Coldcard RNG bug made many Bitcoin seeds weak

A firmware error in Coldcard hardware wallets caused the devices to use a deterministic software random-number generator when creating recovery seeds. The fallback produced weaker BIP-39 mnemonics that can be reconstructed by attackers who know the weak RNG path, allowing them to derive addresses and check the Bitcoin ledger for funds to drain.

The error appeared after seed-generation code was moved into a new library and the integration defined the hardware-RNG flag as disabled while the calling code checked only for the flag’s presence. That mismatch routed seed creation to MicroPython’s deterministic Yasmarang fallback instead of the intended hardware random-number generator. The affected code shipped in early 2021 firmwares and remained on several device models until fixes were released.

A person who can reproduce the fallback RNG sequence can generate candidate seeds on another machine, derive the corresponding public addresses and compare them to on-chain addresses. Vendor analysis estimates the effective search space was about 40 bits for some older Mk2 and Mk3 devices and about 72 bits for some Mk4, Mk5 and Q devices. A separate analysis placed some pre-fix devices inside the vulnerable range by counting the number of securely distinguished RNG streams available in the fallback state.

Published firmware ranges tied to the bug include Mk2 and Mk3 versions in the 4.0.x series and Mk4/Mk5 and Q firmware before the fixed releases. Reported boundaries differ on exactly which early 4.0.x build introduced the path; vendors and security teams advise treating the earlier boundary conservatively. Updating to a patched release prevents new seeds from being created with the flaw, but any seed already generated on an affected device retains its original entropy.

Owners who used affected firmware are advised to create a new seed with updated firmware and trusted entropy, then move funds to addresses derived from that new seed. Generating new addresses from the compromised mnemonic preserves the original weakness and does not protect funds.

One security research group estimated roughly 1,367 BTC suspected stolen across several thousand addresses as of early August. Chain analysis also shows a much larger volume of older coins moved following the disclosure; those movements include precautionary migrations as owners transferred funds out of addresses created on early-generation devices.

Coldcard’s documentation describes an owner-controlled alternative: entering entropy via physical dice. A fair six-sided die provides about 2.585 bits of entropy per independent roll, so roughly 50 independent rolls yield about 129 bits of raw entropy (the target for a 12-word BIP-39 phrase) and about 99 rolls approach 256 bits for a 24-word phrase. The vendor’s guidance states migration may be unnecessary only when a user can prove the final seed incorporated at least 50 fair, independent and private dice rolls following the device’s procedure.

Other protections affect different risks. A BIP-39 passphrase adds an additional secret an attacker must find after recovering a mnemonic; a device PIN limits device access but does not increase the seed’s entropy. Loss of an unrecoverable passphrase can permanently block access to funds.

Weak randomness at seed creation has occurred in other wallet software and tools in the past, producing apparently normal recovery words that actually came from a much smaller set of possible secrets. Security teams recommend users update firmware, verify whether their device and firmware version are affected, and, when doubt remains about a seed’s origin, create a new seed with verified entropy and move funds to it.