Coldcard Wallet Randomness Vulnerability Exposes Hardware Wallet Security Blind Spot

Written by: Liam 'Akiba' Wright

Compiled by Saoirse, Foresight News

The security of a wallet can be compromised even before a hardware wallet connects to the network. Although an air-gapped hardware wallet may keep private keys isolated from the internet for years, the risk is already present from the moment the mnemonic seed is generated.

The recent disclosure of a random number vulnerability in Coldcard perfectly illustrates this security trap. Wallets affected by this vulnerability can generate 12- or 24-word recovery mnemonics that appear completely legitimate, allowing users to securely store the mnemonic and sign transactions offline. However, the underlying random number generator’s possible range is actually drastically reduced. Attackers can brute-force all possible seed combinations on other devices to reconstruct candidate seeds, then cross-reference them with the public Bitcoin ledger to identify the valid seed that matches the real addresses.

In my view, the security fate of a wallet is sealed at the moment the seed is generated. Before PIN codes, steel mnemonic backup plates, tamper-evident seals, or air-gapped systems come into play, the seed must first be created using a truly reliable source of randomness.

A high-quality modern random number generator can produce sufficient entropy. However, if an attacker understands the underlying logic of the random number generator, they may be able to reverse-engineer the entire generation process.

Manual dice rolling provides users with a verifiable source of randomness that is intuitive, controllable, and independent of code written by the provider.

Coldcard seed generation contains hidden security risks. Attackers can generate candidate seeds externally, convert them to public key addresses, and match them against transaction records on the Bitcoin public ledger to carry out attacks.

The technical root cause of the vulnerability is alarmingly minor. On March 1, 2021, a code change migrated Coldcard’s seed generation functionality to a new codebase. In the production firmware, the configuration option MICROPY_HW_ENABLE_RNG was set to 0, indicating that the hardware random number generator was disabled; however, the code integration logic only checked whether this configuration option existed, not whether its value was read. As long as the configuration option was present, the system would abandon the hardware random number generator and instead启用 the deterministic algorithm Yasmarang from MicroPython as a fallback. According to the joint analysis report by Block, this flawed logic was officially released to the public with firmware version 4.0.0 on March 17.

The generated mnemonic appears completely normal, but the underlying search space available for brute-force attacks has been drastically reduced. According to Coinkite’s preliminary calculations, the effective search space for affected Mk2 and Mk3 devices is approximately 40 bits; for affected Mk4, Mk5, and Q-series devices, it is approximately 72 bits.

The Block team has imposed specific limitations for subsequent models: when the backup algorithm state and call history are fixed, there are at most 2^32 distinguishable random streams. Coinkite's data estimates the effective search space an attacker could exhaust.

Both analysis reports confirm that all later-model devices prior to the firmware patch were within the risk range. According to Coinkite’s security advisory, affected firmware versions include Standard 5.6.0 and earlier, Edge 6.6.0X and earlier for Mk4 and Mk5; Standard 1.5.0Q and earlier, Edge 6.6.0QX and earlier for the Q series. For Mk2 and Mk3, Coinkite lists versions 4.0.1 through 4.1.9 as at risk, while the Block team believes the vulnerability existed as early as version 4.0.0. Given this discrepancy in the version boundary, users are advised to adopt a conservative approach.

This incident clearly demonstrates that simply installing the new firmware does not fix existing security vulnerabilities in wallets. Upgrading to the patched version only ensures the security of newly generated seeds going forward; all previously generated seeds retain only the entropy value they had at the time of creation, and all addresses derived from these seeds share the same underlying key.

All users running firmware with security vulnerabilities should review the official security advisory. Unless you can confirm that your seed was generated using sufficient manual dice rolls, you must use the patched firmware to generate a new seed from a trusted random source and transfer your funds to a new wallet. Simply generating new addresses from your old mnemonic will preserve the original security flaw.

On July 31, Bitcoin Optech released estimated data indicating that assets at risk exceeded 1,000 bitcoins. As of August 2, Galaxy Research estimated that approximately 1,367 bitcoins across 4,585 addresses were at risk. A user on X platform with the handle Graham_Quantum stated that on July 29, 18.25245043 bitcoins had already been transferred out of the related wallets.

After the message was disclosed, a large number of users moved their assets for risk avoidance, triggering significantly larger capital flows. Following the disclosure of the vulnerability, 77,402 bitcoins were transferred from the pool of old, unspent transaction outputs (UTXOs).

Two types of data need to be distinguished:

This security incident triggered two major impacts: first, hackers stole assets; second, a larger wave of users proactively migrated their funds to protect themselves.

The Coldcard wallet vulnerability, involving approximately $89 million, triggered the largest on-chain Bitcoin transfer since the FTX collapse and severely disrupted the interpretation of market signals. Tens of thousands of users urgently transferred Bitcoin from their old wallets, making it difficult to distinguish the authenticity of bearish signals emitted by key on-chain metrics.

