Coldcard Hardware Wallet $111M Bitcoin Theft: Weak RNG Private Key Vulnerability (Yasmarang PRNG Fallback)

Coldcard Hardware Wallet $111M Bitcoin Theft (TL-2026-1992), also tracked as Coldcard Entropy Bug, is a critical-severity software vulnerability, first published 2026-08-12. It has no confirmed attribution, affects Coinkite COLDCARD Mk2/Mk3, maps to 10 MITRE ATT&CK techniques (T1110.002, T1119, T1552.004), and is covered by 9 detection rules and 18 indicators of compromise.

Key facts for TL-2026-1992

Threat ID
TL-2026-1992
Also known as
Coldcard Entropy Bug, Yasmarang RNG Fallback, COLDCARD RNG Fiasco
Severity
CRITICAL
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-12
Last reviewed
2026-08-12
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cryptocurrency, finance, consumer
Target regions
Global
Detection rules
9
Indicators of compromise
18

Malware and tooling in Coldcard Hardware Wallet $111M Bitcoin Theft

Malware and tooling: THORChain, Tornado Cash, Wasabi Wallet, Yasmarang PRNG

A five-year-dormant build-configuration bug in COLDCARD hardware wallet firmware silently routed private-key seed generation through Yasmarang, a non-cryptographic 1990s-era software PRNG, instead of the STM32 hardware TRNG, collapsing effective key entropy to roughly 40 bits (Mk2/Mk3) or roughly 72 bits (Mk4/Mk5/Q) against the 128 bits a BIP-39 seed requires. Attackers modeled the PRNG's predictable state-transition space and used GPU-accelerated offline brute-forcing to recover private keys, draining at least 1,719 BTC (~$111M) from more than 5,200 addresses across multiple waves beginning 2026-07-30.

How Coldcard Hardware Wallet $111M Bitcoin Theft works

COLDCARD (Coinkite) hardware wallets Mk2 through Q were found to generate wallet seeds using a predictable software pseudo-random number generator instead of the device's dedicated hardware true-random-number generator (TRNG). The root cause is a build/link integration error introduced on 2021-03-01 (commit b18723dd) during a libNgU migration and first shipped in firmware v4.0.0 on 2021-03-17: COLDCARD's board configuration sets the macro MICROPY_HW_ENABLE_RNG to 0 because Coinkite supplies its own hardware-RNG wrapper (ckcc.rng_bytes), but libNgU's guard condition tests only whether the macro is DEFINED (#ifndef) rather than whether its VALUE is non-zero. Because the macro is defined-but-zero, libNgU believes the hardware path is active and binds to MicroPython's default rng_get() symbol, while MicroPython itself sees the zero value and compiles its Yasmarang software fallback instead of the STM32 hardware peripheral. Every call to COLDCARD's random number generator therefore silently routed through Yasmarang, a deterministic, non-cryptographic PRNG originally posted to 1990s programming forums.

Yasmarang's 128-bit internal state (variables pad, n, d, dat) is seeded from device-observable, low-entropy sources: the low 32 bits of the STM32 unique chip ID (UID) XORed with the SysTick countdown timer, the RTC time-of-day register, and the RTC sub-second register. On Mk2/Mk3 devices this reduces to a completely deterministic derivation with effective search space of roughly 2^40 (wafer-coordinate UID range of 0-72, SysTick range of roughly 80,000-120,000 counts, and RTC registers that resolved to zero in observed cases). Mk4/Mk5/Q devices mix in secure-element (SE1/SE2) entropy during a reseed() call, but the reseed implementation extracts only 4 bytes from a 32-byte SHA-256 digest to replace a single 32-bit Yasmarang state word, leaving the rest of the state unchanged and effective entropy at roughly 72 bits — still far short of the 128 bits a 12-word BIP-39 seed is designed to provide.

