Coldcard RNG Flaw Risks 1,367 BTC: Why Hardware Wallets Fail at Seed Generation

Woofun AI reports that a critical vulnerability in Coldcard hardware wallets has exposed approximately 1,367 Bitcoin to potential theft due to a flawed random number generation process. The incident, analyzed by Liam ‘Akiba’ Wright and compiled by Saoirse for Foresight News, reveals that the security of Bitcoin custody is often compromised before the device even connects to the network. While hardware wallets are designed to keep private keys isolated from the Internet, the risk emerges at the moment the seed phrase is generated.

If the underlying random number generator lacks sufficient entropy, the resulting seed phrase becomes predictable, rendering subsequent security measures ineffective. This structural weakness illustrates a fundamental security trap: an air-gapped device cannot protect a seed that was generated with insufficient randomness. The flaw allows attackers to exhaust possible seed combinations on external devices and filter them against the Bitcoin public ledger, bypassing the wallet’s physical isolation entirely.

The attack vector exploits the reduced search space of the random number generator, allowing adversaries to derive candidate seeds and match them against transaction records. Affected wallets generate seemingly normal 12-word or 24-word recovery seed phrases, which users store on steel seed backup boards or in tamper-proof envelopes, believing them to be secure.

However, the range of possible values for the underlying random number generator is drastically reduced, making brute-force attacks feasible. Before safeguards such as PIN codes and air isolation can take effect, the seed must be generated using a truly reliable random source. If attackers understand the logic behind the random number generation, they can reverse-engineer the entire process. The deterministic algorithm Yasmarang in MicroPython serves as a fallback when the hardware random generator is disabled, but this fallback introduces significant predictability. The configuration option MICROPY_HW_ENABLE_RNG, when set to 0, disables the hardware random generator, yet the code integration logic only checks for the option’s existence without reading its value, leading to the unintended use of the weaker algorithm.

The root cause of this vulnerability lies in a specific code change implemented on March 1, 2021, which moved Coldcard’s seed generation functionality to a new codebase. report by Block, the flawed logic was included in version 4.0.0 of the firmware, officially released on March 17. This version introduced a critical error where the system abandons the hardware random generator and turns to the deterministic algorithm Yasmarang in MicroPython as a fallback, regardless of the intended configuration.

The generated seed phrases appear normal to users, but the search space available for brute-forcing is drastically reduced. This flaw affected multiple models, including the Mk2, Mk3, Mk4, Mk5, and Q series, all manufactured by Coinkite. The integration error meant that as long as the configuration option existed, the system defaulted to the less secure algorithm, compromising the entropy of the generated seeds. This oversight persisted across several firmware versions, leaving a wide range of devices vulnerable to exploitation.

Quantifying the risk reveals significant disparities in entropy bits across different firmware versions and models. Based on preliminary calculations by Coinkite, the effective search space for affected Mk2 and Mk3 models is only about 40 bits, while for affected Mk4, Mk5, and Q series models, it is around 72 bits. The Block team imposed additional restrictions on later models, noting that when the status of the fallback algorithm and call history are fixed, there are at most 2^32 distinguishable random streams. Coinkite’s security announcement states that Mk4 and Mk5 firmware versions prior to standard 5.

6.0 and Edge 6.6.0X versions, as well as Q series firmware versions prior to standard 1.5.0Q and Edge 6.6.0QX versions, were all affected. For Mk2 and Mk3, Coinkite listed versions 4.0.1 to 4.1.9 as risky, while the Block team believes the flaw existed since version 4.0.0. This discrepancy in version boundaries highlights the complexity of assessing risk, with users advised to take a cautious approach. The data provided by Coinkite estimates the effective search range that attackers can explore, confirming that all later models before firmware fixes were at risk.

Remediation advice emphasizes that simply upgrading firmware does not fix existing security flaws in wallets. Upgrading to a fixed version only ensures the security of newly generated seeds; all previously generated old seeds retain only the entropy value obtained at the time of creation. All addresses derived from those seeds share the same underlying key, meaning that using an old seed phrase to generate new addresses leaves the original security flaws intact.

Users are advised to check official security announcements and, unless they can confirm that the seed was generated through sufficient manual dice rolling, generate new seeds using a trusted random source. Manual dice rolling provides a random source whose randomness is intuitive and controllable, independent of the code written by manufacturers. This method allows users to introduce entropy that is independent of the device’s trust chain, ensuring that the seed phrase is generated with sufficient randomness.

Transferring funds to a new wallet is essential for users who cannot verify the integrity of their original seed generation process.

Woofun AI data shows that the impact assessment reveals significant asset values at risk and substantial on-chain transfer statistics. Bitcoin Optech released updated estimates on July 31, showing that the value of assets at risk exceeded 1,000 Bitcoin. As of August 2, Galaxy Research estimated that approximately 1,367 Bitcoin in 4,585 addresses were at risk. A user named Graham_Quantum on X Corp claimed that 18.25245043 Bitcoin had already been transferred from related wallets on July 29. After these details became public, many users transferred their assets to avoid risk, resulting in even larger capital flows.

