## Coldcard RNG Flaw: Attack Waves to Date
A March 2021 commit moved seed generation from `ckcc.rng_bytes()` to `ngu.random.bytes()`. Libngu's guard used `#ifndef` on `MICROPY_HW_ENABLE_RNG` (which Coinkite had defined as zero), so the build silently bound to MicroPython's Yasmarang PRNG, seeded from the MCU UID and timer registers. No device was ever touched; keys were enumerated offline and matched against the chain.
Effective search space: ~40 bits on Mk2/Mk3, ~72 bits on Mk4/Mk5/Q, against a 128-bit target.
| Wave | Window (UTC) | BTC | Addresses | Fingerprint |
|---|---|---|---|---|
| 1 | Jul 30, 01:10–01:51 | 1,082.65 | 1,195 | 30 sat/vB flat fee, no change outputs |
| 2 | Jul 31 | 76.16 | 1,478 | Same as Wave 1 |
| 3 | Jul 31 → Aug 1 | ~208 | 1,912 | 293 P2WSH vaults, per-victim outputs, default derivation only |
| **Total** | | **~1,367** | **4,585** | ~$88.6M |
Waves 1–2 share a signature: one operator or one toolkit. Wave 3 breaks it: separate vaults, harder to cluster, working down-market into wallets worth a few thousand. Galaxy can't say from chain data alone whether that's the same actor retooling or a second one on the same weak-seed pool. Nothing has moved; ~300 attacker addresses are being watched.
Wave 1 detail: victims split 1,183 native segwit (BIP-84), 7 BIP-49, 6 BIP-44, consistent with multi-path key scanning. The 30 sat/vB fee was a 30–75x overpay against that week's 0.4–1.0 sat/vB median. The event spans six blocks, with three intervening blocks showing no sweep activity, suggesting batched broadcasts rather than a stream. Top collectors: bc1qq85v2c9…cu9r (562.02 BTC), bc1qx76cae2…fhe3 (398.48), bc1q8jy96fe…tp3q (89.62), bc1qnk4zh9q…fecp0 (32.45).
**Affected (per Coinkite, updated Aug 1):** Mk2/Mk3 4.0.1–4.1.9 · Mk4/Mk5 before 5.6.0 (Edge before 6.6.0X) · Q before 1.5.0Q (Edge before 6.6.0QX). Tapsigner, Opendime, Satscard use different codebases and are unaffected.
**Fixed firmware:** 4.2.0 (Mk2/Mk3) · 5.6.0 (Mk4/Mk5) · 1.5.0Q (Q) · 6.6.0X / 6.6.0QX (Edge). Standard and Edge are separate tracks. A higher Edge 6.x number does not mean fixed.
**Firmware updates do not repair an existing seed.** A weak seed stays weak in any device. The attacker searches the seed pool, not the hardware. Generate fresh on patched firmware, verify fingerprint, send a test tx, then migrate. Don't rush it: a botched migration is a bigger risk than the bug.
50+ fair, independent, private dice rolls at creation = not at risk from this alone. Strong unique BIP-39 passphrase = reduced exposure, migrate anyway. Device PIN ≠ passphrase. Multisig built entirely from affected devices is still affected.
Galaxy's analysis is preliminary and based solely on public chain data. Figures still climbing.
### Sources
- Coinkite advisory: 
- Coinkite technical backgrounder: 
- Block Engineering root-cause analysis: 
- Firmware downloads: 
- LLFOURN attack-cost model (linked by Coinkite): 
- Galaxy Research, Wave 1 flow-of-funds: 
- Galaxy Research, Waves 2 and 3 (same thread, Aug 1): 
COINKITE Blog
Coldcard Security Advisory
Funds from affected COLDCARD seeds are at risk if the seed lacks 50 independent, private dice rolls and the wallet lacks a strong, unique BIP-39 pa...
COINKITE Blog
Technical Deep Dive into the Entropy Issue
Technical Deep Dive into the Entropy Issue
Block Engineering Blog
Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware
How a disabled hardware-RNG path and 32-bit reseed constrain entropy in affected COLDCARD firmware and expose generated secrets.
COLDCARD Documentation
Upgrade Firmware
Download, verify, install, and confirm current COLDCARD firmware.
X (formerly Twitter)
Zero-Knowledge Goof❄️ (@LLFOURN) on X
MK4s are vulenerable but are millions of times harder to steal from. MK3s can be stolen from a decent laptop, mk4,5s and Q would need much more com...
X (formerly Twitter)
Galaxy Research (@glxyresearch) on X
We mapped the flow of funds for the Coldcard vulnerability based on the pattern identified by engineers at Block and shared by @clay_garrett
1,19...
X (formerly Twitter)
Galaxy Research (@glxyresearch) on X
$GLXY | Newsletter https://t.co/gS6b9XUHVt | Podcast https://t.co/hsBUlryJiw | Reports https://t.co/l3rGJmoE8y Disclaimer: https://t.co/dZG0gOY8I6
