Coldcard flaw drains $60M in self-custody failure

Custody (4)

• A Coldcard hardware wallet exploit led to approximately 600 Bitcoin, valued at about $38 million, being emptied from around 500 single-signature wallets within 30 minutes.
• Q reports that updated estimates suggest over 1,000 Bitcoin have been stolen, emphasizing that the situation is still evolving and users who lost funds did nothing inherently wrong.
• Q states that the crucial factor for determining risk is the firmware version on the Coldcard when the seed was *generated*, not the current firmware version.
• Seth advises all users to move funds from any seed generated on a Coldcard due to this issue, even if they used dice rolls or a passphrase, as the vulnerability window varies.

Coding (2)

• The exploit affects Coldcard Mark 3 devices on firmware version 4.0.1 and later, Mark 4 and 5 devices before version 5.6, and Q devices on firmware 1.5 or earlier.
• The vulnerability stems from a core code rewrite in March 2021 that stopped using the device's hardware randomness for seed generation, instead relying on predictable software randomness.

Privacy (2)

• Seth warns that privacy for non-Coldcard users could be damaged if they participated in coinjoins or payjoins with vulnerable Coldcard users, as transaction histories are now traceable.
• For migration, Seth advises moving individual UTXOs one at a time to unique addresses and randomizing timing to preserve privacy, though sweeping all funds is simpler for security-first users.

Education (1)

• Q cautions against scammers and impersonators who will exploit the panic, reminding users to never give out seed words and to only use official channels for support.

Custody (8)

• Rob Hamilton issued an urgent warning for Coldcard MK3, MK4, MK5, and Q users who generated wallets directly from the device without providing their own entropy or a strong passphrase, urging immediate fund recovery.
• For impacted Coldcard users, a sufficiently strong 25th-word passphrase or providing external entropy (e.g., dice rolling) is the only protection against attackers scanning all possible Coldcard seed phrases.
• Danny Knowles confirms that Trezor and Foundation devices are safe because they do not use the same compromised library as Coldcard, indicating a specific, not widespread, self-custody vulnerability.
• Rob Hamilton recommends moving funds to trusted exchanges like River, citing its in-house custody and proof of reserves, or immediately acquiring other hardware wallets like Ledger or BitKey as emergency measures.
• Multi-signature wallets are at risk if a majority of their signers (e.g., two of three) are compromised Coldcard devices without strong passphrases or rolled dice; Unchained, Casa, and AnchorWatch state they are not affected.
• For at-risk multi-sig wallets with un-reused addresses, Rob Hamilton suggests using Mara Slipstream to broadcast transactions directly to a mining pool, which helps prevent replace-by-fee attacks by faster confirmation.
• The Coldcard incident is a 'nuclear event' for Bitcoin self-custody, fundamentally undermining the trust in hardware wallets to generate sufficiently random numbers, a core tenet of Bitcoin security.
• Future improvements for self-custody could include Bitcoin covenants and vault-like structures, enabling on-chain controls like address whitelisting or spending limits for enhanced security.

Safety (3)

• The critical bug, introduced in early 2021 via a firmware change, compromised the entropy generation process, making seed words created by affected Coldcard devices insecure.
• Rob Hamilton clarifies that Coldcard MK1 and MK2 models are not impacted by this specific firmware bug, as they are older hardware and do not receive new firmware updates.
• Rob Hamilton explains that the MK3 has only 2^32 bits of entropy, which is easily brute-forced by consumer hardware, while MK4, MK5, and Q models have 45-50 bits, still vulnerable to GPU data farms.

Coding (1)

• The vulnerability stems from a single line of code that incorrectly skipped secure entropy generation if a function merely existed, rather than evaluating if it was true, a 'nuclear event' for hardware wallet security.

BTC Markets (1)

• Initially, the attack was carried out by an amateur, evident from only targeting addresses with more than 0.15 BTC and failing to scan full addresses; now, multiple sophisticated attackers are involved.

