On July 30, an attacker exploited a vulnerability in Coldcard hardware wallets, draining 1,196 Bitcoin addresses in just 41 minutes. The theft amounted to 1,082.65 BTC, valued at approximately $70.2 million at the time. This incident has been linked to a firmware flaw in Coldcard devices, which are Bitcoin-only hardware wallets produced by Canadian company Coinkite.
The root of the issue traces back to a firmware integration error from March 2021. Instead of utilizing the STM32 hardware random number generator (RNG) for seed generation, the firmware erroneously routed this process to a deterministic software pseudorandom number generator (PRNG). This misconfiguration compromised the randomness essential for secure seed generation.
According to security analyses, an attacker who can determine or sufficiently constrain the device’s unique identifier (UID), timer state, and prior RNG-call history can reproduce potential output streams offline without direct access to the device. By deriving addresses from these candidate seeds and comparing them with public blockchain data, the attacker can identify and access vulnerable wallets.
In response to the breach, Coinkite released emergency firmware updates for all affected models on July 31. However, updating the firmware alone does not secure existing seeds. Users with exposed seeds are advised to generate new ones using the patched firmware and transfer their funds accordingly. Restoring an old seed to updated firmware or another wallet perpetuates the vulnerability.
The vulnerability affects devices based on the firmware version used during seed creation:
- Mk2 and Mk3: Versions 4.0.0 through 4.1.9 are vulnerable; the issue was fixed in version 4.2.0.
- Mk4 and Mk5: Versions prior to 5.6.0 are affected.
- Q: Versions before 1.5.0Q are vulnerable.
- Edge builds: Versions before 6.6.0X for Mk4 and Mk5, and before 6.6.0QX for Q are affected.
Coinkite notes that a seed generated with at least 50 fair, independent, private dice rolls is not susceptible to this specific flaw. However, if the number or privacy of the rolls is uncertain, users should migrate to a new seed. While a strong, unique BIP-39 passphrase can create a separate wallet inaccessible by the seed words alone, replacing the seed is still recommended. Multisig configurations offer protection only if the quorum isn’t entirely composed of affected devices. Notably, TAPSIGNER, OPENDIME, and SATSCARD products use different codebases and remain unaffected.
As of now, the identity of the attacker remains unknown. The pattern of the 1,196-address sweep suggests a methodical operation, but it doesn’t conclusively identify the perpetrator. This incident underscores the critical importance of robust random number generation in cryptocurrency security. Users are urged to update their firmware promptly and consider generating new seeds to safeguard their assets.
