When the dust settled on July 30, investigators traced an astonishing 1,367 Bitcoin, worth roughly $88.6 million, disappearing from 4,585 addresses. The loss spanned just 41 minutes, yet the damage dwarfed many past crypto breaches.
Key Takeaways
- COLDCARD’s firmware used a deterministic fallback RNG instead of the hardware generator.
- Attackers swept funds with a hard‑coded 30 sat/vB fee, 30‑75× the market rate.
- Galaxy Research identified three waves, totaling $88.6 M stolen.
- Coinkite’s advisory urges firmware updates and fresh seed generation.
- Hardware wallets that rely on insecure RNGs can be compromised offline.
Historical Context
Hardware wallets have long been the go‑to defense for crypto holders who want an “air‑gapped” safeguard. Early models relied on a single, proven hardware random‑number generator (RNG) built into the microcontroller. Over time, manufacturers layered open‑source firmware on top of those chips, hoping to add features without sacrificing security.
That layering introduced a subtle risk: a software fallback could be triggered when the hardware RNG failed or was unavailable. In many products, that fallback was a simple pseudo‑random routine intended only for debugging. When the routine made it into production, it opened a back door that a determined attacker could walk through.
Previous high‑profile incidents have shown that a compromised RNG can turn an offline device into an online target. Those cases taught the community that cryptographic strength depends on every component, not just the headline‑grabbing hardware. The COLDCARD episode is the latest reminder that the chain is only as strong as its weakest link.
Developers responded by tightening code reviews and adding automated checks for RNG calls. Auditors began to flag any use of MicroPython’s Yasmarang fallback as a red flag. The industry’s playbook now includes a step to verify that the fallback is disabled before a firmware release leaves the lab.
Even with those safeguards, the COLDCARD flaw slipped through. It demonstrates that open‑source projects, despite transparent code, still need rigorous integration testing. The lesson is clear: a single line of code can undo years of hard‑earned trust.
COLDCARD RNG Flaw: What Went Wrong and Who Paid the Price
It’s not just a bug; it’s an integration error that let a deterministic software RNG slip into production. Block’s Bitcoin Engineering team says the firmware’s check sent ngu.random to MicroPython’s Yasmarang fallback instead of the STM32’s true hardware RNG. That fallback drew on the device’s microcontroller ID and timing values – data anyone can observe or reconstruct.
How the Vulnerability Operates
Because the fallback isn’t cryptographically secure, attackers could simulate seed generation offline, compute every possible address, and match those against the blockchain. When a match appeared, they’d know the exact seed and could instantly derive the private key. In other words, the flaw turned a hardware‑protected wallet into a software‑guessable one.
That’s the catch. The RNG mistake meant that any seed produced on affected firmware versions – Mk2 and Mk3 4.0.1‑4.1.9, Mk4/Mk5 before 5.6.0, and Q devices before 1.5.0Q – was essentially public‑ready for a determined adversary.
Timeline of the Theft
On July 30, Galaxy Research spotted an initial wave of 1,083 BTC, worth $70.2 M, moving from 1,196 addresses. Every transaction paid an identical hard‑coded 30.0 sat/vB fee, a stark overpay compared with the week’s median of 0.4‑1.0 sat/vB. The attack lasted just 41 minutes, finishing roughly 30 hours before Coinkite publicly disclosed the flaw.
Then, on August 1, the same researchers identified two more waves, pushing the total stolen amount to $88.6 M. Chainalysis’ data showed the attacker zeroed in on high‑value wallets, snatching $30 M in the first ten minutes and even extracting $1.8 M from a single victim.
“COLDCARD firmware contains an RNG integration error that causes ngu.random to use MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware RNG,” the Block report reads.
That looks like an automated tool spending keys it already held, not owners moving funds,” Galaxy said. The pattern of no change outputs and identical fees makes it clear the thieves used a script that fed pre‑computed private keys straight into sweep transactions.
Who Detected the Attack and What the Data Shows
Galaxy Research, a digital‑asset analytics firm, was the first to publish the wave analysis. Their methodology tracked transaction fees, output structures, and timing to flag the suspicious activity. The firm’s confidence grew when Chainalysis corroborated the high‑value focus, noting a clear prioritization of wallets that likely held the most Bitcoin.
