Coldcard’s $70 Million Bitcoin Heist: Unpacking the Firmware Flaw That Rocked Crypto Security

In a stunning display of digital vulnerability, an attacker managed to drain 1,196 Bitcoin addresses, seizing approximately 1,082.65 BTC — valued at roughly $70.2 million at the time — in a mere 41 minutes on July 30. This rapid-fire heist has been meticulously traced by Galaxy Research to a critical firmware flaw within Coldcard, the highly regarded Bitcoin-only hardware wallet manufactured by Canadian firm Coinkite.

The Root of the Vulnerability: A PRNG Predicament

The core of the problem lies in a firmware integration error introduced in March 2021. Instead of leveraging the robust STM32 hardware random number generator (RNG) for seed generation, the system inadvertently defaulted to a deterministic software pseudorandom number generator (PRNG). This seemingly minor misstep created a gaping security hole.

How the Flaw Was Exploitable

According to Block, an attacker possessing sufficient information — specifically, the device’s unique ID (UID), timer state, and a history of prior RNG calls — could offline reproduce candidate output streams without ever needing physical access to the device. These candidate seeds could then be cross-referenced with public blockchain data by deriving their associated addresses, effectively identifying and targeting vulnerable wallets.

The fault was traced to Coldcard’s production configuration, where the `MICROPY_HW_ENABLE_RNG` macro was defined as zero. This was intended because Coinkite supplies its own hardware-RNG wrapper. However, the `libngu` library mistakenly checked for the macro’s *existence* rather than its *enabled state*, binding the build to MicroPython’s less secure Yasmarang fallback. This fallback, initialized only from the chip’s unique ID and timer registers, failed to collect fresh entropy after its initial setup, severely compromising the randomness of generated seeds.

Quantifying the Risk: Reduced Entropy

Coinkite has estimated the effective entropy of the affected seeds to be significantly lower than cryptographic standards. For the Mk3, it was roughly 40 bits, and for the Mk4, Mk5, and Q models, approximately 72 bits. This stands in stark contrast to the 128 bits expected for a standard 12-word BIP-39 seed. While Block did not provide a single practical figure, it set conditional ceilings well below secure levels, warning that even 73 bits is not equivalent to strong cryptographic security.

Coinkite’s Swift Response and User Directives

In the wake of the discovery, Coinkite acted swiftly, shipping emergency firmware for all affected models and release tracks on July 31. However, merely installing this update does not rectify an already exposed seed. The company has issued a critical directive: owners with potentially compromised seeds must generate a *new* seed on patched firmware and promptly transfer their funds. Crucially, restoring an old, vulnerable seed to updated firmware or any other wallet will carry the inherent weakness forward.

Identifying Vulnerable Firmware Versions

The exposure hinges on the firmware version running when the seed was *created*, not the version currently installed. Users should check their historical firmware:

• Mk2 and Mk3: Versions 4.0.0 through 4.1.9 are vulnerable. Coinkite specifically lists Mk3 versions 4.0.1 through 4.1.9, fixed in 4.2.0.
• Mk4 and Mk5: Any version prior to 5.6.0.
• Q: Any version prior to 1.5.0Q.
• Edge builds: Before 6.6.0X for Mk4 and Mk5, and before 6.6.0QX for Q.

Coinkite reassures users that a seed generated with at least 50 fair, independent, and private dice rolls is not susceptible to this specific bug. However, if there’s any uncertainty regarding the number or privacy of these rolls, migration is strongly advised.

Mitigation Strategies and Unaffected Products

While a strong, unique BIP-39 passphrase can create a separate wallet inaccessible by the seed words alone, Coinkite still recommends replacing the seed entirely as the safest course of action. Multisignature (multisig) setups offer protection only if the quorum is not entirely composed of affected devices.

It’s important to note that other Coinkite products like TAPSIGNER, OPENDIME, and SATSCARD utilize distinct codebases and remain unaffected by this particular vulnerability.

The Attacker Remains Anonymous

As of now, the identity of the attacker behind this sophisticated sweep remains unknown. Galaxy Research, which meticulously mapped the 1,196-address sweep, observed a unique transaction pattern (30 sat/vB, no-change signature) that was not present in other Bitcoin transactions over the preceding 30 days. However, they cautioned that this pattern identifies the operator, not necessarily the theft, as a large sweep could also be a legitimate consolidation of funds by an owner.

This incident follows closely on the heels of Coinspect’s ‘Ill Bloom’ research in early July, which uncovered a separate weak-PRNG flaw in older software wallets. That vulnerability has been linked to over $5 million drained from addresses across various blockchains, including Bitcoin, Ethereum, Tron, Rootstock, and Polygon, since May. These events serve as a stark reminder of the continuous and evolving threats in the cryptocurrency landscape, underscoring the paramount importance of robust security practices and vigilant user awareness.

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

For more details, visit our website.

Source: Link