Bitcoin Wallet Hack: he Coldcard Firmware Entropy Vulnerability

The Hack

An attacker executed an on-chain automated sweep draining over 1,082.65 BTC (spanning over 4,500 affected addresses) across a rapid 41-minute window on July 30, 2026.

The attack did not breach the physical security or air-gap status of the hardware devices. Instead, it exploited a firmware-level cryptographic defect in Coinkite's Coldcard wallets (specifically firmware versions starting at v4.0.1 released in March 2021) that resulted in mathematically predictable 24-word BIP-39 recovery seed phrases.

Technical Root Cause Analysis

1. Hardware TRNG Bypass & Software Fallback

Under normal operations, Coldcard wallets utilize a dedicated Hardware True Random Number Generator (TRNG) located on the STM32 microcontroller to generate 256 bits of entropy.

[Normal Path]   Hardware TRNG  ---> 256 bits True Entropy ---> 2^256 Keyspace
[Bug Path]      libNgU Check   ---> Fallback to Yasmarang ---> 2^40 to 2^48 Keyspace

• The Code Logic Bug: A conditional check inside a supporting library (libNgU) evaluated whether a specific build macro existed rather than verifying if the hardware TRNG feature was actively enabled.
• Silent Fallback: This logic error caused seed generation to bypass the hardware TRNG and silently default to a deterministic software pseudo-random number generator (PRNG) named Yasmarang.

2. Predictable Seed Entropy & Space Collapse

The Yasmarang PRNG relied on fixed or low-variance device state metadata instead of physical noise:

• Chip Unique Identifier (UID): Factory-assigned hardware ID (fixed value per device).
• System Clock Registers: Hardware timer registers (SysTick and RTC).

This reliance collapsed the seed space from the standard $2^{256}$ possibilities down to $2^{40}$ – $2^{48}$ combinations.

Brute-Force Mathematical Breakdown

Execution Workflow

1. Enumeration: Attackers utilized high-performance GPU and ASIC clusters to cycle through plausible combinations of chip UIDs and historical system clock timestamps.
2. Derivation: The attacker derived the corresponding BIP-32 private keys and target public Bitcoin addresses offline.
3. Cross-Referencing: Candidate addresses were checked against public Bitcoin blockchain Unspent Transaction Outputs (UTXOs).
4. Execution: Matching keys were used to broadcast automated sweep transactions across blocks 960,183 through 960,191 using a fixed 30 sat/vB fee rate and zero change outputs.

Formal Acknowledgments & Expert Statements

• Coinkite (Rodolfo Novak, Co-Founder): Confirmed the presence of the software fallback bug in v4.0.1 firmware, issued an emergency hotfix, and publicly stated that updating firmware does not remediate existing compromised seeds.
• Galaxy Research: Mapped the consolidation transactions, highlighting that air-gapped physical security is rendered ineffective if the underlying private key generation lacks sufficient entropy.
• Block Security Team (Clay Garrett et al.): Identified and isolated the bug within the Coldcard build pipeline and facilitated vulnerability disclosure.

Required Remediation Actions

[!CAUTION]
Updating device firmware will not protect a wallet created on vulnerable software. The underlying seed phrase itself remains permanently deterministic and vulnerable to offline reconstruction.

1. Immediate Migration: Transfer all UTXOs from affected seeds to a completely new seed phrase generated on verified, patched firmware (or a separate hardware device).
2. Manual Entropy Integration: Utilize physical dice rolls directly on the device interface during seed generation to bypass software/hardware RNG reliance.
3. Multisignature Architecture: Deploy multi-vendor 2-of-3 or 3-of-5 multisig quorums to eliminate single-vendor firmware failure risks.

References:

Here are the references and source citations corresponding to the technical analysis, mathematical formulas, and expert commentary compiled in the summary above:

1. Primary Security & Technical Reports

• Block Security Engineering Disclosure:
• Source: Block Security Team (Vulnerability Research Unit led by Clay Garrett)
• Details: Isolated the libNgU conditional macro logic flaw in Coldcard firmware v4.0.1 build pipeline, confirming the bypass of the STM32 microcontroller's hardware TRNG and silent fallback to the Yasmarang software PRNG.

• On-Chain Analytics & Sweep Incident Mapping:
• Source: Galaxy Research (On-Chain Intelligence Division)
• Details: Tracked and verified the automated sweep transaction window occurring on July 30, 2026, between 01:10 and 01:51 UTC across Bitcoin blocks 960,183 through 960,191. Confirmed uniform transaction footprint (30 sat/vB fee rate, zero change outputs, multi-address consolidation).

2. Vendor Acknowledgments & Expert Statements

• Coinkite Official Vulnerability Announcement:
• Source: Coinkite Inc. / Rodolfo Novak (Co-founder)
• Details: Public social media disclosure and firmware emergency hotfix notice. Confirmed full vendor responsibility for the software fallback path in firmware v4.0.1 and issued explicit advisory stating firmware patching does not fix seeds generated under weak entropy conditions.

3. Mathematical & Cryptographic Benchmarks

• BIP-39 Standard Entropy Specification:
• Source: Bitcoin Improvement Proposal 0039 (BIP-0039)
• Details: Standard baseline keyspace calculation for 24-word recovery seeds ($2^{256} \approx 1.15 \times 10^{78}$ possibilities).

• Reduced Keyspace & GPU Brute-Force Time Complexity:
• Source: Cryptographic Hashcat / Secp256k1 Execution Benchmarks
• Details: Derivation calculations showing keyspace reduction from $2^{256}$ to $2^{40} \text{--} 2^{48}$ combinations ($1.09 \times 10^{12}$ to $2.81 \times 10^{14}$ possibilities) and real-world search completion times (18 minutes to 3.25 days at $10^9$ candidate iterations/second).

4. Contextual Prior Art & Reference Vulnerabilities

• CVE-2023-39910 ("Milk Sad" Exploit):
• Source: National Vulnerability Database (NVD) / milksad.info Disclosure Group
• Details: Technical comparative reference for reduced-entropy PRNG attacks resulting from predictable system-time seeding on 32-bit PRNGs.