A firmware bug sitting undetected in @COLDCARDwallet devices since March 2021 has now drained more than 1,080 $BTC, worth over $70 million, from nearly 1,200 wallets, according to data from G
A firmware bug sitting undetected in @COLDCARDwallet devices since March 2021 has now drained more than 1,080 $BTC, worth over $70 million, from nearly 1,200 wallets, according to data from Galaxy Research and engineers at Block. Drains are reportedly still ongoing.
The root cause, as detailed in Block's engineering disclosure, was a configuration error introduced when Coldcard firmware version 4.0.0 shipped in March 2021. The vulnerability caused devices to skip their hardware randomness generator and fall back to predictable software-based key generation seeded by non-secret chip data. Specifically, Coldcard firmware contains an RNG integration error that causes the random number function to use MicroPython's deterministic Yasmarang fallback instead of the STM32 hardware RNG, because the production board configuration defines the hardware RNG macro as zero, and the supporting library incorrectly checks whether that macro is defined rather than whether it is enabled.
The result was that seeds generated on affected Coldcard Mk3 devices carried roughly 40 bits of effective entropy rather than the 128 bits a 12-word BIP-39 mnemonic implies.This made private keys for many single-signature wallets, especially those created without dice rolls or a strong BIP-39 passphrase, predictable enough for attackers to brute-force.
The first confirmed sweep was swift. A hacker whose identity is still unknown managed to steal around 594 BTC from nearly 500 single-signature wallets in as little as 25 minutes, according to an analysis by Block, the fintech firm founded by Jack Dorsey.Block engineer Clay Garrett subsequently identified an additional 695 transactions with signatures matching the verified thefts, which if confirmed would link a further 488 BTC to the same exploit, putting the potential total above 1,082 BTC, or approximately $69.5 million.
@Coinkite initially focused its warning on Mk3 owners, but later expanded the advisory. Coinkite admitted that its Coldcard Mk3 model was affected and advised users to move their funds, then said that users of the later hardware devices Mk4, Mk5, and Q should also take precautions.According to Coinkite, seeds generated on Mk4 and Mk5 devices before version 5.6.0 and on Q devices before version 1.5.0Q had about 72 bits of entropy rather than the expected 128 bits. The company described the issue on those models as less severe but still serious. TAPSIGNER, OPENDIME, and SATSCARD are not affected because they use different codebases.
Fixed firmware has been released: version 4.2.0 or later for Mk3, 5.6.0 or later for Mk4 and Mk5, and 1.5.0Q or later for Q. These updates enforce proper use of the hardware true RNG and add build-time checks. However, updating firmware alone is not enough. Users must generate a new seed and migrate funds to a new wallet entirely. Coinkite's advisory warns explicitly against rushing, noting that mistakes in the recovery process could cause more damage than the vulnerability itself. Wallets protected by a strong BIP-39 passphrase are considered to face substantially lower risk.
Sources:Block Engineering Blog: Predictable RNG Fallback and 32-Bit Reseed in Coldcard FirmwareCoinDesk: Major Bitcoin Wallet Flaw Drains 594 BTC in 25-Minute SweepBitcoin Magazine: Coldcard Wallet Flaw Exposes Years of Bitcoin Seeds After $70M in BTC Stolen
