The Technical Root Cause: Entropy Collapse
Published 8/3/2026, 2:35:02 AM
The Coldcard exploit, which culminated in late July 2026, resulted in the theft of approximately $88.6 million (roughly 1,367 BTC) from 4,585 wallets. The attack was not a supply-chain compromise or a physical breach, but rather a sophisticated exploitation of a firmware configuration error that had existed since March 2021.
The Technical Root Cause: Entropy Collapse
The vulnerability originated in a preprocessor macro check within the libngu cryptographic library used by Coinkite. The library checked for the existence of the MICROPY_HW_ENABLE_RNG macro rather than its boolean value. Because Coinkite used a custom hardware RNG wrapper, the macro was set to 0 (disabled). The library interpreted this as a signal to bypass the hardware-based True Random Number Generator (TRNG) and use a predictable software fallback called Yasmarang.
This fallback was seeded using only three non-secret inputs:
- The chip's 32-bit unique identifier (UID).
- A timer register.
- The real-time clock (RTC).
This reduced the effective entropy of generated seeds from the industry-standard 128 bits to as low as ~40 bits for Mk3 devices and ~72 bits for Mk4/Mk5/Q models, making them susceptible to brute-force reconstruction.
Attack Execution and Impact
Attackers likely used AI-assisted code review to identify the flaw and then performed offline enumeration to reconstruct predictable seed streams. By brute-forcing the limited range of device UIDs and timer states, they derived Bitcoin addresses and cross-referenced them against the blockchain.
| Metric | Data Point |
|---|---|
| Total Drained | ~$88.6 Million (1,367 BTC) |
| Wallets Affected | 4,585+ |
| Primary Attack Wave | July 30, 2026 (1,082.65 BTC in 41 minutes) |
| Vulnerable Models | Mk2, Mk3, Mk4, Mk5, Q |
| Entropy Reduction | 128 bits down to ~40–72 bits |
While the total reported loss reached $88.6M across multiple waves, initial reports confirmed a concentrated sweep of 594 BTC (~$38M) from approximately 500 wallets occurring within a 25-minute window on July 30 [Verified: coindesk.com/tech/2026/07/31].
Remediation and Vulnerable Versions
The vulnerability affects any wallet where the seed was generated using the compromised firmware. Simply updating the firmware does not secure an existing compromised seed; users must generate a new seed on patched firmware and migrate their funds.
| Model | Vulnerable Firmware Range | Fixed Version |
|---|---|---|
| Mk2 / Mk3 | 4.0.0 – 4.1.9 | 4.2.0+ |
| Mk4 / Mk5 | Prior to 5.6.0 | 5.6.0+ |
| Q | Prior to 1.5.0Q | 1.5.0Q+ |
| Edge Builds | Prior to 6.6.0X | 6.6.0X+ |
Note: Seeds generated using 50+ independent dice rolls or those protected by a strong BIP-39 passphrase were significantly more resilient to this specific entropy flaw, as these methods provided entropy outside the compromised software fallback.