Coldcard Firmware Update Mandates Manual Randomness for New Wallets After Major Exploit
Coinkite, the company behind the Coldcard hardware wallet, has released a significant firmware update that requires users to manually introduce randomness when generating new wallet seeds. This move comes in the wake of a critical vulnerability in the device’s random number generator that exposed customer funds to attackers.
The new firmware update necessitates a minimum of 50 dice rolls, 128 coin flips, or 65 timed key presses to generate a new seed. This measure is designed to supplement the device’s internal randomness sources, ensuring a more robust and secure seed generation process.
The update applies to two distinct firmware tracks: version 5.6.1 for the Mk4 and Mk5 models, and version 1.5.1Q for the Q model, which features a larger form factor with an integrated keyboard and QR code scanner.
Coinkite stated that the user-provided randomness is combined with the device’s internal randomness derived from the STM32 TRNG and both secure elements.
The company traced the original vulnerability to a build and link error that inadvertently bypassed a setting intended to disable a software-based random number generator. This allowed MicroPython’s Yasmarang PRNG to be used for seed generation, a path that was active since March 2021. The flaw resulted in affected seeds possessing approximately 72 bits of entropy, falling short of the expected 128 bits. This weakness was exploited on July 30, leading to the theft of 594.5 BTC from 500 addresses.
The updated firmware, 5.6.1, now includes a boot-time verification that ensures random number generation is routed through the intended hardware path. The device will halt operation if this check fails. Coinkite has replaced Yasmarang with a SHA-256 Hash_DRBG, compliant with NIST SP 800-90A standards. This new generator is seeded at startup with a full 256-bit digest from both secure elements, a significant improvement from the previous firmware’s 32-bit truncation.
The “key mashing” feature, inspired by Peter Todd’s push-button RNG design, hashes the timing of keypad presses at CPU-cycle resolution. The initial press establishes a reference point, with each subsequent gap of the 64 following presses contributing two bits of entropy.
“Installing this update does not make an existing vulnerable seed safe,” Coinkite cautioned. The company strongly advises users whose seeds may have been generated on affected firmware between 2021 and July 2026 to create a new seed and transfer their Bitcoin (BTC) to the new wallet. The Mk2 and Mk3 models are not included in this release, and their minimum fixed version remains 4.2.0.
In a separate security enhancement, Coldcard devices now re-verify transaction data before signing to mitigate risks associated with compromised USB hosts. Previously, an attacker could alter transaction outputs after a user had approved them, with the signature still appearing valid. The device now performs a byte-level recheck, displaying a “Transaction modified” warning if any discrepancies are found.
Coinkite’s new Security Status page details four independent reviews, including a real-device test that confirmed eight hardware RNG reads for a 32-byte seed request and a firmware rebuild that matched every byte of the signed firmware.
The company emphasized that these checks do not constitute a “complete audit of every firmware binary.” As previously reported, confirmed losses from the exploit have surpassed $100 million, with Galaxy Research estimating 1,596 BTC stolen from approximately 7,300 addresses. A suspected fourth wave of attacks on August 3 reportedly swept nearly 449 BTC.
Leave a Reply