Coldcard Vulnerability: $70M in Bitcoin Stolen in 41 Minutes

A theft in 41 minutes

On July 30, an unknown actor drained 1,196 bitcoin addresses in 41 minutes, moving out 1,082.65 BTC — around $70.2 million at the time. Analysts at Galaxy Research reconstructed the “sweep” and tied it to a flaw in the firmware of Coldcard, a “bitcoin-only” hardware wallet made by the Canadian company Coinkite.

Where randomness broke

The cause dates back to March 2021. Because of a firmware integration bug, seed-phrase generation ran not through the hardware random number generator of the STM32 chip but through a deterministic software pseudo-random generator (PRNG). Per Block's analysis, the build referenced the Yasmarang fallback algorithm from MicroPython: the libngu library checked only whether the MICROPY_HW_ENABLE_RNG macro existed, not whether it was enabled. The fallback generator was seeded with the chip's unique identifier and timer values, and collected no fresh entropy once it started.

As a result, effective entropy shrank to roughly 40 bits on the Mk3 model and about 72 bits on the Mk4, Mk5 and Q — against the 128 bits of a normal 12-word BIP-39 seed phrase. An attacker who can determine or sufficiently narrow down the device identifier, the timer state and the history of calls to the generator is able to reproduce seed-phrase candidates offline and then check the derived addresses against the public blockchain.

What owners should do

On July 31, Coinkite released emergency firmware for all affected models, but the update does not “fix” a seed phrase that has already been created. The company advises owners of vulnerable wallets to generate a new phrase on the patched firmware and move their coins. Restoring the old seed on the updated firmware or in another wallet just carries the weakness forward.

The vulnerability is determined by the firmware that was running when the seed was created, not by what is installed now. At risk are the Mk4 and Mk5 before version 5.6.0, the Q before 1.5.0Q, and a number of early Mk2 and Mk3 releases. Not affected are TAPSIGNER, OPENDIME and SATSCARD — they have a different codebase.

Coinkite notes that a seed assembled from at least 50 honest, independent dice rolls in a private setting is not affected by this bug. A separate, strong BIP-39 passphrase creates an independent wallet, but replacing the seed is still recommended. Multisig helps only when the quorum is not made up solely of affected devices.

The attacker's name has not been disclosed. Galaxy stresses that the telltale signature — a 30 sat/vB fee with no change — gives away the operator, but not the fact of theft itself: from the outside, the “sweep” is indistinguishable from an owner routinely moving their coins. So far no one's seed has been publicly recovered or matched to a drained address.

Source: The Hacker News