## Coldcard RNG Flaw: Attack Waves to Date
A March 2021 commit moved seed generation from `ckcc.rng_bytes()` to `ngu.random.bytes()`. Libngu's guard used `#ifndef` on `MICROPY_HW_ENABLE_RNG` (which Coinkite had defined as zero), so the build silently bound to MicroPython's Yasmarang PRNG, seeded from the MCU UID and timer registers. No device was ever touched; keys were enumerated offline and matched against the chain.
Effective search space: ~40 bits on Mk2/Mk3, ~72 bits on Mk4/Mk5/Q, against a 128-bit target.
| Wave | Window (UTC) | BTC | Addresses | Fingerprint |
|---|---|---|---|---|
| 1 | Jul 30, 01:10–01:51 | 1,082.65 | 1,195 | 30 sat/vB flat fee, no change outputs |
| 2 | Jul 31 | 76.16 | 1,478 | Same as Wave 1 |
| 3 | Jul 31 → Aug 1 | ~208 | 1,912 | 293 P2WSH vaults, per-victim outputs, default derivation only |
| **Total** | | **~1,367** | **4,585** | ~$88.6M |
Waves 1–2 share a signature: one operator or one toolkit. Wave 3 breaks it: separate vaults, harder to cluster, working down-market into wallets worth a few thousand. Galaxy can't say from chain data alone whether that's the same actor retooling or a second one on the same weak-seed pool. Nothing has moved; ~300 attacker addresses are being watched.
Wave 1 detail: victims split 1,183 native segwit (BIP-84), 7 BIP-49, 6 BIP-44, consistent with multi-path key scanning. The 30 sat/vB fee was a 30–75x overpay against that week's 0.4–1.0 sat/vB median. The event spans six blocks, with three intervening blocks showing no sweep activity, suggesting batched broadcasts rather than a stream. Top collectors: bc1qq85v2c9…cu9r (562.02 BTC), bc1qx76cae2…fhe3 (398.48), bc1q8jy96fe…tp3q (89.62), bc1qnk4zh9q…fecp0 (32.45).
**Affected (per Coinkite, updated Aug 1):** Mk2/Mk3 4.0.1–4.1.9 · Mk4/Mk5 before 5.6.0 (Edge before 6.6.0X) · Q before 1.5.0Q (Edge before 6.6.0QX). Tapsigner, Opendime, Satscard use different codebases and are unaffected.
**Fixed firmware:** 4.2.0 (Mk2/Mk3) · 5.6.0 (Mk4/Mk5) · 1.5.0Q (Q) · 6.6.0X / 6.6.0QX (Edge). Standard and Edge are separate tracks. A higher Edge 6.x number does not mean fixed.
**Firmware updates do not repair an existing seed.** A weak seed stays weak in any device. The attacker searches the seed pool, not the hardware. Generate fresh on patched firmware, verify fingerprint, send a test tx, then migrate. Don't rush it: a botched migration is a bigger risk than the bug.
50+ fair, independent, private dice rolls at creation = not at risk from this alone. Strong unique BIP-39 passphrase = reduced exposure, migrate anyway. Device PIN ≠ passphrase. Multisig built entirely from affected devices is still affected.
Galaxy's analysis is preliminary and based solely on public chain data. Figures still climbing.
### Sources
- Coinkite advisory: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/
- Coinkite technical backgrounder: https://blog.coinkite.com/entropy-technical-backgrounder/
- Block Engineering root-cause analysis: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware
- Firmware downloads: https://coldcard.com/docs/upgrade
- LLFOURN attack-cost model (linked by Coinkite): https://x.com/LLFOURN/status/2082990000896147942
- Galaxy Research, Wave 1 flow-of-funds: https://x.com/glxyresearch/status/2083181683067506899
- Galaxy Research, Waves 2 and 3 (same thread, Aug 1): https://x.com/glxyresearch
A March 2021 commit moved seed generation from `ckcc.rng_bytes()` to `ngu.random.bytes()`. Libngu's guard used `#ifndef` on `MICROPY_HW_ENABLE_RNG` (which Coinkite had defined as zero), so the build silently bound to MicroPython's Yasmarang PRNG, seeded from the MCU UID and timer registers. No device was ever touched; keys were enumerated offline and matched against the chain.
Effective search space: ~40 bits on Mk2/Mk3, ~72 bits on Mk4/Mk5/Q, against a 128-bit target.
| Wave | Window (UTC) | BTC | Addresses | Fingerprint |
|---|---|---|---|---|
| 1 | Jul 30, 01:10–01:51 | 1,082.65 | 1,195 | 30 sat/vB flat fee, no change outputs |
| 2 | Jul 31 | 76.16 | 1,478 | Same as Wave 1 |
| 3 | Jul 31 → Aug 1 | ~208 | 1,912 | 293 P2WSH vaults, per-victim outputs, default derivation only |
| **Total** | | **~1,367** | **4,585** | ~$88.6M |
Waves 1–2 share a signature: one operator or one toolkit. Wave 3 breaks it: separate vaults, harder to cluster, working down-market into wallets worth a few thousand. Galaxy can't say from chain data alone whether that's the same actor retooling or a second one on the same weak-seed pool. Nothing has moved; ~300 attacker addresses are being watched.
Wave 1 detail: victims split 1,183 native segwit (BIP-84), 7 BIP-49, 6 BIP-44, consistent with multi-path key scanning. The 30 sat/vB fee was a 30–75x overpay against that week's 0.4–1.0 sat/vB median. The event spans six blocks, with three intervening blocks showing no sweep activity, suggesting batched broadcasts rather than a stream. Top collectors: bc1qq85v2c9…cu9r (562.02 BTC), bc1qx76cae2…fhe3 (398.48), bc1q8jy96fe…tp3q (89.62), bc1qnk4zh9q…fecp0 (32.45).
**Affected (per Coinkite, updated Aug 1):** Mk2/Mk3 4.0.1–4.1.9 · Mk4/Mk5 before 5.6.0 (Edge before 6.6.0X) · Q before 1.5.0Q (Edge before 6.6.0QX). Tapsigner, Opendime, Satscard use different codebases and are unaffected.
**Fixed firmware:** 4.2.0 (Mk2/Mk3) · 5.6.0 (Mk4/Mk5) · 1.5.0Q (Q) · 6.6.0X / 6.6.0QX (Edge). Standard and Edge are separate tracks. A higher Edge 6.x number does not mean fixed.
**Firmware updates do not repair an existing seed.** A weak seed stays weak in any device. The attacker searches the seed pool, not the hardware. Generate fresh on patched firmware, verify fingerprint, send a test tx, then migrate. Don't rush it: a botched migration is a bigger risk than the bug.
50+ fair, independent, private dice rolls at creation = not at risk from this alone. Strong unique BIP-39 passphrase = reduced exposure, migrate anyway. Device PIN ≠ passphrase. Multisig built entirely from affected devices is still affected.
Galaxy's analysis is preliminary and based solely on public chain data. Figures still climbing.
### Sources
- Coinkite advisory: https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/
- Coinkite technical backgrounder: https://blog.coinkite.com/entropy-technical-backgrounder/
- Block Engineering root-cause analysis: https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware
- Firmware downloads: https://coldcard.com/docs/upgrade
- LLFOURN attack-cost model (linked by Coinkite): https://x.com/LLFOURN/status/2082990000896147942
- Galaxy Research, Wave 1 flow-of-funds: https://x.com/glxyresearch/status/2083181683067506899
- Galaxy Research, Waves 2 and 3 (same thread, Aug 1): https://x.com/glxyresearch
1
