Incident Overview
Published 8/2/2026, 3:59:09 AM
The weak RNG (Random Number Generator) theory is the confirmed root cause of the ongoing Coldcard drain incident. Technical audits from Block Engineering, Galaxy Research, and Coinkite have verified that a firmware configuration error introduced in March 2021 catastrophically reduced the entropy of generated seeds, making them predictable and susceptible to brute-force attacks [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware, https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/].
Incident Overview
Between July 30 and July 31, 2026, an automated attacker executed a highly coordinated sweep, draining approximately 1,082.65 BTC (~$70.2 million) from 1,196 addresses in just 41 minutes [Source: https://x.com/glxyresearch/status/2083181683067506899]. The attack specifically targeted single-signature wallets where the seed was generated on vulnerable Coldcard firmware.
Technical Root Cause
The vulnerability stemmed from a build configuration error in the firmware (starting with v4.0.0) rather than a hardware failure.
- The Bug: A preprocessor guard (
MICROPY_HW_ENABLE_RNG = 0) was misconfigured. The system's library checked for the existence of the macro rather than its value, causing the device to bypass the STM32 hardware random number generator (TRNG) [Source: https://thehackernews.com/2026/08/coldcard-hardware-wallet-flaw-linked-to.html]. - The Fallback: The device defaulted to a software-based PRNG (Yasmarang) seeded with non-secret data, such as the chip's unique ID (UID) and system timers [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware].
- Entropy Collapse: This reduced the effective entropy of a 12-word seed from the required 128 bits to as low as ~40 bits on Mk3 devices. This level of entropy can be cracked in minutes using consumer-grade hardware [Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/].
Affected Devices and Risk Assessment
| Device Model | Vulnerable Firmware Versions | Effective Entropy |
|---|---|---|
| Coldcard Mk3 | v4.0.0 to v4.1.9 | ~40 bits (High Risk) |
| Coldcard Mk4/Mk5 | Pre-v5.6.0 | ~72 bits (Moderate/High Risk) |
| Coldcard Q | Pre-v1.5.0Q | ~72 bits (Moderate/High Risk) |
| Tapsigner/Opendime | Not Affected | Standard 128/256 bits |
Critical Mitigations
Updating the firmware does not secure an existing weak seed. If a seed was generated on the vulnerable versions listed above, the following conditions apply:
- New Seed Required: Users must generate a new seed on patched firmware and migrate all funds immediately [Source: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/].
- Dice Rolls: Seeds generated using 50+ independent dice rolls are considered safe, as this manual entropy bypasses the internal RNG bug [Source: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware].
- Passphrases: The use of a strong, unique BIP-39 passphrase significantly increases the difficulty of the attack, though it may not fully compensate for a 40-bit entropy collapse against a determined attacker [Source: https://x.com/glxyresearch/status/2083181683067506899].
While the vulnerability is now understood and patched in the latest firmware releases, the "ongoing" nature of the drain refers to the fact that any funds remaining on legacy "weak" seeds are still vulnerable to being swept by the attacker's automated scripts [Source: https://www.coindesk.com/tech/2026/07/31/major-bitcoin-wallet-flaw-drains-594-btc-in-25-minute-sweep].