Key facts
- A firmware bug in Coldcard Bitcoin wallets caused seeds to be generated by a software pseudo-random number generator instead of the intended hardware chip.
- This vulnerability reduced the effective security of older Coldcard models to approximately 40 bits, down from the target of 128 bits.
- Attackers have stolen an estimated 1,596 to 2,055 BTC, valued at around $130 million.
- Coinkite, the manufacturer, has released a technical explanation and fixed firmware, but users with affected seeds must move their funds.
- Concerns have been raised about the security of using physical dice for entropy generation, even precision casino dice.
A critical firmware bug in Coldcard hardware wallets, designed to be air-gapped and highly secure, has led to the theft of approximately $130 million worth of Bitcoin. The exploit, discovered and detailed by Coinkite and analyzed by firms like Galaxy Research and Block, stemmed from a misconfiguration that caused the wallets to use a software-based pseudo-random number generator (PRNG) instead of their dedicated hardware random number generator.
This rerouting of entropy generation effectively weakened the security of the private keys. On older models (Mk2 and Mk3 running firmware 4.0.1 through 4.1.9), the effective search space for generating these keys was reduced from the intended 128 bits to around 40 bits. Newer models offered slightly better security, around 72 bits, by incorporating some secure-element entropy, but still fell short of the 128-bit standard.
Coinkite suspects that advanced tools, potentially including AI, were used by attackers to identify this vulnerability. The company noted that a build guard check was improperly implemented, allowing the software fallback to be used without triggering a safety alert. The migration to libsecp256k1, a library also used by Bitcoin Core, was the point where the issue was introduced.
As a result, attackers were able to deterministically guess or brute-force the private keys for a significant number of wallets, leading to multiple waves of theft totaling over 1,596 BTC, with estimates reaching up to 2,055 BTC. Coinkite has released updated firmware to fix the issue, but users with affected wallets must regenerate their seeds and move their funds to new, secure wallets.
Following the exploit, concerns have arisen regarding mitigation strategies. Bitcoin Core developer Luke Dashjr cautioned against relying solely on physical dice for generating new seeds, noting that common dice are not cryptographically secure and even precision casino dice require careful handling and additional entropy sources to ensure adequate security against such vulnerabilities.