Coldcard Hardware Wallet Flaw Leads to $70 Million Bitcoin Theft
Firmware vulnerability resulted in the theft of 1,082 BTC in just 41 minutes.
1$70 Million Worth of Bitcoin Stolen
On July 30, an attacker drained 1,196 Bitcoin addresses in just 41 minutes, stealing 1,082.65 BTC worth approximately $70.2 million at the time. Galaxy Research linked this massive theft to a firmware flaw in Coldcard, a Bitcoin-only hardware wallet manufactured by Canadian company Coinkite. The incident highlights critical vulnerabilities in even specialized crypto storage solutions.
2Root Cause of the Firmware Flaw
A March 2021 firmware integration error mistakenly routed seed generation to a deterministic software pseudorandom number generator (PRNG) instead of the STM32 hardware random number generator (RNG). According to Block researchers, an attacker who can determine or sufficiently constrain the device UID, timer state, and prior RNG-call history could reproduce candidate output streams offline without physical access to the device.
3Emergency Firmware Patch Released
Coinkite shipped emergency firmware updates for all affected models and release tracks on July 31. However, the company clarified that installing the update doesn't repair existing seeds. Users with potentially exposed seeds were advised to generate new ones on patched firmware and transfer their coins. Restoring old seeds to updated firmware or different wallets would perpetuate the vulnerability.
4Technical Details of the Vulnerability
The fault traced back to Coldcard's production configuration, which defined MICROPY_HW_ENABLE_RNG as zero since Coinkite supplies its own hardware-RNG wrapper. The libngu library checked for the macro's existence rather than its enabled status, binding the build to MicroPython's Yasmarang fallback. This fallback initialized from the chip's unique ID and timer registers without collecting fresh entropy post-initialization.
5Affected Models and Entropy Levels
Coinkite estimates effective entropy at roughly 40 bits for the Mk3 model and about 72 bits for Mk4, Mk5 and Q models - significantly below the 128-bit security expected from a standard 12-word BIP-39 seed. Block established conditional ceilings below 240.7 and 273.3, cautioning that the latter doesn't equate to 73-bit cryptographic security. The company published no brute-force benchmarks.
6Attacker's Identity Remains Unknown
The perpetrator behind the attack hasn't been identified. Galaxy, which mapped the 1,196-address sweep, found no other Bitcoin transactions with the same 30 sat/vB fee and no-change signature in the preceding 30 days. They noted this pattern identifies the operator rather than the theft itself, as sweeps "look identical to legitimate coin movements by owners."
7Related Security Vulnerabilities
This disclosure follows Coinspect's Ill Bloom research in early July, which uncovered a separate weak-PRNG flaw in older software wallets. That vulnerability was linked to over $5 million drained from addresses across Bitcoin, Ethereum, Tron, Rootstock and Polygon since May, demonstrating recurring issues with cryptographic randomness implementations.
8Critical Lessons for Crypto Security
This incident proves even hardware wallets aren't infallible. Users must regularly check for firmware updates and take proactive security measures. For high-value holdings, multisig solutions and strong BIP-39 passphrases become essential. The crypto community must prioritize rigorous security audits, especially for foundational components like random number generation in wallet systems.