Attackers (multiple apparent operators/waves per Galaxy Research clustering, ~600 suspected attacker-controlled addresses) reconstructed the vulnerable derivation chain and ran GPU-accelerated brute-force campaigns: for each of ~424 million candidate 'pad' values (wafer-coordinate x SysTick cross product), they enumerated plausible button-press counts, then executed the full pipeline — SHA-256, BIP-39 wordlist conversion, 2,048-round PBKDF2-HMAC-SHA512, BIP-32 derivation at m/44'/0'/0'/0/0, and HASH160 address generation — comparing outputs against the known Bitcoin P2WPKH address set via Bloom-filter matching. A single Apple M1 GPU could exhaust Phase A's search space in roughly 8.6 days; data-center NVIDIA A100 clusters reduced this to hours. On 2026-07-30, an initial wave drained 1,196 addresses of 1,082.65 BTC (~$70.2M) within 41 minutes; subsequent waves through early August pushed confirmed losses to at least 1,719 BTC (~$111M) across 5,200+ addresses and 25+ distinct attack patterns, with Galaxy Research and TRM Labs estimating the total could exceed 1,816-2,300 BTC (~$116-130M) as unconfirmed cases are validated. 88% of drained funds came from addresses inactive for a year or more (median dormancy 3.5 years), consistent with old, never-migrated seeds. Stolen funds were consolidated into a small number of aggregation addresses and partially laundered through Tornado Cash, THORChain cross-chain bridging, and Wasabi Wallet CoinJoin mixing.

Coinkite issued a preliminary warning on 2026-07-30 and shipped patched firmware within 24 hours (2026-07-31): 4.2.0+ for Mk2/Mk3, 5.6.0+ for Mk4/Mk5 standard, 6.6.0X+ for Mk4/Mk5 Edge, 1.5.0Q+ for Q standard, 6.6.0QX+ for Q Edge. TAPSIGNER, OPENDIME, and SATSCARD products are unaffected. No CVE identifier has been assigned as of this writing. Independent firmware analysis and disclosure came from Block (Square) Engineering, which additionally documented the truncated-reseed weakness on Mk4/Mk5/Q. Coinkite co-founder NVK publicly noted that AI-assisted code review may have accelerated discovery of the flaw by outside researchers, though no specific tooling or actor has been confirmed.

MITRE ATT&CK techniques used in TL-2026-1992

Credential Access

T1110.002 Password Cracking; T1552.004 Private Keys

Collection

T1119 Automated Collection

Resource Development

T1587.004 Exploits; T1588.002 Tool; T1588.006 Vulnerabilities

Reconnaissance

T1592.003 Firmware; T1596.005 Scan Databases

defense-impairment

T1600.001 Reduce Key Space

Impact

T1657 Financial Theft

Affected products and versions in Coldcard Hardware Wallet $111M Bitcoin Theft

  • Coinkite — COLDCARD Mk2/Mk3
    Vulnerable versions: 4.0.0; 4.0.1-4.1.9
    Fixed in: 4.2.0+
  • Coinkite — COLDCARD Mk4/Mk5 (Standard)
    Vulnerable versions: pre-5.6.0
    Fixed in: 5.6.0+
  • Coinkite — COLDCARD Mk4/Mk5 (Edge)
    Vulnerable versions: pre-6.6.0X
    Fixed in: 6.6.0X+
  • Coinkite — COLDCARD Q (Standard)
    Vulnerable versions: pre-1.5.0Q
    Fixed in: 1.5.0Q+
  • Coinkite — COLDCARD Q (Edge)
    Vulnerable versions: pre-6.6.0QX
    Fixed in: 6.6.0QX+

Remediation for Coldcard Hardware Wallet $111M Bitcoin Theft

Patches

  • COLDCARD firmware 4.2.0+ (Mk2/Mk3)
  • COLDCARD firmware 5.6.0+ (Mk4/Mk5 standard)
  • COLDCARD firmware 6.6.0X+ (Mk4/Mk5 Edge)
  • COLDCARD firmware 1.5.0Q+ (Q standard)
  • COLDCARD firmware 6.6.0QX+ (Q Edge)