Protocol (1)

• Rob Hamilton estimates over 1100 BTC has been stolen already, with projections of thousands more, as well-capitalized attackers using GPU computing join the effort to exploit the vulnerability.

Custody (8)

• Steve estimates the Coldcard security incident has resulted in over 1,000 BTC stolen, valued between $65 million and potentially $100 million, describing it as the "worst day in Bitcoin's history" due to the impact on self-custody.
• The bug allows attackers to regenerate private keys from on-chain transactions due to weak entropy, without physical device access or seed phrases, by brute-forcing inputs like the CPU timer cycle and unique device ID.
• Steve advises Coldcard users in vulnerable situations to move funds immediately to temporary locations like trusted custodians or wiped, old devices; CoinKite has released new firmware for most products, but not MK3.
• Customers who properly used Coldcard's dice roll feature (e.g., 99-100 rolls) or a strong BIP39 passphrase (128-bit or more) should be safe, but Steve suggests moving funds for peace of mind.
• Steve emphasizes custody diversification as crucial, recommending users split funds between solutions with non-intersecting risks, such as a third-party custodian and a self-custody solution, rather than relying solely on one method.
• White hat hacking to sweep vulnerable funds to a secure system, to be returned to rightful owners, is proposed as a method to mitigate further theft, though the legality and feasibility remain uncertain.
• Multi-signature setups remain a strong self-custody option, but require diversity across keys from different hardware/software vendors to avoid single points of failure, unlike using multiple devices from the same vendor.
• BitKey is a multi-signature product by default, using three keys generated across different hardware and software stacks (Block server, phone, hardware device) to provide diversity, but it lacks independent verifiability for some key generation processes.

Chips (2)

• The Coldcard vulnerability affects MK2 and MK3 hardware with firmware from 2021 to the present, stemming from a compile-time bug that caused the hardware random number generator to fall back to a weak software pseudo-random generator.
• Newer Coldcard models (MK4, MK5, Q) have 32 to 72 bits of cryptographic entropy, which is stronger but still potentially vulnerable to a financially substantial brute-force attack; reports indicate these models have also been exploited.

Models (1)

• Max proposes that for critical software, users need transparency on which top-tier AI models are conducting 24/7 security audits, stating that "all bugs are shallow with enough tokens."

Open Source (1)

• Project Loupe, launched by Spiral, performs AI security scans on open-source Bitcoin repositories, but models produce noise and misclassify severity, necessitating human review and active remediation by project maintainers.

Protocol (1)

• Steve suggests that recovering stolen Bitcoin would require proving original ownership through a combination of unique device IDs, DKIM-signed email receipts from CoinKite (verified for 2023), and KYC/on-chain analysis from exchanges.

Protocol (2)

• Marty Bent argues Bitcoin will emerge as the victor over fiat currencies in a world where central banks actively devalue their money.
• Guest suggests that while auditing RNGs is crucial, the ultimate fix for improved user experience and multisig-level security lies in on-chain covenant technology.

Safety (4)

• A critical vulnerability affects Coldcard hardware wallets, manufactured by CoinKite, produced after 2021, specifically MK2 and MK3 models with firmware between 2021 and 2023.
• The vulnerability stems from an insufficient random number generator (RNG) used for private keys, making them deterministic and severely limiting the search space for recovery.
• Users are secure if they initiated their Coldcard key with over 99 dice rolls or used a sufficiently complex passphrase, which is often longer than users anticipate.
• Current Coldcard devices, including the Q model, are estimated to provide only 70 bits of security during key generation, far below the intended 256 bits.

