A programming error from five years ago just cost $88 million
For 41 minutes, in the early hours of 30 July, someone emptied 1,196 bitcoin wallets without forcing any door. There was no phishing, no malware, no stolen password: the attacker simply already had the keys. The analysis firm Galaxy Research put that first wave at 1,083 BTC, about $70.2 million. Two days later, with the second and third waves counted, the figure had risen to 1,367 bitcoin —close to $88.6 million— stolen from 4,585 addresses. The origin of it all: a flaw in the random number generator of the firmware of COLDCARD hardware wallets, made by Canadian company Coinkite.
When chance stops being chance
A hardware wallet exists precisely for the opposite of what has happened: to keep private keys on an isolated device, away from the computer and the internet. Its entire value rests on a simple premise: the seed from which those keys are derived must be impossible to guess. And for it to be impossible to guess, it has to be born from a real source of randomness.
The engineering and security teams at Block, who analysed the firmware alongside other researchers after the first reports of thefts, found the problem. In the words of their report, “the COLDCARD firmware contains an RNG integration bug that causes ngu.random to use MicroPython’s deterministic Yasmarang generator instead of the STM32 hardware RNG”. Translated: the device includes a chip designed specifically to produce cryptographic-grade randomness, but a badly written check in the code meant that chip was ignored and the software plan B was used instead.
That plan B fed on the microcontroller identifier and system timing values. Neither is secret nor unpredictable: they are observable or reconstructible data. With them, an attacker can generate millions of candidate seeds offline, calculate the bitcoin addresses they would correspond to and compare them with the addresses anyone can see on the blockchain. When there is a match, the seed is correct and the private keys fall on their own.
The signature of an automated attack
The pattern of the transactions betrays the mechanics. They all paid exactly the same fee, 30 satoshis per virtual byte, between 30 and 75 times above that week’s median, and none left change. “That looks like an automated tool spending keys it already possessed, not owners moving funds,” Galaxy summarized. Chainalysis added a disturbing detail: the attacker went after the fattest wallets first, took about $30 million in the first ten minutes and emptied $1.8 million from a single victim. They had studied the terrain before entering.
And there is a figure that summarizes the asymmetry of this story better than any number: the robbery took place about 30 hours before Coinkite published the security advisory. The flaw was reported to the manufacturer on 30 July; the thieves were already inside.
Which models are affected and what to do
According to Coinkite’s advisory, the seeds at risk are those generated on Mk2 and Mk3 with firmware versions 4.0.1 to 4.1.9, on Mk4 and Mk5 earlier than the standard 5.6.0 (or 6.6.0X Edge) and on Q devices earlier than 1.5.0Q (or 6.6.0QX Edge). The TAPSIGNER, OPENDIME and SATSCARD products use a different code base and are not affected. The company says it has destroyed all pending-shipment units that carried vulnerable firmware.
Here is the part worth underlining, because it is counterintuitive: updating the firmware does not fix an already-generated seed. The patch prevents the error from occurring again, but the keys created with the defective generator remain weak forever. The correct procedure involves verifying the existing backup, installing the corrected firmware, generating and noting down a new seed, checking the address on the device’s screen, sending a small test transaction and, only then, moving the rest of the funds. The old backup is kept until the migration is confirmed. Coinkite states that seeds supplemented with at least 50 fair and independent die rolls are not at risk from this flaw, and that a strong BIP-39 passphrase makes exploitation harder, although it does not repair the underlying seed.
The uncomfortable lesson
The episode does not call into question the idea of the hardware wallet, which remains far safer than keeping keys on a phone or on an exchange. It questions something deeper: that the security of an entire system can hang from a single line of code that nobody reviewed, in a component taken for granted. Randomness is the invisible foundation of all modern cryptography —including the one that protects email, online banking and encrypted connections— and when it fails silently, no alarm goes off. The device works, the screen shows twelve or twenty-four apparently unrepeatable words and the user sleeps soundly for years. Until the early morning when it stops being so.
