Researchers believe a random number generator flaw in COLDCARD hardware wallet firmware was exploited to steal an estimated $88.6 million in Bitcoin from thousands of affected wallets. Digital asset research firm Galaxy Research identified an initial wave of transactions on July 30 that drained roughly 1,083 BTC (about $70.2 million) from 1,196 addresses in just 41 minutes, approximately 30 hours before Coinkite, the maker of COLDCARD, publicly disclosed the vulnerability.
Every sweep in that first wave used an identical hardcoded fee rate of 30 satoshis per virtual byte, far above the 0.4 to 1.0 sat/vB median at the time, and left no change output. Galaxy Research says this pattern points to an automated tool spending keys the attacker already controlled rather than legitimate owners moving funds. On August 1, Galaxy identified a second and third wave, raising the total to roughly 1,367 BTC (about $88.6 million) stolen from 4,585 addresses. Chainalysis found the attacker prioritized high value wallets, taking about $30 million in the first ten minutes, including $1.8 million from a single victim, suggesting the affected wallets had been identified and studied in advance.
Root cause: RNG fallback
Block’s Bitcoin Engineering and Security teams worked with other researchers to analyze COLDCARD firmware after reports of thefts surfaced. They traced the issue to an integration error causing the device’s ngu.random function to use MicroPython’s deterministic Yasmarang fallback generator instead of the onboard STM32 hardware RNG. The fallback relied on the device’s microcontroller identifier and system timing values, which Block says are not cryptographically secure and may be observable or reconstructable, allowing attackers to generate candidate seeds offline, derive addresses, and match them against the blockchain.
Affected devices and fixes
Coinkite’s advisory lists affected seeds as those generated on Mk2 and Mk3 firmware 4.0.1 through 4.1.9, Mk4 and Mk5 devices before standard version 5.6.0 or Edge version 6.6.0X, and Q devices before standard version 1.5.0Q or Edge version 6.6.0QX. Fixed firmware is available as 4.2.0 or later, 5.6.0 or later, 1.5.0Q or later, and 6.6.0X/6.6.0QX for Edge releases. Updating firmware does not repair a seed generated under the flawed code.
Affected users should verify existing backups, install the fixed firmware, generate a new seed, verify the new address on device, send a small test transaction, and then migrate remaining funds, retaining the old backup until migration is confirmed. Coinkite says seeds supplemented with at least 50 independent dice rolls, or protected with a strong unique BIP-39 passphrase, are less exposed but should still be migrated. TAPSIGNER, OPENDIME, and SATSCARD products use different codebases and are not affected. Coinkite destroyed unshipped devices running the flawed firmware and emailed shipped-device customers with the advisory and migration steps.