Custody (7)

• Guest highlights that updating firmware alone does not fix the vulnerability; users must generate a new private key pair and migrate funds to the new address.
• Marty Bent clarifies that MK2 and MK3 models generated after 2021 with default settings might offer as little as 30 bits of entropy, requiring urgent fund migration.
• Guest expresses concern that the Coldcard incident could damage trust in self-custody among Bitcoiners and the broader public, despite best practices like multi-vendor setups.
• Past incidents include Ledger spilling client data multiple times and BitBox having physical defects allowing key exfiltration, underscoring the inherent difficulty of hardware wallet security.
• Multi-signature setups are safe from the Coldcard vulnerability if at least one critical signing key is generated by a non-CoinKite device unaffected by the bug.
• As a temporary measure, individuals with affected Coldcards are advised to move their funds to a trusted exchange, performing small test transactions first to avoid errors.
• A passphrase composed of six BIP39 words is generally not considered strong enough, as the search space for 2048 words multiplied by six is still too small for robust security.

Models (4)

• Marty Bent notes that AI models are becoming sophisticated enough to uncover such security vulnerabilities, with Kimmy K3 reportedly used to discover this Coldcard flaw.
• The hosts caution that the rise of AI is accelerating the erosion of 'security by obscurity,' making all open-source code and historical versions vulnerable to automated analysis.
• Marty Bent asserts that US government intervention in 'model wars' by 'cucking' frontier AI models like Fable 5 and ChatGPT 5.6 hinders crucial security auditing for Bitcoin systems.
• Guest observed that US-based AI models censored or blocked inquiries related to the Coldcard vulnerability, making security investigations more difficult compared to less restricted models.

Philosophy (2)

• Guest quotes Nick Szabo's principle that 'trusted third parties are security holes,' reinforcing the lesson that delegating security fully to a packaged product is risky.
• The hosts debated the ethical implications of 'white hats' using computing resources to sweep vulnerable funds from exposed Coldcards, citing challenges in attributing and returning funds.

Custody (4)

• Block's security research identified vulnerabilities in COLDCARD firmware that could enable Bitcoin theft, stemming from an RNG integration error causing `ngu.random` to default to MicroPython's deterministic Yasmarang fallback.
• COLDCARD Mk2/Mk3 v4.0.0-v4.1.9 firmware versions have no cryptographic entropy added to `ngu.random`, making wallet generation deterministic if the device UID, timer state, and RNG-call history are known.
• For Mk2/Mk3 v4, the maximum enumeration count under normal cold-boot with known UID but unknown SysTick is approximately 2^16.29, making the seed highly vulnerable.
• Current devices like Mk4/Q/Mk5, even with a successful reseed, have a secure-element-derived search space limited to at most 2^32 possibilities when the fallback state and call history are known.

Coding (2)

• The vulnerability arises because the production board configuration defines `MICROPY_HW_ENABLE_RNG` as zero, and `libngu` incorrectly checks if the macro is defined rather than enabled, binding to a deterministic software generator.
• The regression originated from a firmware change on March 1, 2021, which migrated wallet generation to `libngu`, and appeared in released firmware v4.0.0 on March 17, 2021.

Chips (2)

• COLDCARD Mk4/Q/Mk5 devices, using production firmware v5.0.0 onward, incorporate a limited secure-element reseed that hashes 32 bytes to retain only four, replacing just one 32-bit Yasmarang state word.
• The Yasmarang software fallback initializes using the MCU's low 32-bit UID, SysTick counter, and RTC registers, none of which are cryptographic entropy sources, allowing for state reproduction.

Privacy (2)

• An attacker with knowledge or sufficient constraints on device UID, timer state, and RNG-call history can reproduce the fallback stream offline, potentially recovering wallet seeds and private keys.
• The vulnerability affects other functionalities relying on `ngu.random`, including paper-wallet private keys, seed XOR masks, cloning/USB encryption keys, Key Teleport, Web2FA, and Secure Notes passwords.

Safety (1)

• Block and security researchers identified the root cause on July 30, 2026, after user reports of lost funds, leading to the early publication of this advisory due to ongoing active exploitation.