Coldcard flaw enables GPU theft

Other (15)

• Rob Hamilton issued an urgent warning for Coldcard MK3, MK4, MK5, and Q users who generated wallets directly from the device without providing their own entropy or a strong passphrase, urging immediate fund recovery.
• The critical bug, introduced in early 2021 via a firmware change, compromised the entropy generation process, making seed words created by affected Coldcard devices insecure.
• Rob Hamilton clarifies that Coldcard MK1 and MK2 models are not impacted by this specific firmware bug, as they are older hardware and do not receive new firmware updates.
• For impacted Coldcard users, a sufficiently strong 25th-word passphrase or providing external entropy (e.g., dice rolling) is the only protection against attackers scanning all possible Coldcard seed phrases.
• Rob Hamilton explains that the MK3 has only 2^32 bits of entropy, which is easily brute-forced by consumer hardware, while MK4, MK5, and Q models have 45-50 bits, still vulnerable to GPU data farms.
• The vulnerability stems from a single line of code that incorrectly skipped secure entropy generation if a function merely existed, rather than evaluating if it was true, a 'nuclear event' for hardware wallet security.
• Initially, the attack was carried out by an amateur, evident from only targeting addresses with more than 0.15 BTC and failing to scan full addresses; now, multiple sophisticated attackers are involved.
• Danny Knowles confirms that Trezor and Foundation devices are safe because they do not use the same compromised library as Coldcard, indicating a specific, not widespread, self-custody vulnerability.
• Rob Hamilton recommends moving funds to trusted exchanges like River, citing its in-house custody and proof of reserves, or immediately acquiring other hardware wallets like Ledger or BitKey as emergency measures.
• Multi-signature wallets are at risk if a majority of their signers (e.g., two of three) are compromised Coldcard devices without strong passphrases or rolled dice; Unchained, Casa, and AnchorWatch state they are not affected.
• For at-risk multi-sig wallets with un-reused addresses, Rob Hamilton suggests using Mara Slipstream to broadcast transactions directly to a mining pool, which helps prevent replace-by-fee attacks by faster confirmation.
• Rob Hamilton estimates over 1100 BTC has been stolen already, with projections of thousands more, as well-capitalized attackers using GPU computing join the effort to exploit the vulnerability.
• The Coldcard incident is a 'nuclear event' for Bitcoin self-custody, fundamentally undermining the trust in hardware wallets to generate sufficiently random numbers, a core tenet of Bitcoin security.
• Rob Hamilton observed that bleeding-edge, open-source LLMs like Kimi K3, without safety guardrails, could instantly identify the Coldcard bug, signaling a new era where AI accelerates vulnerability discovery.
• Future improvements for self-custody could include Bitcoin covenants and vault-like structures, enabling on-chain controls like address whitelisting or spending limits for enhanced security.

Other (15)

• Steve estimates the Coldcard security incident has resulted in over 1,000 BTC stolen, valued between $65 million and potentially $100 million, describing it as the "worst day in Bitcoin's history" due to the impact on self-custody.
• The Coldcard vulnerability affects MK2 and MK3 hardware with firmware from 2021 to the present, stemming from a compile-time bug that caused the hardware random number generator to fall back to a weak software pseudo-random generator.
• The bug allows attackers to regenerate private keys from on-chain transactions due to weak entropy, without physical device access or seed phrases, by brute-forcing inputs like the CPU timer cycle and unique device ID.
• Newer Coldcard models (MK4, MK5, Q) have 32 to 72 bits of cryptographic entropy, which is stronger but still potentially vulnerable to a financially substantial brute-force attack; reports indicate these models have also been exploited.
• Steve advises Coldcard users in vulnerable situations to move funds immediately to temporary locations like trusted custodians or wiped, old devices; CoinKite has released new firmware for most products, but not MK3.
• Bitcoin itself is not compromised; this is a vendor-specific issue with CoinKite's Coldcard products, underscoring Max's argument that AI poses a more immediate and significant threat to security than quantum computing.
• Customers who properly used Coldcard's dice roll feature (e.g., 99-100 rolls) or a strong BIP39 passphrase (128-bit or more) should be safe, but Steve suggests moving funds for peace of mind.
• Steve emphasizes custody diversification as crucial, recommending users split funds between solutions with non-intersecting risks, such as a third-party custodian and a self-custody solution, rather than relying solely on one method.
• Max proposes that for critical software, users need transparency on which top-tier AI models are conducting 24/7 security audits, stating that "all bugs are shallow with enough tokens."
• Project Loupe, launched by Spiral, performs AI security scans on open-source Bitcoin repositories, but models produce noise and misclassify severity, necessitating human review and active remediation by project maintainers.
• Steve suggests that recovering stolen Bitcoin would require proving original ownership through a combination of unique device IDs, DKIM-signed email receipts from CoinKite (verified for 2023), and KYC/on-chain analysis from exchanges.
• White hat hacking to sweep vulnerable funds to a secure system, to be returned to rightful owners, is proposed as a method to mitigate further theft, though the legality and feasibility remain uncertain.
• Multi-signature setups remain a strong self-custody option, but require diversity across keys from different hardware/software vendors to avoid single points of failure, unlike using multiple devices from the same vendor.
• BitKey is a multi-signature product by default, using three keys generated across different hardware and software stacks (Block server, phone, hardware device) to provide diversity, but it lacks independent verifiability for some key generation processes.
• Max questions if retail users can perform in-kind BTC transfers to IBIT (BlackRock's ETF) without a taxable event, noting it's currently restricted to authorized participants with tens of millions of dollars.

Coding (1)

• The vulnerability arises because the production board configuration defines `MICROPY_HW_ENABLE_RNG` as zero, and `libngu` incorrectly checks if the macro is defined rather than enabled, binding to a deterministic software generator.

Chips (2)

• COLDCARD Mk4/Q/Mk5 devices, using production firmware v5.0.0 onward, incorporate a limited secure-element reseed that hashes 32 bytes to retain only four, replacing just one 32-bit Yasmarang state word.
• The Yasmarang software fallback initializes using the MCU's low 32-bit UID, SysTick counter, and RTC registers, none of which are cryptographic entropy sources, allowing for state reproduction.

Safety (1)

• Block and security researchers identified the root cause on July 30, 2026, after user reports of lost funds, leading to the early publication of this advisory due to ongoing active exploitation.