The Frontier

Block's security research identified vulnerabilities in COLDCARD firmware that could enable Bitcoin theft, stemming from an RNG integration error causing `ngu.random` to default to MicroPython's deterministic Yasmarang fallback.

The vulnerability arises because the production board configuration defines `MICROPY_HW_ENABLE_RNG` as zero, and `libngu` incorrectly checks if the macro is defined rather than enabled, binding to a deterministic software generator.

COLDCARD Mk2/Mk3 v4.0.0-v4.1.9 firmware versions have no cryptographic entropy added to `ngu.random`, making wallet generation deterministic if the device UID, timer state, and RNG-call history are known.

COLDCARD Mk4/Q/Mk5 devices, using production firmware v5.0.0 onward, incorporate a limited secure-element reseed that hashes 32 bytes to retain only four, replacing just one 32-bit Yasmarang state word.

The Yasmarang software fallback initializes using the MCU's low 32-bit UID, SysTick counter, and RTC registers, none of which are cryptographic entropy sources, allowing for state reproduction.

An attacker with knowledge or sufficient constraints on device UID, timer state, and RNG-call history can reproduce the fallback stream offline, potentially recovering wallet seeds and private keys.

For Mk2/Mk3 v4, the maximum enumeration count under normal cold-boot with known UID but unknown SysTick is approximately 2^16.29, making the seed highly vulnerable.

Current devices like Mk4/Q/Mk5, even with a successful reseed, have a secure-element-derived search space limited to at most 2^32 possibilities when the fallback state and call history are known.

The vulnerability affects other functionalities relying on `ngu.random`, including paper-wallet private keys, seed XOR masks, cloning/USB encryption keys, Key Teleport, Web2FA, and Secure Notes passwords.

The regression originated from a firmware change on March 1, 2021, which migrated wallet generation to `libngu`, and appeared in released firmware v4.0.0 on March 17, 2021.

Block and security researchers identified the root cause on July 30, 2026, after user reports of lost funds, leading to the early publication of this advisory due to ongoing active exploitation.