Coldcard Wallet Firmware Flaw Disclosed

On July 30, a series of unauthorized transactions targeted 1,196 Bitcoin addresses, resulting in the movement of 1,082.65 BTC. Analysis by Galaxy Research tied these events to a firmware flaw within the Coldcard hardware wallet, manufactured by the Canadian company Coinkite.

Deterministic PRNG Failure

The security vulnerability originated from a firmware integration error that diverted seed generation to a deterministic pseudorandom number generator instead of the expected STM32 hardware RNG. This default behavior utilized the chip's unique ID and timer registers for initialization without capturing subsequent fresh entropy.

Technical analysis indicates that an attacker possessing knowledge of the device's UID, timer state, and prior RNG call history can potentially reconstruct output streams offline. By deriving addresses from these candidate seeds and comparing them against public blockchain data, unauthorized parties may identify vulnerable wallets.

Estimating Cryptographic Strength

Coinkite has provided data regarding the effective entropy associated with different device models. The manufacturer estimates the following figures for its hardware line:

• Mk3: approximately 40 bits
• Mk4, Mk5, and Q: approximately 72 bits

These values fall below the 128 bits typically required for a standard 12-word BIP-39 seed. While the company noted that seeds created with at least 50 fair, independent, and private dice rolls are not susceptible to this specific bug, they still recommend that users migrate their assets if the quality of the initial entropy is uncertain.

Ongoing Financial Impact

Following the initial discovery, Galaxy Research identified additional waves of suspected activity. The updated figures reflect a broader scope of the incident:

• 1,367.05 BTC total identified loss
• $88.6 million approximate valuation
• 4,585 total addresses affected

Coinkite released emergency firmware updates on July 31 for all affected models. However, the company emphasized that installing the patch does not retroactively secure an existing seed. Users must generate a new, secure seed on the updated firmware and move their coins to the new wallet.

Implications for Hardware Security

This situation illustrates the limitations of relying on a single hardware manufacturer for cryptographic security. Because the flaw is tied to the firmware environment in which a seed was originally created, performing a simple software update is insufficient to remediate the exposure. For users, this means that even if their current device appears to be running the latest software version, the underlying root of trust—the seed itself—may remain fundamentally compromised if it was generated under the flawed configuration. Organizations and individuals using these devices should evaluate their current storage strategies and consider the necessity of rotating keys to ensure they are not carrying forward legacy vulnerabilities.