU-accelerated offline brute-forcing of the predictable Yasmarang state space.
- Coinkite publishes a preliminary security advisory (COLDCARD Mk3 Seed Generation Warning) confirming the entropy issue and urging at-risk users to prepare to migrate funds.
- Coinkite releases patched firmware across all affected product lines (4.2.0 Mk2/Mk3, 5.6.0 Mk4/Mk5 standard, 6.6.0X Mk4/Mk5 Edge, 1.5.0Q Q standard, 6.6.0QX Q Edge) roughly 24 hours after the first wave, and suspends shipment of unpatched inventory.
- Block (Square) Engineering publishes an independent technical analysis identifying the truncated 4-byte reseed() weakness affecting Mk4/Mk5/Q devices, and Coinkite publishes an updated technical backgrounder on the entropy issue.
- Additional draining waves are identified; Galaxy Research raises the cumulative suspected total to 1,367.05 BTC (~$88.6M) across 4,585 addresses and begins tracking roughly 600 suspected attacker-controlled addresses.
- TRM Labs estimates confirmed losses at 1,816 BTC (~$116M) as fund-flow tracing continues; Fortune reports on the escalating impact.
- TechCrunch reports Galaxy Research's projection that total losses could exceed $130M (up to ~2,300 BTC) if remaining unconfirmed cases are validated.
- Investigators confirm losses of 1,719 BTC (~$111M) across more than 5,200 addresses, with 25+ distinct attack patterns identified across three waves, indicating multiple likely operators; 88% of drained funds came from addresses dormant a year or more (median 3.5 years).
Detections & IOCs
As of 2026-09-04, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 18 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1596.005, T1592.003, T1588.006, T1588.002, T1587.004, T1600.001, T1552.004, T1110.002, T1119, T1657
