Listen to this Post
Introduction
The Coldcard hardware wallet, long revered as the gold standard for Bitcoin cold storage, suffered a catastrophic failure in July 2026 when a firmware bug introduced in March 2021 silently disabled its hardware random number generator (RNG). Attackers exploited this flaw to regenerate private keys offline, draining over 1,367 BTC—nearly $89 million—from more than 4,500 wallet addresses across three distinct waves of theft. The breach represents one of the most serious Bitcoin wallet security incidents to date, exposing a fundamental truth: even air-gapped hardware wallets are only as secure as the entropy they generate—and when randomness fails, so does everything else.
Learning Objectives
- Understand how a single firmware integration error silently bypassed hardware-based random number generation across multiple Coldcard generations
- Identify vulnerable firmware versions and assess whether your Bitcoin holdings remain at risk
- Implement verified entropy-enhancement techniques, including dice-roll seed generation and BIP-39 passphrases
- Recognize the role of AI in both discovering and defending against cryptographic vulnerabilities
- Apply forensic commands to audit wallet generation patterns and verify seed integrity
1. The Anatomy of a 40-Bit Catastrophe
The vulnerability traces to a March 1, 2021 commit that migrated Coldcard’s elliptic-curve operations to Bitcoin Core’s libsecp256k1. During this integration, seed generation moved from `ckcc.rng_bytes()` to ngu.random.bytes(). The production board configuration defined `MICROPY_HW_ENABLE_RNG` as zero—because Coldcard provides its own hardware-RNG wrapper—but the libngu library incorrectly checked only whether that macro was defined, not whether it was enabled.
The build completed silently against MicroPython’s deterministic Yasmarang software fallback, initialized from the chip’s unique ID and timer registers. No fresh entropy was collected after initialization. On Mk2 and Mk3 devices, this produced zero cryptographic entropy beyond nonsecret factory metadata. Coinkite estimates the effective search space collapsed to roughly 40 bits on Mk3 devices—a number modern cloud computing can brute-force in hours, compared to the intended 128 bits that would require billions of years to crack.
Affected Firmware Versions
| Device | Vulnerable Firmware | Fixed Version |
|–|||
| Mk2 | v4.0.0 – v4.1.9 | No fix available |
| Mk3 | v4.0.0 – v4.1.9 | No fix available (EOL) |
| Mk4 / Mk5 | Before 5.6.0 | 5.6.0+ |
| Q | Before 1.5.0Q | 1.5.0Q+ |
| Edge (Mk4/Mk5) | Before 6.6.0X | 6.6.0X+ |
| Edge (Q) | Before 6.6.0QX | 6.6.0QX+ |
Later models (Mk4, Q, Mk5) added secure-element entropy during boot, but retained only four bytes—limiting the output stream space to at most 2³² (approximately 4 billion) possibilities. Coinkite estimates this yields roughly 72 bits of effective entropy, an improvement but still far short of the 128-bit security target.
Step-by-Step: Verifying Your Device’s Risk
- Identify your Coldcard model — Check the label on the device背面 or use the `version` command in the device menu.
- Determine the firmware version — Navigate to `Settings > Version` or
Advanced > Version Info. - Check the firmware that was running when your seed was created — Exposure depends on the firmware at seed-generation time, not the currently installed version.
- Cross-reference with the table above — If your seed was generated on any vulnerable firmware version without additional entropy (dice rolls or passphrase), your funds are at risk.
- If affected — Do not update firmware and assume the seed is safe. Generate a completely new seed on patched firmware and migrate all funds immediately.
Linux Command: Entropy Assessment
Check system entropy availability (for reference, not Coldcard-specific) cat /proc/sys/kernel/random/entropy_avail Generate a cryptographically secure random number (128-bit equivalent) head -c 16 /dev/urandom | xxd -p Estimate brute-force time for 40-bit vs 128-bit entropy 40-bit: 2^40 ≈ 1.1 trillion combinations echo "2^40" | bc 128-bit: 2^128 ≈ 3.4 × 10^38 combinations echo "2^128" | bc
2. How the Attack Unfolded: Offline Key Regeneration
The attacker never touched a single Coldcard device. Instead, they exploited the bounded search space to regenerate likely seed phrases offline, derive corresponding Bitcoin addresses, and check which ones held balances.
Wave 1: July 30, 2026 — 41 Minutes, $70 Million
Between 01:10 and 01:51 UTC, the attacker drained 1,082.65 BTC from 1,196 addresses, pulling more than $30 million in the opening ten minutes. The sweep moved 1,324 chunks of bitcoin across 500 transactions within a three-block window.
Wave 2: August 1, 2026 — $75 Million Total
Galaxy Research identified a second wave tied to the same attacker, bringing the total to 1,158.66 BTC from 2,673 addresses.
Wave 3: August 2, 2026 — $89 Million, 4,585 Addresses
A third wave swept roughly 208 BTC from 1,912 addresses, now targeting smaller balances (average ~0.1 BTC per victim) and employing more complex transaction patterns—each victim’s coins sent to its own destination rather than shared collector addresses.