Immediate actions

  • Update COLDCARD firmware to the patched build for your model BEFORE generating any new seed: 4.2.0+ (Mk2/Mk3), 5.6.0+ (Mk4/Mk5 standard), 6.6.0X+ (Mk4/Mk5 Edge), 1.5.0Q+ (Q standard), 6.6.0QX+ (Q Edge)
  • Generate a brand-new seed on the updated/patched firmware and migrate all funds from any seed created on vulnerable firmware (v4.0.0-4.1.9 on Mk2/Mk3; any pre-fix build on Mk4/Mk5/Q)
  • Verify the new receive address and send a small test transaction before migrating the remaining balance; retain the old backup only until migration is confirmed complete

Workarounds

  • Seeds created with 50+ independent private dice rolls during original generation are not considered at risk from this RNG issue alone
  • Seeds protected by a strong, unique BIP-39 passphrase separate from the seed backup are not practically at risk even if the base seed entropy was weak
  • TAPSIGNER, OPENDIME, and SATSCARD products use a different code path and are unaffected; no action required

Longer-term hardening

  • Add 50 or more independent private dice rolls as supplemental entropy whenever generating a new hardware-wallet seed
  • Protect wallets with a strong, unique BIP-39 passphrase kept independent of the seed backup, as a defense-in-depth measure against future RNG defects
  • For firmware/embedded RNG code, validate configuration guards on macro VALUE, not just existence (#if MACRO, not #ifndef MACRO), and add build-time tests asserting the hardware RNG path is actually compiled and exercised
  • Independently re-audit hardware-RNG wrapper integration after any MicroPython/libNgU or similar third-party dependency migration
  • Vendors of offline/air-gapped signing hardware should publish reproducible-build attestations and third-party entropy audits given the multi-year dormancy of this class of bug

Weaknesses (CWE) in Coldcard Hardware Wallet $111M Bitcoin Theft

CWE-338, CWE-330

Timeline of Coldcard Hardware Wallet $111M Bitcoin Theft

  • Commit b18723dd introduces the RNG-fallback regression during a libNgU migration; the build guard checks macro existence (#ifndef) instead of value, causing MICROPY_HW_ENABLE_RNG=0 to silently select the Yasmarang software PRNG fallback instead of the STM32 hardware TRNG.
  • COLDCARD firmware v4.0.0 ships publicly with the RNG regression, beginning five years of affected seed generation on Mk2/Mk3 devices.
  • Coinkite publishes a preliminary security advisory (COLDCARD Mk3 Seed Generation Warning) confirming the entropy issue and urging at-risk users to prepare to migrate funds.
  • Initial exploitation wave drains 1,196 single-signature addresses of 1,082.65 BTC (~$70.2M) within a 41-minute window via GPU-accelerated offline brute-forcing of the predictable Yasmarang state space.
  • Coinkite releases patched firmware across all affected product lines (4.2.0 Mk2/Mk3, 5.6.0 Mk4/Mk5 standard, 6.6.0X Mk4/Mk5 Edge, 1.5.0Q Q standard, 6.6.0QX Q Edge) roughly 24 hours after the first wave, and suspends shipment of unpatched inventory.
  • Block (Square) Engineering publishes an independent technical analysis identifying the truncated 4-byte reseed() weakness affecting Mk4/Mk5/Q devices, and Coinkite publishes an updated technical backgrounder on the entropy issue.
  • Additional draining waves are identified; Galaxy Research raises the cumulative suspected total to 1,367.05 BTC (~$88.6M) across 4,585 addresses and begins tracking roughly 600 suspected attacker-controlled addresses.
  • TRM Labs estimates confirmed losses at 1,816 BTC (~$116M) as fund-flow tracing continues; Fortune reports on the escalating impact.
  • TechCrunch reports Galaxy Research's projection that total losses could exceed $130M (up to ~2,300 BTC) if remaining unconfirmed cases are validated.
  • Investigators confirm losses of 1,719 BTC (~$111M) across more than 5,200 addresses, with 25+ distinct attack patterns identified across three waves, indicating multiple likely operators; 88% of drained funds came from addresses dormant a year or more (median 3.5 years).

Sources cited for Coldcard Hardware Wallet $111M Bitcoin Theft

Threats related to Coldcard Hardware Wallet $111M Bitcoin Theft

Detection coverage for TL-2026-1992

As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1992 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats