COLDCARD Wallet Flaw Suspected in $88.6M Bitcoin Theft
COLDCARD Wallet RNG Flaw Linked to $88.6 Million Bitcoin Theft
Impact Scope
People Affected
4,585 wallet addresses
Industries Affected
MITRE ATT&CK Techniques
Full Report
Executive Summary
An estimated $88.6 million worth of Bitcoin has been stolen from 4,585 wallet addresses, with the theft strongly linked to a critical firmware vulnerability in COLDCARD hardware wallets. The flaw, an integration error in the device's random number generation (RNG) process, was introduced in 2021. It caused affected wallets to generate recovery seeds using a weak, deterministic software-based pseudorandom number generator (PRNG) instead of the intended secure hardware RNG. This significantly reduced the seed's entropy, making it possible for attackers to predict and reconstruct the private keys offline. The largest theft, a $70.2 million sweep, occurred just 30 hours before the manufacturer, Coinkite, publicly disclosed the bug. Users who created wallets on affected devices are at extreme risk and must take immediate action to secure their funds.
Vulnerability Details
The core of the vulnerability was a coding error that affected the generation of wallet recovery seeds. Instead of using the secure STM32 hardware-based RNG, the firmware defaulted to a PRNG known as Yasmarang. This software-based generator is not cryptographically secure and produces a predictable sequence of numbers.
- Affected Devices: Potentially includes COLDCARD Mk2, Mk3, Mk4, and Q models.
- Vulnerable Action: Creating a new wallet seed on a device with the flawed firmware.
- Attack Vector: The attack is performed offline. An attacker can generate a large list of weak seeds produced by the flawed PRNG and then scan the Bitcoin blockchain to find addresses that match these predictable seeds and contain funds.
Once a match is found, the attacker can reconstruct the private key and has full control to "sweep" or transfer the funds to their own wallet. This explains the automated, large-scale nature of the theft.
Exploitation Status
The vulnerability was actively and successfully exploited on a massive scale. Digital asset research firm Galaxy Research tracked the on-chain activity, identifying three major waves of theft:
- Initial Wave (July 30, 2026): A 41-minute automated sweep drained 1,082.65 BTC (worth $70.2 million) from 1,196 addresses.
- Subsequent Waves: Two more sweeps brought the total stolen funds to 1,367.05 BTC (worth $88.6 million) from 4,585 addresses.
The timing of the largest attack, just before public disclosure, suggests the attacker may have independently discovered the flaw or learned of it through non-public channels. The attacker's tools appeared to prioritize wallets with the highest balances first.
Impact Assessment
This incident has a severe impact on the victims and the broader cryptocurrency community.
- Direct Financial Loss: Victims have lost a combined total of nearly $89 million in assets, with little to no chance of recovery.
- Erosion of Trust in Hardware Wallets: Hardware wallets are considered the gold standard for secure cryptocurrency storage. A vulnerability of this magnitude in a popular and respected brand like COLDCARD undermines user confidence in the entire product category.
- Systemic Risk: The flaw highlights the critical importance of secure random number generation in all cryptographic applications. A single point of failure in this process can render an entire security system useless.
This is a catastrophic failure of a core security promise. Simply updating the firmware is not a fix for affected users. The original sin was the creation of a weak seed, and any funds associated with that seed remain vulnerable forever until moved.
IOCs — Directly from Articles
No specific attacker-controlled wallet addresses or other indicators were provided in the source articles.
Cyber Observables — Hunting Hints
For security researchers analyzing this event, the primary observables are on the blockchain itself:
otherotherotherDetection Methods
For users, detection is about determining if their wallet was created with the flawed firmware.
- Check Firmware Version and Creation Date: Users should check the firmware version of their COLDCARD and the date they created their wallet seed. Coinkite's advisory provides the specific range of vulnerable firmware versions.
- Use a Verification Tool: If available, a trusted third-party or manufacturer-provided tool could be used to check if a user's public address falls within the set of predictable addresses generated by the weak PRNG. This should be done with extreme caution to avoid phishing scams.
Remediation Steps
Updating the firmware alone is NOT sufficient. The recovery seed itself is compromised.
- Generate a New Seed: The absolute first step is to obtain a COLDCARD with patched firmware (or another trusted hardware wallet) and generate a completely new, secure recovery seed.
- Transfer All Funds: Immediately create new addresses from the new, secure seed and transfer all Bitcoin and other assets from the old, compromised addresses to the new ones. This transaction will be public on the blockchain.
- Prioritize High-Value Wallets: Since the attacker's tools targeted high-value wallets first, users with significant holdings should act with extreme urgency.
- Abandon the Old Seed: Never use the old, compromised recovery seed or any of its associated private keys again. It must be considered permanently insecure.
Timeline of Events
MITRE ATT&CK Mitigations
Update Software
While not a complete fix, updating the firmware is a necessary first step to ensure a new, secure seed can be generated.
User Training
Educating users on the critical remediation steps (generating a new seed and moving funds) is paramount to preventing further losses.
D3FEND Defensive Countermeasures
The immediate first step for any COLDCARD owner is to update their device's firmware to a patched version as specified by Coinkite. This action is crucial because it corrects the random number generation process, ensuring that any new wallets created will use the secure hardware-based RNG. However, it is critical to understand that this action alone does not protect any funds associated with a previously generated weak seed. The firmware update is a prerequisite for the actual remediation, which is creating a new, secure wallet. Users must verify the authenticity of the firmware update from the official Coinkite source to avoid installing malicious firmware.
This is a developer-centric recommendation for hardware wallet manufacturers. The core vulnerability stemmed from a faulty RNG. Wallet firmware should include self-tests and health checks for critical cryptographic components like the RNG. Before generating a seed, the device should verify that it is drawing from a high-entropy source. If the hardware RNG fails or is unavailable, the device should fail-safe and refuse to generate a seed, rather than fail-open to a weak software PRNG. This involves implementing robust error handling and status checking around the HAL_RNG_GenerateRandomNumber() function or its equivalent. This defensive programming practice, a form of application hardening, would have prevented this entire class of vulnerability.
Timeline of Events
The faulty RNG integration was introduced into COLDCARD firmware.
The largest wave of theft occurs, with attackers sweeping over $70 million in Bitcoin in 41 minutes.
Coinkite, the manufacturer of COLDCARD, publicly discloses the vulnerability, approximately 30 hours after the main attack.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.