Full Report
A vulnerability in COLDCARD hardware wallet firmware allowed attackers to steal an estimated $88.6 million in Bitcoin from thousands of wallets whose seeds were generated using a flawed random number generator. [...]
Analysis Summary
# Vulnerability: COLDCARD Deterministic RNG Fallback
## CVE Details
- **CVE ID:** Not explicitly listed in report (Typically tracked under vendor-specific advisories for hardware wallets)
- **CVSS Score:** 9.8 (Estimated based on Critical impact: High Complexity, Total Loss of Confidentiality/Integrity)
- **CWE:** CWE-330: Use of Insufficiently Random Values; CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
## Affected Systems
- **Products:** Coinkite COLDCARD Hardware Wallets (Mk2, Mk3, Mk4, Mk5, and Q series)
- **Versions:**
- Mk2/Mk3: Firmware 4.0.1 through 4.1.9
- Mk4/Mk5: Firmware before Standard 5.6.0 or Edge 6.6.0X
- Q Devices: Firmware before Standard 1.5.0Q or Edge 6.6.0QX
- **Configurations:** Wallets where the seed phrase was generated directly on the device using the internal RNG without sufficient external entropy (e.g., dice rolls).
## Vulnerability Description
The vulnerability stems from an integration error in the `ngu.random` function within the COLDCARD firmware. Due to a coding error, the firmware failed to utilize the STM32 hardware random number generator (TRNG) as intended. Instead, it defaulted to MicroPython’s deterministic "Yasmarang" software fallback.
This fallback generator relied on predictable inputs: the device’s microcontroller ID and system timing values. Because these values are not cryptographically secure and are potentially observable, the resulting entropy was insufficient. This allowed attackers to perform offline brute-force computations to recreate potential seed phrases and identify high-value Bitcoin addresses.
## Exploitation
- **Status:** Exploited in the wild (Estimated $88.6 million stolen).
- **Complexity:** Medium to High (Requires offline computation of seeds based on known firmware logic).
- **Attack Vector:** Physical/Remote (The vulnerability exists in the generation process; however, the actual theft is executed via the network/blockchain using reconstructed keys).
## Impact
- **Confidentiality:** High (Private keys/seeds can be reconstructed).
- **Integrity:** High (Attackers can sign transactions and drain all funds).
- **Availability:** High (Loss of access to assets once moved by attacker).
## Remediation
### Patches
Update to the following firmware versions (or later):
- **Mk2 / Mk3:** Version 4.2.0
- **Mk4 / Mk5:** Standard version 5.6.0 or Edge 6.6.0X
- **Q Devices:** Standard version 1.5.0Q or Edge 6.6.0QX
### Workarounds
**IMPORTANT:** A firmware update **does not** fix a seed that has already been generated. The only effective remediation for existing users is:
1. Update firmware to a patched version.
2. Generate a **completely new seed phrase**.
3. Transfer all funds from the old (vulnerable) seed to the new seed.
4. (Optional but Recommended) Use the "Dice Rolls" feature (50+ rolls) to provide manual entropy, bypassing the internal RNG flaw.
## Detection
- **Indicators of Compromise:** Large outbound transactions to unknown addresses, specifically those using a hardcoded fee rate of 30.0 sat/vB with no "change" output.
- **Detection Methods:** Users can verify if their seed was generated during the vulnerable firmware window. Galaxy Research and Chainalysis have monitored the specific attacker-controlled addresses involved in the $88.6M theft.
## References
- **Vendor Advisory:** [https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/](https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/)
- **Technical Analysis:** [https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware](https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware)
- **Galaxy Research Report:** [http://x.com/glxyresearch/status/2083181683067506899](http://x.com/glxyresearch/status/2083181683067506899)