Thoughts on Coldcard

By Nicola Ceornea, CTO, FREEDOM/FACTORY Last updated Aug 3, 2026

On July 30, over 1,082.65 BTC - more than $70 million as of the writing of this blog - was extracted in a hack targeting COLDCARD hardware wallets by the company Coinkite.

Today we will talk about the attack.

The prelude

When operating a brand-new hardware wallet, the user is faced with a choice: import their own seed phrase, or let the device generate one for them.

Whichever the user chooses, one thing always has to hold: the method used to generate the wallet must contain a high level of randomness - usually described as entropy in information theory.

As a practical example, pretend you are creating a new account and need a password for it. Using easily discoverable information like:

common number sequences: birthdays, anniversaries
names, addresses
popular personalities or objects

…would make the resulting password low-entropy, because a malicious actor could reasonably find that information and guess password candidates by brute force. The classic example is Password1234 (please do not do that).

Thankfully, there are ways to generate high-entropy passwords. They usually involve introducing an external, fair actor into the generation process - dice, coin flips.

Computers have many different ways to generate randomness. Here we need to distinguish between two kinds:

	PRNG	TRNG
Stands for	Pseudo-random number generation	True random number generation
Source	An algorithm expanded from an initial value (a seed)	Physical - and sometimes non-physical - processes
Reproducible?	Yes. Same initial state, same sequence	No. Non-deterministic by construction
Typical use	General-purpose software	Security-focused devices

PRNGs are algorithms that take an initial value, called a seed, and use it to generate a sequence of numbers. Given the same initial state, a PRNG will generate the same sequence again.

Depending on the implementation, that initial state might come from a predictable value such as the system time, or from a secure source of entropy. As you may already have realised, the seed can make or break the security of the system. Anyone who can reconstruct the initial state may be able to reproduce the generated sequence. This makes some PRNG algorithms unsuitable for security-sensitive applications.

Note: cryptographically secure pseudorandom number generators, or CSPRNGs, are specifically designed for secure applications. When properly initialised with sufficient unpredictable entropy and used correctly, they can safely generate cryptographic keys and other sensitive values.

TRNGs, on the other hand, use physical - and sometimes non-physical - processes to non-deterministically generate randomness, and are commonly used in security-focused devices.

Note: not every TRNG implementation is automatically secure. Like PRNGs, hardware entropy sources have to be correctly designed, integrated and tested.

What happened

Our current understanding is that the vulnerability was introduced during a migration of COLDCARD’s elliptic-curve implementation.

As part of that migration, the code used to generate wallet entropy was changed from a path that directly accessed the STM32 microcontroller’s hardware random-number generator to a different random-number interface.

Because of a subtle build and integration error, the new interface resolved to MicroPython’s deterministic Yasmarang fallback generator instead of the intended STM32 hardware random-number generator.

The fallback initialised itself using values derived from:

the microcontroller’s unique identifier
the system tick counter
the real-time-clock registers

Although these values may differ between devices and boots, they are not suitable cryptographic secrets. They are fixed, timing-derived or otherwise potentially predictable values that an attacker may be able to constrain or enumerate.

The impact per model

The exact impact differed between COLDCARD models:

Model	What reached the generator
Mk2, Mk3 (affected firmware)	No cryptographically secure entropy was added through the vulnerable generation path
Mk4, Mk5, Q	Some additional secure-element entropy, but only a limited amount of it reached the generator

As a result, seeds generated by affected firmware could come from a much smaller set of possibilities than intended.

How the funds moved

The vulnerability did not allow an attacker to remotely extract private keys from the physical hardware wallets. Instead, it made it possible to enumerate possible generator states and reproduce candidate wallet seeds. The attack ran entirely off-device:

Generate candidate seeds from the constrained set of generator states.
Derive their corresponding Bitcoin addresses.
Compare those addresses against activity visible on the public blockchain.
Where a candidate matches an address holding bitcoin, derive the private keys and transfer the funds.

As of the writing of this blog, the security vulnerability has been patched, and any new account generated after the fix should not be affected.

If you hold a COLDCARD: any account that relied solely on the flawed PRNG implementation is to be considered compromised. If you are potentially affected, move all assets off those addresses immediately - a patched firmware does not repair a seed that was already generated with too little entropy.

Conclusion

The hack was not caused by defective chips, and it affected only owners of COLDCARD hardware wallets. Users of other wallets - including Trezor, Ledger and Keycard - were not impacted and should not have suffered any loss of tokens.

Ultimately, human error was the deciding factor. A single build-and-integration mistake, in a code path nobody was watching, quietly replaced the one thing a wallet cannot afford to get wrong.

This incident has been a tragedy, and our thoughts are with everyone affected.

For a more in-depth explanation, we invite you to read the official Coinkite report: Entropy: A Technical Backgrounder.