Coldcard Bitcoin Exploit: $130M Stolen via Randomness Flaw
In brief
- Coldcard vulnerability enabled theft of 2,055 BTC ($130M) across multiple attack waves via weak seed generation.
- 2021 firmware migration disabled hardware entropy checks, leaving key generation dependent on predictable serial numbers and clock values.
- Mk2 and Mk3 devices had only 40-bit search space; attackers brute-forced keys on laptops in hours.
- At least 15 attackers exploited the flaw; one moved $70M in 41 minutes.
- Coinkite released patched firmware, but existing seeds cannot be recovered—users must migrate funds.
The Entropy Breakdown
Galaxy Research has tracked more than 1,596 BTC stolen across three confirmed waves, with a suspected fourth wave that would lift the total to roughly 2,055 BTC—about $130 million at current prices. One sweep moved $70 million in 41 minutes. Coinkite says at least 15 separate attackers have piled in.
The root cause lies in how randomness is generated. In 2021, Coinkite moved Coldcard's cryptography onto libsecp256k1, the same library Bitcoin Core uses. But the migration quietly rerouted seed generation away from Coldcard's hardware random number generator and onto MicroPython's software fallback called Yasmarang.
A build guard was supposed to catch this. A build guard used #ifndef, which checks whether a setting exists rather than whether it's switched on. Coinkite had defined that setting as zero, meaning "off." Because zero still counts as defined, the safety check passed—despite the randomness chip not being used.
Why 40 Bits Matters
On Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, that starting value came from the chip's serial number and clock. Coinkite estimates the resulting search space at about 40 bits. Forty bits is about a trillion—a number a decent laptop can chew through.
Newer models mixed in a little secure-element entropy, lifting them to roughly 72 bits. But even that fell short. Block's engineering team, which published its own analysis, put the newer devices' effective secure-element search space at 2^32 candidates.
The vulnerability was deterministic. For a known device ID, timer state and call history, wallet generation is deterministic. Once an attacker knew those values—often available through public blockchain analysis—brute-forcing the private key became feasible.
The AI Question
Coinkite suspects the vulnerability was found using AI to review previous versions of firmware. The company's statement: "We have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue."
Fixed firmware is out for every affected model. But here's the hard part: It does not repair existing seeds; those wallets have to be regenerated and the funds moved. Anyone holding Bitcoin on a Coldcard should assume their keys are compromised if they haven't already upgraded and migrated their holdings.
