Coldcard Firmware 5.6.1 Forces User Entropy Into Every New Seed After $100M Exploit

• Firmware 5.6.1 mandates at least 50 dice rolls, 128 coin flips, or 65 timed keypad presses before seed generation can complete on Mk4 and Mk5 models.
• A build error in firmware shipped from March 2021 through July 2026 routed seed entropy to an unintended software PRNG instead of hardware, reducing entropy from 128 bits to approximately 72 bits.
• Confirmed losses exceed $100 million across roughly 7,300 addresses, with attackers recovering 1,596 BTC in at least four separate waves between July 30 and August 3.

• 594.5 BTC swept from 500 addresses on initial exploit date of July 30
• 72 bits of entropy generated versus intended 128-bit standard in affected seeds
• 7,300 addresses impacted across four confirmed attack waves through August 3

Coinkite disclosed on August 13 that a firmware build failure had diverted seed entropy generation away from Coldcard’s hardware true random number generator (TRNG) into MicroPython’s Yasmarang software PRNG, a cryptographically weak alternative that left all seeds generated between March 2021 and July 2026 vulnerable to practical recovery.

The defect, traced to a disabled security flag during compilation that went undetected through the device’s boot verification sequence, opened a window spanning roughly five and a half years during which attackers could enumerate the reduced seed space and derive private keys.

On July 30, confirmed losses began accumulating rapidly: 594.5 BTC was swept from 500 addresses in the initial attack, followed by waves totaling 1,596 BTC across approximately 7,300 addresses by August 3, making this one of the largest institutional custody failures in recent blockchain history.

Build Error Disabled Hardware RNG Path, Routing Seeds Through Weak Software Generator

The technical root cause was straightforward but devastating: a configuration flag meant to enforce hardware-only entropy was left inactive during the build process, allowing the random-number generation call to fall through to MicroPython’s Yasmarang PRNG instead of the STM32 microcontroller’s dedicated TRNG and secure elements.

Coldcard’s architecture had been designed with redundancy, entropy was meant to be drawn from both the STM32 hardware generator and two separate secure element chips, but the software path became the default when the hardware enforcement mechanism failed silently.

Yasmarang, a software-based pseudorandom number generator, is not cryptographically suitable for key material. Seeds generated through this path carried approximately 72 bits of entropy instead of the intended 128 bits, reducing the search space from 2^128 to 2^72, a difference that moved private key recovery from computationally infeasible to practical within weeks.

The flaw went unnoticed because Coldcard’s existing firmware shipped without a boot-time verification that the hardware path was actually being used; the device simply assumed its configuration was correct and proceeded to generate seeds.

Firmware 5.6.1 Adds Hardware Path Verification and Mandatory User-Supplied Entropy

The patch introduces two independent mitigations. First, Coldcard now performs a cryptographic boot check that verifies seed entropy actually reaches the hardware RNG before allowing the device to complete startup; if the path is broken or misconfigured, the device halts with an error rather than silently degrading to software generation.

Second, firmware 5.6.1 and 1.5.1Q (for the larger Q model with keyboard and QR scanning) require manual entropy injection from the user, at minimum 50 dice rolls, 128 coin flips, or 65 timed keypad presses, before any new seed can be finalized.

The user-supplied entropy is combined with refreshed hardware randomness from both secure elements, seeded at startup with a full 256-bit SHA-256 Hash_DRBG derived from NIST SP 800-90A specification. Earlier firmware had truncated the secure element output to only 32 bits; the new build uses the full digest.

For the keypad-based entropy method, Coinkite implemented a design originally proposed by developer Peter Todd that credits two bits of entropy per keypress gap, measured at CPU-cycle resolution. The first press establishes a timing reference, and each of the 64 subsequent gaps contributes to the entropy pool through high-resolution timing measurements.

Existing Seeds Remain Vulnerable; Migration Mandatory for Affected Users

Coinkite stated explicitly that “installing this update does not make an existing vulnerable seed safe.” Any Coldcard user whose device generated a seed between March 2021 and July 2026, the entire window during which affected firmware was in production, must assume that seed is compromised and create a replacement immediately, then migrate all Bitcoin holdings to a new address derived from the fresh seed.

The advisory affects Coldcard Mk4 and Mk5 models running firmware 5.6.1 and the Q model running 1.5.1Q. Older Mk2 and Mk3 models are not covered by this release; their minimum fixed version remains 4.2.0, indicating they were either unaffected or receive updates through a separate track.

Coinkite has not provided a tool to determine whether a specific device generated a vulnerable seed without external analysis, forcing users into a conservative posture: unless they can prove their device was updated before March 2021 or activated after July 2026, migration is prudent.

The scope of affected devices remains uncertain, as Coinkite has not disclosed shipment numbers or activation dates for units sold during the vulnerable period.

Second Vulnerability Discovered in Transaction Approval Process

During the post-breach investigation, Coinkite identified a second defect that would have allowed a compromised USB host, a connected desktop or laptop executing attacker code, to rewrite a transaction after the user approved it on the Coldcard display, changing the outputs without invalidating the signature.

An attacker who could intercept the USB connection could display one transaction to the user for approval, then substitute a modified version for signing, with the device’s signature applying to the attacker’s revised outputs instead.

Firmware 5.6.1 now rechecks the transaction bytes immediately before signing and halts with a “Transaction modified” warning if any discrepancy is detected.

This remediation adds a verification layer that closes the window between user approval and cryptographic signing, though it assumes the Coldcard’s display and user interface remain trustworthy, the device cannot detect a compromised host that modifies data before the initial transaction is shown.

Coinkite Publishes Independent Review Results; Audit Scope Explicitly Capped

In response to institutional custody concerns, Coinkite published a new Security Status page documenting four independent reviews, including a real-device test that observed the hardware RNG reads directly and conducted byte-for-byte verification of the signed firmware binary.

The company was transparent about limitations: the reviews represent targeted testing of specific security concerns, not a comprehensive audit of every firmware component.

One review examined hardware RNG behavior by instrumenting eight separate reads for a 32-byte seed request, validating that entropy actually originated from the STM32 and secure elements. Another rebuilt the entire firmware binary and confirmed that every byte matched the signed release, ruling out any hidden code insertion or divergence between source and compiled versions.

However, Coinkite explicitly noted these checks “are not a complete audit of every firmware binary,” leaving room for subtle logic errors or attack vectors outside the reviewed scope to remain undiscovered.

Institutional Custody Operators Face Immediate Key Rotation and Disclosure Decisions

For institutional users, cryptocurrency exchanges, custody providers, and enterprise treasuries that held Bitcoin on Coldcard devices,

Original reporting: cryptopotato.com