According to official Coldcard dice-related documentation: A fair six-sided die produces approximately 2.585 bits of entropy per independent roll. Rolling 50 times generates approximately 129.25 bits of raw entropy, meeting the standard 128-bit security level; rolling 99 times generates approximately 255.91 bits of raw entropy, nearly reaching the 256-bit security standard (this value has not yet been processed by the wallet’s internal conversion algorithm).

These values align with the widely used BIP-39 mnemonic standard: a 12-word mnemonic encodes 128 bits of entropy plus a 4-bit checksum; a 24-word mnemonic encodes 256 bits of entropy plus an 8-bit checksum.

The offline isolation mechanism of a hardware wallet can only protect the mnemonic after it has been generated; it cannot fix weak randomness vulnerabilities during the generation process. To generate a secure BIP-39 mnemonic, independent entropy must be obtained through private dice rolling.

The checksum is only used to detect mnemonic transcription errors. The true determinant of security is the underlying raw random data. Hashing and canonical formatting can improve low-entropy inputs, but they do not expand the total space of possible keys. Those seemingly reassuring 12 words could originate from an extremely small random pool.

For manual dice rolling to provide protection, the wallet’s internal process must correctly accept the random data generated by the dice. The dice themselves must be valid, with each roll being genuinely random and independent of others, and the entire sequence of rolls must remain confidential. Reusing roll patterns, photographing or recording rolls, storing sequences in the cloud, or entering results on an internet-connected computer will compromise the independence and confidentiality of the randomness.

Regarding this Coldcard security incident, Coinkite stated: Users may only avoid migrating their assets if they can verify that at least 50 fair, independent, and confidential dice rolls were performed during the final seed generation; for any uncertainty, the official recommendation is to migrate funds.

For me, the core value of a manual dice lies in the fact that relying on the device’s built-in random number generator means you must unconditionally trust the entire chain—from the hardware and firmware to the compilation process and integrated code.

A standardized dice entry process can introduce entropy that is independent of this trust chain and fully controlled by the user. Approximately 50 fair dice rolls correspond to a 128-bit security level, and 99 rolls correspond to a 256-bit security level. However, users must strictly follow the official device operation procedures and should not design their own random number conversion methods.

Set a strong, unique BIP-39 passphrases to raise the attack barrier by an additional dimension. A passphrase acts as an independent key; even if an attacker obtains your mnemonic, they must still crack the passphrase to access your assets. Note: The entropy of the mnemonic itself is not increased by adding a passphrase. Any passphrase—even a single character wrong—will generate a valid set of wallet addresses. If the passphrase is lost, your assets will be permanently locked. A hardware wallet PIN serves a completely different purpose than a passphrase.

Enabling the passcode involves a trade-off: if you can securely store and accurately reproduce it, it serves as a strong second line of defense; however, if your backup method is inadequate, this feature could permanently lock you out of your assets.

The Coldcard vulnerability serves as another warning to everyone: the security foundation of a Bitcoin wallet lies in the seed being generated with sufficient cryptographic randomness at the moment of creation. Similar underlying flaws have repeatedly surfaced across multiple different wallet products.

In 2023, Ledger Donjon disclosed that certain versions of the Trust Wallet browser extension used a 32-bit Mersenne Twister algorithm to generate random seeds within the WebAssembly execution path. These seemingly legitimate mnemonic phrases all originated from approximately 4 billion initial values. The risk scope is clearly defined: browser extensions versions 0.0.172 to 0.0.182 incorporating Trust Wallet Core versions prior to 3.1.1. The U.S. National Vulnerability Database records that this vulnerability was exploited in December 2022 and March 2023.

The "Milk Sad" vulnerability incident clearly illustrates this type of risk. The bx seed command in Libbitcoin Explorer 3.x uses a 32-bit Mersenne Twister algorithm seeded by system time; under identical clock conditions, the software may generate identical mnemonic phrases. An attacker who can roughly estimate the seed creation time faces a brute-force search space far smaller than the apparent entropy suggested by the mnemonic itself.

Researchers identified over 2,600 still-active Bitcoin wallets within the risk zone; based on August 2023 market conditions, the value of related stolen assets across multiple blockchains exceeded $900,000. More than 2,550 of these wallets exhibited automated operational characteristics, strongly suggesting they are controlled by the same entity. Researchers also noted that some of the stolen assets may have been compromised due to additional security vulnerabilities.

These vulnerabilities always appear under different guises: Coldcard inadvertently triggers a fallback random number algorithm in its firmware; Trust Wallet’s browser extension and Libbitcoin’s command-line tool generate weak random numbers due to reliance on the system clock. The resulting wallet keys appear flawless, but the pool of possible keys is so small that it poses a fatal risk.

The vast majority of Bitcoin custody recommendations focus on steps taken after the seed is generated: storing the mnemonic offline, using durable backup media, implementing access isolation, and testing recovery procedures. These measures remain valuable. However, the Coldcard incident reminds us that security defenses must be pushed one step further.

Air gap protection only safeguards keys that have already been entered into your device. That’s why Bitcoin wallet security must begin with a trusted source of randomness.