Reported by 1 outlet

Timeline

1. original reporting

   COLDCARD Hardware Wallet RNG Flaw Likely Behind $88.6M Bitcoin Theft — 4,585 Wallets Drained

   bleepingcomputer.com · 72d ago · August 3rd, 2026

   Researchers suspect a firmware RNG flaw in COLDCARD hardware wallets enabled the theft of an estimated $88.6 million in Bitcoin (1,367 BTC) from 4,585 addresses across three automated sweep waves (July 30–August 1). Galaxy Research identified the first wave — 1,083 BTC (~$70.2M) from 1,196 addresses in a 41-minute automated sweep on July 30, roughly 30 hours before Coinkite publicly disclosed the flaw. Every transaction used an identical hardcoded 30 sat/vB fee (a 30–75× overpay vs. that week's median) with no change output — "an automated tool spending keys it already held, not owners moving funds." Chainalysis found the attacker prioritized high-value wallets (~$30M taken in the first ten minutes; one victim lost $1.8M), suggesting the affected wallets were identified and studied in advance. The funds remained in attacker-controlled addresses at last report.

   Root cause: Block's Bitcoin Engineering and Security teams traced the issue to an RNG integration error: a faulty check in COLDCARD firmware makes ngu.random fall back to MicroPython's deterministic Yasmarang generator instead of the STM32 hardware RNG. The deterministic fallback was seeded by the device's microcontroller identifier and timing values — observable or reconstructable — letting attackers generate candidate seeds offline and match derived addresses against the blockchain.

   Affected: Mk2/Mk3 firmware 4.0.1–4.1.9; Mk4/Mk5 before standard 5.6.0 or Edge 6.6.0X; Q before standard 1.5.0Q or Edge 6.6.0QX. Fixed in 4.2.0+ / 5.6.0+ / 1.5.0Q+ / 6.6.0X / 6.6.0QX. Updating firmware does not repair a previously generated seed — affected users must verify backups, install fixed firmware, generate and record a new seed, verify the address on-device, test with a small transaction, then migrate remaining funds (retain old backups until migration is confirmed). Seeds supplemented with ≥50 fair, independent, private dice rolls are not considered at risk from this flaw alone; a strong unique BIP-39 passphrase mitigates but does not repair the seed. TAPSIGNER, OPENDIME, and SATSCARD use different codebases and are unaffected; Coinkite destroyed all affected unsold devices.

   ---