How a 2021 Firmware Bug Let Attackers Predict Coldcard Seeds and Steal $70M in 41 Minutes

On July 30, 2026, someone swept 1,196 Bitcoin addresses in a single 41-minute operation, moving 1,082.65 BTC (~$70.2M) out of Coldcard hardware wallets. Galaxy Research clustered the sweep by its fingerprint: every transaction used the same 30 sat/vB fee rate with no change output, and no other Bitcoin activity in the prior 30 days matched that pattern.

The headline says 2021, and that is the twist. The theft happened in 2026, but the flaw it exploited was introduced by a commit in March 2021 and sat in public source for roughly five years before anyone weaponized it. Coinkite says it was unaware of the bug until the day of the sweep.

Coldcard has its own hand-written wrapper that reads the STM32's hardware true-RNG peripheral. Commit b18723dd, dated March 1, 2021, changed seed generation to call random.bytes(32) instead, which routed through a new library, libngu, added that year when the device migrated its elliptic-curve math to libsecp256k1.

Nobody meant to weaken anything. The intent was to use the shared library's randomness, and on paper random.bytes should have reached the hardware. It didn't, because of a subtle defect one layer down in how the library decided where its bytes came from.

Coldcard's board config sets MICROPY_HW_ENABLE_RNG to 0 on purpose, because Coinkite supplies its own hardware wrapper. But libngu guarded its RNG choice with #ifndef MICROPY_HW_ENABLE_RNG, which only tests whether the macro is defined, not whether its value is nonzero. Defined as 0 still passes the guard, so the library bound to MicroPython's software path.

That path is MicroPython's Yasmarang fallback, seeded exactly once from the chip's fixed 32-bit UID, the SysTick down-counter, and RTC registers. On Mk3 the RTC oscillator was disabled and SysTick has at most ~80,000 values, so once you know the inputs the whole stream is reproducible. Coldcard even XORs in a second Yasmarang seeded from hardcoded public constants, but XOR of two deterministic streams is still deterministic.

A 12-word BIP-39 seed is supposed to carry 128 bits of entropy. Coinkite's own estimate puts the real figure at roughly 40 bits on Mk2/Mk3, and about 72 bits on the newer Mk4/Mk5/Q line. Forty bits is a search space small enough to reason about, not a wall of astronomical numbers.

The seed bytes are hashed with SHA256d before use, but hashing a bounded input can't add entropy, so a small candidate set stays small. Block's independent analysis is careful here: it bounds the theoretical search space below ceilings like 2^40.7 and 2^73.3, stresses that 2^73.3 is not the same as 73-bit security, and publishes no end-to-end brute-force benchmark. Nobody has publicly reconstructed a victim's seed and matched it to a drained address.

Because every function that reached for randomness went through the same ngu.random path, the exposure runs past wallet seeds. Paper wallet private keys are the worst case: the RNG output becomes the secp256k1 key directly, and the public address is an instant oracle to check a guess against. Seed-XOR masks, device cloning keys, USB encryption keys, and TOTP secrets all drew from the same well.

Coinkite shipped patched firmware for every affected model on July 31, 2026, but the fix is not just an update. Exposure is set by the firmware version at the time the seed was generated, so a compromised seed stays compromised even on new firmware. The real remedy is to generate a brand-new seed on patched firmware and move funds, and Coinkite notes that seeds made with 50+ private dice rolls were never at risk from this bug alone. Ledger's CTO drew the parallel to the 2022 Trust Wallet weak-RNG flaw, where public addresses alone were enough to brute-force wallets.