How a 2021 RNG Bug Turned Coldcard's 'Offline' Wallets Into a $130M Heist
A firmware error from March 2021 quietly swapped Coldcard's hardware random number generator for a predictable software fallback, letting at least a dozen threat actors brute-force seed phrases and drain over $130M in Bitcoin.
Key Takeaways
- A 2021 firmware bug routed Coldcard seed generation to a deterministic software PRNG instead of the STM32 hardware RNG, cutting effective entropy to roughly 40-72 bits against the 128 bits BIP-39 requires.
- Attackers didn't breach the offline devices — they reverse-engineered the flawed generation logic and computed candidate seeds independently, then swept matching wallets.
- Losses passed $130M across at least a dozen separate threat actors, with one wave draining roughly $70M in 41 minutes, per Block and Galaxy Research analysis.
- Firmware patches alone don't fix already-exposed wallets — Coinkite is telling affected users to generate fresh seeds and migrate funds, and a phishing campaign is now exploiting the panic.
Coldcard hardware wallets, made by Coinkite, are marketed on a simple premise: keys generated and stored on an air-gapped device can't be remotely compromised. That premise held for the network layer. It didn't hold for the random number generator. A firmware integration error dating to March 2021 caused affected builds to derive wallet seeds from a deterministic software fallback instead of the device's dedicated hardware RNG — and once researchers at Block worked out the pattern, several groups of attackers used it to computationally regenerate victims' private keys and drain their coins, entirely without touching the devices themselves.
The root cause: a fallback nobody meant to ship
According to Block's technical writeup, the libngu library checked whether a macro (MICROPY_HW_ENABLE_RNG) simply *existed* rather than whether it was *enabled*. That logic error bound affected builds to MicroPython's Yasmarang fallback generator, which was seeded only from the chip's unique ID and timer registers — with no fresh entropy collected afterward. Coinkite's own post-incident estimate put effective entropy at roughly 40 bits on Mk3 devices and 72 bits on Mk4/Mk5/Q, against the 128 bits a proper 12-word BIP-39 seed requires. That gap is the entire vulnerability: a keyspace small enough for well-resourced attackers to search.
Exploitation didn't need the device online
This is the detail that matters for anyone relying on 'air-gapped' as a security boundary: the offline design didn't blunt the attack at all. The flaw is in how the seed was *generated*, not in how it's stored or transmitted, so attackers could brute-force the reduced keyspace on their own infrastructure and simply check the resulting addresses for balances. Per Block and Galaxy Research, thefts began on July 30, 2026, with one wave draining 1,196 addresses — about 1,082.65 BTC (~$70.2M) — in 41 minutes. Coinkite shipped emergency firmware the next day. As reported waves accumulated, TechCrunch put total exposure above $130 million across roughly a dozen distinct hacker groups, with affected firmware spanning Mk2/Mk3 builds 4.0.0–4.1.9, Mk4/Mk5 before 5.6.0, and Q before 1.5.0Q.
A patch doesn't undo an exposed seed
Coinkite's advisory is explicit that updating firmware protects future seed generation but does nothing for a seed already computed under the flawed logic — that private key is permanently weakened and must be treated as burned. The company is telling affected users to generate an entirely new seed on patched firmware and migrate funds, and it flagged a few exceptions: seeds created from at least 50 fair, independent dice rolls were never dependent on the onboard RNG and are unaffected, and a strong BIP-39 passphrase creates a functionally separate wallet — though Coinkite still recommends a full reseed. Multisig setups are only protected if the signing quorum isn't drawn entirely from affected devices.
The incident spawned its own phishing wave
As is now routine after a high-profile disclosure, opportunistic attackers moved fast. Decrypt reported a coordinated campaign using spoofed Coldcard emails referencing a "coordinated hardware audit," a cloned Coinkite website with a "Start Hardware Audit" button, and a GitHub-hosted batch file that installs the ScreenConnect remote-access tool — reportedly backed by live chat operators walking victims through the install. Competing vendors Trezor and Foundation both issued warnings reiterating that no legitimate wallet maker will ever ask for a recovery phrase or ask a user to install remote-access software.
The practitioner takeaway
This is a supply-chain-style firmware bug hiding behind a conditional-compilation error, not a cryptographic break — and it's a reminder that entropy source verification deserves the same audit rigor as the crypto primitives built on top of it. "Offline" and "hardware-backed" are properties of the threat model for network attacks; they say nothing about whether the RNG underneath was ever doing its job. Anyone holding funds on a Coldcard device should check Coinkite's advisory against their firmware version immediately, and treat any seed generated before the fix as compromised regardless of whether funds have moved yet.
Frequently Asked Questions
Were Coldcard devices hacked remotely?
No. The devices themselves were never breached or connected to attacker infrastructure. Attackers exploited a firmware flaw that made seed generation predictable, then independently computed candidate private keys and checked them against the blockchain for funds.
Does updating Coldcard firmware protect my existing funds?
Only for wallets not yet created. Coinkite's advisory states that patching stops future weak-seed generation, but any seed already produced under the flawed firmware is considered permanently exposed and should be migrated to a newly generated seed on patched firmware.
How can I tell if my seed was affected?
Check your device model and firmware version against Coinkite's published advisory. Seeds generated from at least 50 fair, independent dice rolls rather than the onboard generator were not affected by the flaw.