An attacker swiftly drained 1,196 Bitcoin addresses over 41 minutes on July 30, absconding with 1,082.65 BTC, valued at approximately $70.2 million at the time of the incident. **Galaxy Research** identified the extensive sweep and linked it to a significant firmware vulnerability within **Coldcard**, the Bitcoin-only hardware wallet produced by Canadian firm **Coinkite**. ### The Root of the Vulnerability The exploit stems from a firmware integration error introduced in March 2021. This misstep redirected the seed generation process to a deterministic software pseudorandom number generator (PRNG) rather than the more secure **STM32** hardware random number generator (RNG). According to **Block**, an attacker possessing sufficient information—such as the device's unique ID (UID), timer state, and prior RNG call history—could reconstruct potential output streams offline without direct access to the device. These candidate seeds could then be verified by deriving their associated addresses and cross-referencing them with public blockchain data. ### Coinkite's Response and User Guidance **Coinkite** responded swiftly, releasing emergency firmware updates for all affected **Coldcard** models and release tracks on July 31. However, merely installing the update does not remediate an already exposed seed. **Coinkite** has advised owners with potentially compromised seeds to generate a new seed on patched firmware and transfer their Bitcoin to the new wallet. Crucially, restoring an old, vulnerable seed to updated firmware or another wallet will carry the weakness forward. While no public report has yet confirmed the reconstruction of a victim's seed and its direct linkage to a drained address, the risk remains substantial. ### Technical Deep Dive into the Flaw **Block**'s analysis traced the fault to **Coldcard**'s production configuration, which mistakenly defined `MICROPY_HW_ENABLE_RNG` as zero. This was intended because **Coinkite** uses its own hardware-RNG wrapper. However, the `libngu` library incorrectly checked for the macro's existence rather than its enabled state, forcing the build to default to MicroPython's **Yasmarang** fallback PRNG. This fallback was initialized solely from the chip's unique ID and timer registers, failing to collect any fresh entropy after its initial setup. **Coinkite** estimates the effective entropy for the **Mk3** model at approximately 40 bits, and around 72 bits for the **Mk4**, **Mk5**, and **Q** models. This is significantly lower than the 128 bits typically expected for a 12-word **BIP-39** seed. **Block** provides conditional ceilings below 240.7 and 273.3 bits, cautioning that the latter does not equate to 73-bit cryptographic security, and did not publish a brute-force benchmark.   ### Identifying Affected Devices Exposure to this vulnerability depends on the firmware version active when the seed was initially generated, not the version currently installed: * **Mk2 and Mk3:** **Coinkite** lists **Mk3** versions 4.0.1 through 4.1.9 as vulnerable, fixed in 4.2.0. **Block** extends this to both **Mk2** and **Mk3** versions 4.0.0 through 4.1.9. * **Mk4 and Mk5:** Any version prior to 5.6.0. * **Q:** Any version prior to 1.5.0Q. * **Edge builds:** Prior to 6.6.0X for **Mk4** and **Mk5**, and prior to 6.6.0QX for **Q**. **Coinkite** advises that seeds generated with at least 50 fair, independent, and private dice rolls are not at risk from this specific bug. If the quantity or privacy of these rolls is uncertain, migration is recommended. While a strong, unique **BIP-39** passphrase creates a separate wallet inaccessible by the seed words alone, the company still advocates for replacing the seed entirely. Multi-signature (multisig) setups offer protection only if the quorum is not exclusively composed of affected devices. Other **Coinkite** products, including **TAPSIGNER**, **OPENDIME**, and **SATSCARD**, utilize different codebases and are not impacted by this flaw. ### Attacker Profile and Broader Context The identity of the attacker remains unknown. **Galaxy Research**, which meticulously mapped the 1,196-address sweep, noted no other Bitcoin transactions in the preceding 30 days exhibiting the same 30 sat/vB, no-change signature pattern. This pattern, however, identifies the operator's activity rather than the theft itself, as a large sweep could also represent a legitimate owner consolidating funds. This disclosure follows closely on the heels of **Coinspect**'s **Ill Bloom** research earlier in July. That separate report detailed a weak-PRNG flaw in older software wallets, which has been linked to over $5 million drained from addresses across Bitcoin, Ethereum, Tron, Rootstock, and Polygon since May. These incidents underscore the critical importance of robust entropy sources in cryptographic systems, particularly in the realm of digital asset security.