Step-by-Step: How the Attacker Operated
- Identify the vulnerable firmware version — The attacker knew the March 2021 build error affected seeds generated after that date.
- Gather device fingerprints — The deterministic fallback was seeded from the MCU’s unique ID and timer registers—nonsecret factory metadata.
- Generate candidate seeds offline — Using the bounded search space (2⁴⁰ to 2⁷² possibilities), the attacker generated millions of candidate seed phrases.
- Derive addresses from each candidate — Applied BIP-32 derivation to generate corresponding Bitcoin addresses.
- Cross-reference with public blockchain data — Checked which addresses held Bitcoin balances.
- Execute transactions — Once a match was found, the private key was known, and funds were swept without physical access.
Windows PowerShell: Seed Entropy Estimation
Estimate search space for Mk3 (40 bits) [bash]::Pow(2, 40) Estimate search space for Mk4/Q/Mk5 (72 bits) [bash]::Pow(2, 72) Generate a cryptographically secure random hex string (for comparison) $rng = [System.Security.Cryptography.RNGCryptoServiceProvider]::new() $bytes = New-Object byte[] 16 $rng.GetBytes($bytes) [System.BitConverter]::ToString($bytes) -replace '-',''
- The Human Factor: Dice Rolls as the Saving Grace
The irony is profound. Users seeking sovereignty by cutting out banks and exchanges simply relocated their trust to a wallet provider. Yet the oldest random number generator in the world—a physical die—outperformed the tech.
Coldcard has long advised users to add their own entropy by rolling dice 50+ times. Each roll of a standard D6 die provides approximately 2.585 bits of entropy. For 128-bit security, 50 fair, independent, private dice rolls provide sufficient raw information. For 256-bit security, 99 rolls are recommended.
Users who literally rolled dice—even using casino-grade dice and measures to prevent biased throws—did not lose their Bitcoin. Coinkite explicitly states that a seed built with at least 50 fair, independent, private dice rolls is not at risk from this bug alone.
Step-by-Step: Generating a Seed with Dice Rolls on Coldcard
1. Prepare your dice — Use standard six-sided dice. Casino-grade dice are preferred for uniformity, but any fair dice will suffice.
2. Determine the number of rolls — 50 rolls for 128-bit security (12-word seed); 99 rolls for 256-bit security (24-word seed).
3. Roll in a private, secure environment — Ensure no one observes or records your rolls.
4. Navigate to the Coldcard menu — Advanced/Tools > Temporary Seed > Generate Words.
5. Select “12 Word Dice Roll” or “24 Word Dice Roll”.
6. Enter each roll result — The device will prompt you for each roll sequentially.
7. Verify the seed — Use the “dry run” feature to ensure seed generation has not been tampered with.
8. Back up your seed words — Store them securely, ideally in multiple physical locations.
9. Power-cycle the device — Verify the wallet fingerprint and a receive address before sending funds.
Linux Command: Dice Roll Entropy Calculation
Calculate entropy from dice rolls Each D6 roll provides log2(6) ≈ 2.585 bits echo "scale=3; l(6)/l(2)" | bc -l 50 rolls: 50 2.585 = 129.25 bits echo "scale=3; 50 l(6)/l(2)" | bc -l 99 rolls: 99 2.585 = 255.915 bits echo "scale=3; 99 l(6)/l(2)" | bc -l
- The AI Factor: When Machine Learning Becomes a Weapon
Coinkite acknowledges that attackers likely used AI to review the open-source firmware and discover the vulnerability. The company ran one of the best available AI models over its own code weeks earlier—and the model found nothing.
“Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.” — Coinkite
This asymmetry highlights a critical reality: AI-powered code review is not a silver bullet. Attackers can focus their computational resources on finding a single exploitable flaw, while defenders must identify all vulnerabilities across an entire codebase. The Coldcard incident demonstrates that even with open-source code and AI-assisted auditing, subtle integration errors can remain undetected for years.
Step-by-Step: AI-Assisted Code Review for Cryptographic Vulnerabilities
- Prepare the codebase — Clone the repository and ensure all dependencies are available.
- Define the security model — Identify critical functions (e.g., RNG, key generation, entropy sources).
- Use static analysis tools — Run automated scanners like
clang-tidy,cppcheck, or `Semgrep` to identify common vulnerabilities. - Apply AI-powered analysis — Use tools like GitHub Copilot, CodeQL, or custom LLM-based prompts to review critical code paths.
- Focus on integration points — The Coldcard bug occurred at the boundary between the hardware RNG wrapper and the MicroPython fallback—a subtle integration error that static analysis missed.
- Test edge cases — Verify that preprocessor macros are not only defined but correctly evaluated.
- Perform differential analysis — Compare code changes across versions to identify regressions.
