Coldcard hardware wallets shipped with firmware that generated Bitcoin recovery phrases with severely reduced entropy, potentially exposing funds to brute-force attacks. The vulnerability stemmed from a March 1, 2021 code change that moved seed generation into a new library, but the production firmware disabled the device’s random-number generator, causing the system to fall back to a deterministic algorithm instead.

The affected firmware versions span multiple Coldcard models. On Mk2 and Mk3 devices, the flaw reduced effective entropy to just 40 bits, making seed recovery computationally feasible. Mk4, Mk5, and Q models were affected with 72 bits of effective entropy. The vulnerable versions include Mk2/Mk3 firmware 4.0.1 through 4.1.9, Mk4/Mk5 firmware before standard 5.6.0 or Edge 6.6.0X, and Q firmware before standard 1.5.0Q or Edge 6.6.0QX.

Security firm Block identified an additional constraint: later devices faced a maximum of 2^32 securely distinguished streams under fixed conditions, further limiting the randomness pool.

Estimated Losses Mount

Galaxy Research estimated on August 2 that suspected losses across 4,585 addresses reached 1,367.05 BTC, though the firm described the total as evolving with no finalized incident figure. Bitcoin Optech reported an evolving estimate above 1,000 BTC as of July 31. Following the disclosure, 77,402 BTC moved from older UTXO bands, a figure that includes both suspected theft and precautionary migration by users securing their funds.

On July 29, X user Graham_Quantum posted that 18.25245043 BTC had left wallets, though transaction linkage and Coldcard causation for that movement remain unverified.

The Root Cause

The vulnerability originated when Coinkite integrated seed generation into a new library on March 1, 2021. Production firmware set MICROPY_HW_ENABLE_RNG to zero, disabling the hardware random-number generator. The code checked only whether the setting existed, not its value, routing generation to MicroPython’s deterministic Yasmarang fallback instead of the intended entropy source.

Coinkite and Block provide conflicting accounts of when the vulnerable path began. Coinkite lists affected Mk2/Mk3 versions as 4.0.1 through 4.1.9, while Block identifies the vulnerable path as beginning in 4.0.0. The firmware shipped on March 17, 2021.

Mitigation and Precedent

Coinkite states that migration may be unnecessary only when users can establish that the final seed incorporated at least 50 fair, independent, and private dice rolls. Coldcard’s documentation calculates 2.585 bits of entropy per fair six-sided die roll, meaning 50 rolls yield approximately 129.25 bits of entropy, targeting 128-bit security. For 256-bit security, approximately 99 rolls would generate 255.91 bits of entropy.

Similar weak-randomness vulnerabilities have surfaced in other wallet software. Trust Wallet browser-extension versions 0.0.172 through 0.0.182 used a 32-bit Mersenne Twister seed, creating 4 billion possible starting values. Libbitcoin Explorer 3.x used a time-seeded 32-bit Mersenne Twister in its bx seed command, and researchers identified 2,600 actively used Bitcoin wallets within affected entropy ranges. That incident resulted in an estimated $900,000 theft across multiple chains at August 2023 prices, with 2,550 wallets sharing an automated pattern.

“Anyone who used an affected version should check the advisory and create an entirely new seed with fixed software and trustworthy entropy when the private-dice exception cannot be established,” according to security guidance on the incident.