Home›Crypto›Market Structure›Coldcard wallet exploit pushes some Bitcoin users towa…

Coldcard wallet exploit pushes some Bitcoin users toward dice-based entropy

Cointelegraph says Coldcard devices were implicated in thefts starting July 30, and attackers have since brute-forced private keys, with more than $100 million worth of BTC reported stolen.

Reported · Written up by our desk · Market Structure

Coldcard hardware wallet users are re-evaluating how their devices generate secure seed phrases after Cointelegraph linked a low-entropy issue to publicly observed thefts that began on July 30.

Cointelegraph reports that, while Coldcard was originally described as using physical processes via an STM32 “true random number generator” to produce an unguessable seed, a firmware change starting with version 4.0.1 shifted seed generation to MicroPython’s Yasmarang PRNG instead. Analysts widely characterized the swap as a pre-programmed fallback, while Cointelegraph notes that Coinkite disputed that framing and questioned whether the behavior could reflect intentional design.

According to Cointelegraph, Coinkite estimated that Mk2 and Mk3 devices generated seeds with about 40 bits of entropy, while Mk4, Mk5, and Q produced around 70 bits, both falling short of the 128 bits required for a secure 12-word seed phrase. The article adds that the resulting weakness enabled attackers to brute-force private keys and steal more than $100 million worth of BTC.

Cointelegraph also says some Bitcoin holders are turning to external physical entropy methods, such as dice throws, as a way to avoid relying on opaque device randomness. It further notes that James O’Beirne set up a site with honeypot addresses, cktripwire, to measure which wallet types attackers are actively sweeping.

Latest closeBitcoin $64,975.37 ▲1.1%

More like this

Sources