After the flaw was revealed, 77,402 Bitcoin were transferred from old unspent transaction output (UTXO) pools. This security incident caused two major impacts: hackers stealing assets and a much larger-scale voluntary migration by users to protect themselves. The Coldcard wallet flaw, worth approximately $89 million, triggered the largest on-chain Bitcoin transfer since the FTX collapse, severely disrupting the interpretation of market signals. Tens of thousands of users urgently transferred Bitcoin from their old wallets, making it difficult to discern the authenticity of bearish signals emitted by various core on-chain indicators.

The solution involves manual dice rolling mechanics and precise entropy calculations. According to Coldcard’s official documentation on dice usage, a fair six-sided die can generate about 2.585 bits of entropy per independent roll. 50 rolls can produce about 129.25 bits of raw entropy, meeting the standard 128-bit security requirement; 99 rolls can generate about 255.91 bits of raw entropy, roughly meeting the 256-bit security standard. These figures align with the widely used BIP-39 seed standard: a 12-word seed encodes 128 bits of entropy plus a 4-bit checksum; a 24-word seed encodes 256 bits of entropy plus an 8-bit checksum.

A hardware wallet’s offline isolation mechanism can only protect the seed once it has been generated and cannot fix weak random flaws during generation. Safe BIP-39 seed phrases can only be created by using private dice rolling to obtain independent entropy. Checksums are only used to detect copying errors in seed phrases, and the total number of possible keys does not increase with hashing and proper formatting. Those seemingly reassuring 12 words may come from an extremely small random pool if the underlying raw random data is weak.

Best practices for dice rolling emphasize the role of BIP-39 passphrases and the importance of confidentiality. For manual dice rolling to be effective, the wallet’s built-in process must properly accept the random data generated by the dice. The dice themselves must be reliable, with each roll being genuine and independent, and the entire sequence must remain confidential. Reusing roll patterns, taking photos of the results, storing sequences in the cloud, or entering results on a connected computer will all undermine the independence and confidentiality of randomness.

Regarding the Coldcard security incident, Coinkite stated that only if users can prove that at least 50 fair, independent, and confidential dice rolls were performed when the final seed was generated can they avoid transferring their assets. In any case of uncertainty, officials recommend transferring funds. Setting a strong, unique BIP-39 passphrase can raise the attack threshold from another perspective, acting like an independent key.

Even if attackers obtain the seed phrase, they still need to crack the passphrase to access the assets. Note that the entropy of the seed phrase itself does not increase with a passphrase, and any passphrase, even a single incorrect character, can generate a set of valid wallet addresses. The function of a hardware wallet’s PIN code is completely different from that of a passphrase, and enabling a passphrase involves trade-offs regarding backup and access.

Historical context reveals similar RNG flaws in Trust Wallet and Libbitcoin Explorer, highlighting recurring risks. In 2023, Ledger Donjon revealed that certain versions of the Trust Wallet browser extension used a 32-bit Merkle twist algorithm based on WebAssembly to generate random seeds. These seemingly normal seed phrases all originated from approximately 4 billion initial values. The affected range was clear: browser extensions of Trust Wallet Core versions prior to 3.1.

1 with versions 0.0.172 to 0.0.182. The U.S. National Vulnerability Database recorded that this flaw was exploited in December 2022 and March 2023. The "Milk Sad" flaw incident vividly demonstrated a similar risk, where the bx seed command in Libbitcoin Explorer 3.x used a 32-bit Merkle twist algorithm seeded by the system time. Under the same clock conditions, the software might generate identical seed phrases, reducing the brute-forcing range significantly.

Researchers found over 2,600 actively used Bitcoin wallets within the affected range; based on market conditions in August 2023, the value of stolen assets across multiple public chains exceeded $900,000. More than 2,550 of these wallets showed signs of automated operation, likely belonging to the same owner. Such flaws appear in different forms each time, but the resulting wallet keys may seem flawless while the size of the key space available for exploration is small enough to pose a fatal risk.

The conclusion underscores the fundamental requirement for trusted random sources in Bitcoin custody. Most Bitcoin custody recommendations on the market focus on steps taken after seed generation: storing seed phrases offline, using durable backup media, isolating permissions, and testing recovery processes. These measures still hold value, but the Coldcard incident reminds us that security defenses need to be strengthened further. Air isolation can only protect keys that you have already entered into the device, and it cannot fix weak random flaws during generation. That’s why Bitcoin wallet security must start with a trusted random source.

The security fate of a wallet is determined at the time the seed is created, and relying on the device’s built-in random number means unconditionally trusting the entire chain from hardware to integrated code. A proper dice entry process can introduce entropy that is independent of this trust chain and under the user’s control, ensuring that the seed phrase is generated with sufficient randomness. This marks a critical shift in understanding hardware wallet security, emphasizing that true cryptographic security requires manual intervention in the seed generation process.