Coldcard firmware flaw leaves Bitcoin seeds under-protected

Researchers at Block have disclosed a critical bug in the firmware of Coldcard hardware wallets made by Canadian company Coinkite: starting from March 2021, seed phrase generation on affected devices used a predictable software pseudo-random number generator (PRNG) instead of the hardware one. The effective entropy of seeds ranged from 40 to 72 bits instead of the expected 128 bits for a 12-word BIP-39 phrase. Coinkite released an emergency firmware update on July 31, but it does not fix already generated weak seeds — owners must create a new seed on the updated firmware and move their funds. In parallel, Galaxy Research recorded a suspicious operation on July 30: 1,196 Bitcoin addresses were emptied in 41 minutes for a total of 1,082.65 BTC (~$70.2 million), but no causal link with this vulnerability has been confirmed.

Technical essence of the vulnerability

The root cause lies in the Coldcard firmware build configuration. The MICROPY_HW_ENABLE_RNG macro was set to zero because Coinkite uses its own wrapper around the STM32 hardware random number generator. However, the libngu library only checked for the presence of the macro, not its value. As a result, the build was wired to the MicroPython software fallback — the Yasmarang algorithm.

This software PRNG was initialized from the unique chip identifier (UID) and timer register values and then did not receive fresh entropy. According to Block’s researchers, an attacker who can determine or significantly constrain the device UID space, the timer state, and the history of previous generator calls can reproduce the stream of output values offline — without accessing the device. The resulting candidate seed phrases are then checked by deriving addresses and correlating them with public blockchain data.

Estimates of effective entropy differ between the vendor and the researchers:

• Mk3: Coinkite estimates entropy at about 40 bits
• Mk4, Mk5, and Q: about 72 bits according to Coinkite
• Block sets conditional upper bounds below 2^40.7 and 2^73.3 respectively, warning that the latter figure is not equivalent to 73-bit cryptographic strength

For comparison: a standard 12-word BIP-39 seed provides 128 bits of entropy. Block has not published brute-force benchmark results, and the practical cost of an attack depends on how much information is available about the UID, boot time, prior generator invocations, and the cost of key derivation.

Affected versions

The vulnerability is determined by the firmware version on which the seed was created, not by the version currently installed:

• Mk3: versions 4.0.1–4.1.9 (fixed in 4.2.0) according to Coinkite; Block additionally includes Mk2 and version 4.0.0
• Mk4 and Mk5: all versions prior to 5.6.0
• Q: all versions prior to 1.5.0Q
• Edge builds: before 6.6.0X for Mk4/Mk5, before 6.6.0QX for Q

TAPSIGNER, OPENDIME, and SATSCARD products use a different code base and are not affected.

Important discrepancy: In its advisory, Coinkite does not mention the Mk2 model, whereas Block’s research includes it in the list of vulnerable devices. Mk2 owners should treat their seeds as potentially compromised.

Suspicious operation on July 30

According to Galaxy Research, on July 30 an unknown operator emptied 1,196 Bitcoin addresses in 41 minutes, moving 1,082.65 BTC. Galaxy noted that in the preceding 30 days no other transactions with a similar combination of characteristics were found: a 30 sat/vB fee and no change output.

However, Galaxy cautioned that this pattern identifies the operator rather than proving theft: a mass transfer of funds looks the same regardless of whether it was performed by the owner or by an attacker. No public report has reproduced a victim’s seed and matched it to an emptied address. The link between this operation and the Coldcard vulnerability remains a hypothesis based on blockchain pattern analysis.

Impact assessment

All Coldcard users who generated a seed on vulnerable firmware versions without using a sufficient number of dice rolls are at risk. Given that Coldcard is positioned as a wallet for long-term storage of large Bitcoin holdings, the potential damage is significant. Mk3 models with entropy around 40 bits are at the highest risk — such a key space can be brute-forced using modern computing resources.

Multisig reduces the risk only if the quorum is not composed entirely of affected Coldcard devices.

Practical recommendations

1. Determine the firmware version on which your seed was created. If it falls within the vulnerable range, treat the seed as compromised.
2. Update the firmware to a fixed version (4.2.0 for Mk3, 5.6.0 for Mk4/Mk5, 1.5.0Q for Q).
3. Generate a new seed on the updated firmware. Moving the old seed to updated firmware or another wallet does not eliminate the weakness — the vulnerability is embedded in the seed itself.
4. Transfer all funds from old addresses to addresses derived from the new seed.
5. Use dice rolls: Coinkite states that a seed generated using at least 50 honest, independent, and private rolls of physical dice is not affected by this vulnerability. If the number or privacy of the rolls is in doubt, migrate.
6. BIP-39 passphrase: a strong, unique passphrase creates a separate wallet that cannot be accessed with the seed words alone, but Coinkite still recommends replacing the seed.

Owners of affected Coldcard devices must act immediately: update the firmware, create a new seed, and move funds to new addresses. Delaying leaves Bitcoin protected by only 40–72 bits of entropy — orders of magnitude below the BIP-39 standard. Waiting for confirmed links between this vulnerability and specific thefts is not a reasonable strategy: the predictability of the generator alone makes seeds vulnerable, regardless of whether anyone has exploited them in practice.