Blab Crypto
Coldcard Mk3 Firmware Bug Exposes Seed Phrases, $38 Million Bitcoin Stolen
Coinkite, the maker of the Coldcard hardware wallet, issued a security advisory on July 30 after an attacker drained roughly 594 BTC—about $38 million—from 500 Coldcard Mk3 wallets in 25 minutes. The breach was traced to a flaw in the device’s firmware that reduced the randomness used to generate seed phrases from the intended 128‑bit entropy to only about 40 bits.
The bug stems from a duplicated random‑number‑generator (RNG) function in the firmware. Coldcard’s code contains a hardware‑based true‑random‑number generator (TRNG) written by the company and a software fallback inherited from MicroPython. A pre‑processor guard in the build system checks only whether a macro is defined, not its value, so the build silently selects the fallback implementation. Since a March 2021 migration, the seed‑generation routine has been using this fallback, which provides far less entropy.
Coinkite estimates that the effective search space for a Mk3 seed is roughly 2^40, compared with the 2^128 space that BIP‑39 specifies. The company says that the Mk4, Q and Mk5 models incorporate additional entropy from secure‑element chips, raising the effective space to about 2^72. While this improves security, it still falls short of the target. Other wallets that use different code—Tapsigner, Opendime and Satscard—are not affected.
In the advisory, Coinkite warned that any seed generated on a Mk3 running firmware 4.0.1 or later may be compromised. The company shipped an emergency hotfix for the Mk4 and Mk5 (firmware 5.6.0) and for the Q (firmware 1.5.0Q). Updating does not repair a seed that has already been created; owners must generate a new seed on patched hardware and are advised to use a strong BIP‑39 passphrase, at least 99 dice rolls, or both. Mk3 owners, whose model is no longer supported, are directed to a separate migration path.
Block, a Bitcoin‑focused technology firm, began investigating the incident on July 31. In a tweet, Block’s Bitcoin engineering team said they were looking into reports of non‑Bitkey wallets being drained and had found that none of Block’s own products were affected. Trezor, another hardware‑wallet maker, confirmed that seeds created on the compromised Coldcard remain weak even if restored to a different device.
Coinkite said it had run one of the best available AI models over its own firmware a few weeks before the breach, and the model did not flag the bug. The company believes the attacker used AI to review earlier firmware versions and uncover the flaw. “Attackers and defenders have the same tools,” the firm wrote, noting that the AI review helped the bad guys but not the good ones.
The incident highlights the importance of rigorous firmware audits and the potential risks of relying on automated code‑review tools that may miss subtle build‑time issues. It also underscores the need for hardware‑wallet users to keep firmware up to date and to follow manufacturer guidance on seed‑generation best practices.
At present, the stolen 562 BTC have been consolidated into a single address, and the total loss is estimated at 594 BTC. Coinkite’s advisory remains in effect, and users of affected firmware versions are urged to migrate seeds immediately. The broader industry watches how other wallet makers respond and whether additional security reviews are undertaken.
The situation remains fluid. Coinkite has not announced a timeline for a new migration path for Mk3 owners, and it is unclear whether the flaw will be fully remediated in future firmware releases. Block and Trezor continue to monitor the incident for potential cross‑product impacts. Investors and users should stay alert for further updates from the wallet manufacturers and from regulatory bodies that may investigate the breach.
The bug stems from a duplicated random‑number‑generator (RNG) function in the firmware. Coldcard’s code contains a hardware‑based true‑random‑number generator (TRNG) written by the company and a software fallback inherited from MicroPython. A pre‑processor guard in the build system checks only whether a macro is defined, not its value, so the build silently selects the fallback implementation. Since a March 2021 migration, the seed‑generation routine has been using this fallback, which provides far less entropy.
Coinkite estimates that the effective search space for a Mk3 seed is roughly 2^40, compared with the 2^128 space that BIP‑39 specifies. The company says that the Mk4, Q and Mk5 models incorporate additional entropy from secure‑element chips, raising the effective space to about 2^72. While this improves security, it still falls short of the target. Other wallets that use different code—Tapsigner, Opendime and Satscard—are not affected.
In the advisory, Coinkite warned that any seed generated on a Mk3 running firmware 4.0.1 or later may be compromised. The company shipped an emergency hotfix for the Mk4 and Mk5 (firmware 5.6.0) and for the Q (firmware 1.5.0Q). Updating does not repair a seed that has already been created; owners must generate a new seed on patched hardware and are advised to use a strong BIP‑39 passphrase, at least 99 dice rolls, or both. Mk3 owners, whose model is no longer supported, are directed to a separate migration path.
Block, a Bitcoin‑focused technology firm, began investigating the incident on July 31. In a tweet, Block’s Bitcoin engineering team said they were looking into reports of non‑Bitkey wallets being drained and had found that none of Block’s own products were affected. Trezor, another hardware‑wallet maker, confirmed that seeds created on the compromised Coldcard remain weak even if restored to a different device.
Coinkite said it had run one of the best available AI models over its own firmware a few weeks before the breach, and the model did not flag the bug. The company believes the attacker used AI to review earlier firmware versions and uncover the flaw. “Attackers and defenders have the same tools,” the firm wrote, noting that the AI review helped the bad guys but not the good ones.
The incident highlights the importance of rigorous firmware audits and the potential risks of relying on automated code‑review tools that may miss subtle build‑time issues. It also underscores the need for hardware‑wallet users to keep firmware up to date and to follow manufacturer guidance on seed‑generation best practices.
At present, the stolen 562 BTC have been consolidated into a single address, and the total loss is estimated at 594 BTC. Coinkite’s advisory remains in effect, and users of affected firmware versions are urged to migrate seeds immediately. The broader industry watches how other wallet makers respond and whether additional security reviews are undertaken.
The situation remains fluid. Coinkite has not announced a timeline for a new migration path for Mk3 owners, and it is unclear whether the flaw will be fully remediated in future firmware releases. Block and Trezor continue to monitor the incident for potential cross‑product impacts. Investors and users should stay alert for further updates from the wallet manufacturers and from regulatory bodies that may investigate the breach.
