cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

COLDCARD RNG Flaw Likely Linked to $88.6 Million Bitcoin Theft

· Original article ↗

Summary

Researchers say a COLDCARD firmware RNG flaw may be linked to thefts estimated at 1,367 BTC. The flaw used a deterministic fallback instead of hardware randomness; Coinkite released fixes and advised affected users to generate new seeds and migrate funds.

Key points

  • Galaxy Research estimated that about 1,367 BTC, worth $88.6 million, was taken from 4,585 addresses in thefts it linked to the flaw.
  • Galaxy said identical transaction fees and no change outputs suggested the thefts used an automated tool; Chainalysis reported that high-value wallets were targeted.
  • Block traced the flaw to an integration error that made COLDCARD firmware use MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware RNG.
  • The fallback relied on a microcontroller identifier and system timing values that Block said were not cryptographically secure, potentially allowing attackers to derive wallet seeds offline.
  • Affected seeds were generated on specified older Mk2, Mk3, Mk4, Mk5, and Q firmware versions; Coinkite released fixed firmware for those device lines.
  • A firmware update does not repair an existing seed. Coinkite advised affected users to create a new seed and migrate funds after verifying the new wallet.

Article Details

Vulnerability Types
  • Flawed random number generation caused COLDCARD firmware to use a deterministic software fallback instead of the hardware RNG.
Affected Versions
  • COLDCARD Mk2 and Mk3 firmware 4.0.1 through 4.1.9
  • COLDCARD Mk4 and Mk5 standard firmware before 5.6.0
  • COLDCARD Mk4 and Mk5 Edge firmware before 6.6.0X
  • COLDCARD Q standard firmware before 1.5.0Q
  • COLDCARD Q Edge firmware before 6.6.0QX
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available
Workarounds
  • Install fixed firmware and migrate funds to a newly generated seed; updating firmware alone does not repair a previously generated seed.
  • Coinkite says seeds supplemented with at least 50 fair, independent, and private dice rolls are not considered at risk from this flaw alone.

Vendors

CoinkiteGalaxy Research and Chainalysis say the thefts were likely automated, with attackers targeting high-value wallets before Coinkite disclosed the flaw.

Products

ColdcardResearchers believe a COLDCARD firmware vulnerability tied to flawed random number generation may have enabled attackers to steal an estimated $88.6 million in Bitcoin from thousands of wallets.

Related Articles