Verification Commands
Clone the Coldcard firmware repository (for educational purposes) git clone https://github.com/Coldcard/firmware.git Search for RNG-related macros grep -r "MICROPY_HW_ENABLE_RNG" firmware/ Check preprocessor definitions grep -r "ifdef" firmware/ | grep -i rng Look for fallback implementations grep -r "Yasmarang" firmware/
- Mitigation and Recovery: What Coldcard Users Must Do Now
Coinkite has shipped emergency firmware patches: version 5.6.0 for Mk4/Mk5 and 1.5.0Q for Q. However, updating firmware does not repair a seed already created on affected firmware. The weak seed remains weak, regardless of the current firmware version.
Immediate Action Steps
- Determine if your seed is at risk — If generated on any vulnerable firmware version without at least 50 dice rolls, assume compromise.
- Do not update firmware and assume safety — The seed itself is compromised; patching firmware only protects future seeds.
- Generate a new seed on patched firmware — Upgrade to 5.6.0+ (Mk4/Mk5) or 1.5.0Q+ (Q) first.
- Add optional entropy — Coinkite recommends a strong BIP-39 passphrase, at least 99 dice rolls, or both.
- Create a new wallet — Use the newly generated seed to create a fresh wallet.
- Verify the wallet fingerprint — Power-cycle the device and verify the fingerprint matches your records.
- Send a small test transaction — Before moving all funds, send a tiny amount to confirm everything works.
- Migrate all funds — Move your entire balance to the new wallet.
- Securely destroy the old seed — Physically destroy any written backups of the compromised seed.
Additional Security Layers
- BIP-39 Passphrase — Creates a separate wallet that the seed words alone cannot reach. Each passphrase—including typos—produces a valid wallet, so verify the fingerprint before depositing funds.
- Multisig — Helps only when the quorum is not built entirely from affected devices.
- Alternative Devices — TAPSIGNER, OPENDIME, and SATSCARD use different codebases and are unaffected.
Windows Command: BIP-39 Seed Entropy Verification (Python)
Requires: pip install mnemonic
from mnemonic import Mnemonic
import secrets
Generate a secure 12-word seed (128 bits)
mnemo = Mnemonic("english")
entropy = secrets.token_bytes(16) 128 bits
seed = mnemo.to_mnemonic(entropy)
print(f"Generated seed: {seed}")
Verify entropy: 12 words = 128 bits
print(f"Entropy bits: {len(entropy) 8}")
6. The Market Response and Future Implications
Despite the severity, Bitcoin’s price barely blinked—trading around $62,900 on August 1. The attacker’s stolen funds remain unspent across seven addresses, likely due to enhanced exchange compliance and real-time blockchain monitoring.
What Undercode Say:
- Entropy is the foundation of cryptographic security — When randomness fails, every other security layer collapses. Coldcard’s hardware RNG bypass demonstrates that even purpose-built security devices can harbor catastrophic vulnerabilities for years.
- AI is a double-edged sword — Attackers and defenders have access to the same tools, but attackers only need to find one vulnerability while defenders must find all of them. The Coldcard incident shows that AI-assisted code review is not a substitute for rigorous auditing, formal verification, and robust bug bounty programs.
- Human-generated entropy remains underrated — The oldest random number generator in the world—a physical die—outperformed the tech. Users who rolled dice 50+ times did not lose their Bitcoin, proving that adding human-generated entropy provides a critical safety net when hardware RNG fails.
- Trust is the ultimate vulnerability — Users seeking sovereignty by cutting out banks and exchanges simply relocated their trust to a wallet provider. The Coldcard incident is a reminder that self-custody requires not just technical competence but also a healthy skepticism toward the devices we trust.
Prediction:
- +1 The incident will accelerate the adoption of multi-party computation (MPC) and threshold signature schemes, reducing reliance on single-device RNG.
- +1 Hardware wallet manufacturers will invest significantly in formal verification, differential fuzzing, and AI-assisted auditing to prevent similar integration errors.
- -1 The attack demonstrates that AI-powered vulnerability discovery will become increasingly common, forcing defenders to adopt adversarial AI techniques and continuous monitoring.
- -1 The Coldcard breach will erode consumer trust in hardware wallets, potentially slowing Bitcoin adoption among retail investors.
- +1 The use of physical entropy sources (dice rolls, coin flips, etc.) will gain mainstream recognition as a best practice for seed generation.
- -1 The stolen $89 million may eventually be laundered through decentralized mixers or cross-chain bridges, complicating recovery efforts.
- +1 Regulatory pressure on hardware wallet manufacturers will increase, leading to mandatory security certifications and independent audits.
- -1 The incident highlights the fragility of the Bitcoin ecosystem’s security model—if a single firmware bug in one manufacturer can compromise thousands of wallets, the system’s resilience is called into question.
- +1 Open-source hardware and software will gain traction as users demand verifiable, auditable security.
- -1 The attack may inspire copycat exploits targeting other hardware wallets with similar RNG integration flaws.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Annalisa Nash – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