Because the stolen coins stayed in attacker‑controlled addresses, the total hasn’t changed since the report. That suggests the thieves are either hoarding the loot or moving it through mixers to obscure the trail. Either way, the funds remain out of reach for the original owners.
Response from Vendors and Mitigation Steps
Coinkite, the company behind COLDCARD, issued a sweeping advisory on August 1. It listed the affected firmware ranges and offered new versions: 4.2.0+ for Mk2/Mk3, 5.6.0+ for Mk4/Mk5, 1.5.0Q+ for Q devices, and corresponding Edge releases (6.6.0X/6.6.0QX). The update swaps the fallback RNG for the proper hardware source.
But updating alone won’t fix compromised seeds. Coinkite tells users to verify their existing backup, install the fixed firmware, generate a fresh seed, and move funds after a test transaction. The old backup should stay until the migration succeeds.
Seeds supplemented with at least 50 fair, independent dice rolls aren’t considered at risk from this flaw alone, and a strong BIP‑39 passphrase adds another hurdle. Still, Coinkite urges everyone to migrate because a passphrase doesn’t repair an already‑exposed seed.
Coinkite also confirmed that its TAPSIGNER, OPENDIME, and SATSCARD products aren’t affected – they run on different codebases. The company destroyed all COLDCARD devices awaiting shipment with the vulnerable firmware and emailed owners of shipped units with migration instructions.
Implications for Crypto Wallet Security
When a hardware wallet’s RNG can be bypassed, the entire trust model collapses. Developers should treat any deterministic fallback as a fatal flaw, not a minor inconvenience. The COLDCARD episode reminds us that even well‑reviewed open‑source firmware can harbor integration bugs that slip past QA.
- Hardware RNGs must be explicitly called; fallback paths should be disabled in production.
- Firmware audits need to verify that cryptographic primitives aren’t replaced by insecure software equivalents.
- Users should treat seeds generated on any device with known RNG issues as compromised.
- Multi‑factor defenses – such as BIP‑39 passphrases and offline dice entropy – can mitigate but not erase the risk.
It’s ironic that a device marketed for “air‑gapped” security fell victim to a purely software‑side mistake. That irony only deepens when you consider the millions of dollars now sitting in attacker wallets.
Key Questions Remaining
Will other hardware wallets undergo a similar forensic review? The answer depends on how quickly the community can mobilize resources to scan firmware for hidden fallbacks. If more devices are found to rely on deterministic RNGs, the market could see a wave of patch releases.
How will law‑enforcement agencies trace the stolen funds? Chainalysis has already mapped the early movements, but the next steps will likely involve cooperation with mixers and exchanges to force a convergence point.
What safeguards can manufacturers add without sacrificing usability? Some propose a dual‑RNG approach where a software generator cross‑checks the hardware output. Others suggest hardware‑level tamper detection that disables the device if the RNG deviates from expected entropy.
These open issues will shape the next round of wallet design and the regulatory conversation around crypto custody.
What This Means For You
If you own a COLDCARD, don’t wait for a second notice. Verify your firmware version right now, and if it predates 4.2.0 (or the equivalents for your model), flash the latest release immediately. After updating, generate a brand‑new seed, write it down offline, and move any funds to the new address after a tiny test transaction.
Developers building wallet software should audit every random‑number call. Ensure that any fallback path either matches the security guarantees of the primary RNG or is outright disabled. The COLDCARD case shows that a single unchecked line can open the door to a $88 M theft.
Founders planning a new crypto service can learn from this breach. Imagine a startup that integrates a hardware wallet for custody. If the team assumes the vendor’s RNG is flawless, they may skip an independent code review. That oversight could let an attacker siphon away user deposits in minutes.
Builders of DeFi protocols often rely on off‑chain signing services. Should those services use a deterministic RNG, the same pattern of pre‑computed keys could appear in transaction logs. A malicious actor with the seed could replay signed messages and drain the protocol.
In each scenario, the cost of a single insecure random number dwarfs the effort spent on a thorough audit. The takeaway is simple: treat RNG integrity as non‑negotiable, and bake verification into every release pipeline.
Looking ahead, will hardware wallet manufacturers adopt stricter third‑party code reviews, or will the market continue to rely on self‑audits? The answer could shape the next generation of crypto custody solutions.
Sources: BleepingComputer, Coinkite
