Hackers have stolen around $130 million in bitcoin from owners of Coldcard hardware wallets, according to Galaxy Research, by exploiting a firmware bug that made the wallets’ seed phrases predictable. Tom Robinson, co-founder and chief scientist of Elliptic, told TechCrunch the estimate is roughly correct. At least a dozen different hackers or groups are said to be involved.
The devices themselves weren’t hacked or remotely accessed, Coinkite said in its security advisory. The problem is in how affected firmware generated seeds, which attackers can recreate offline and match against funded addresses on the blockchain.
The bug
Researchers at Block traced it to an integration error. Coldcard’s production board configuration sets the macro MICROPY_HW_ENABLE_RNG to zero, because Coldcard has its own hardware RNG wrapper, but the libngu library only checked whether the macro was defined, not whether it was enabled. As a result, its random function fell back to MicroPython’s Yasmarang software generator, initialized from the chip’s unique ID and timer registers, instead of the STM32 hardware random number generator, according to Block’s technical write-up. The change traces to a commit dated March 1, 2021.
On Mk2 and Mk3 firmware 4.x, Block found no cryptographic entropy was added at all. On the Mk4, Q and Mk5, secure-element entropy is mixed in but only 32 bits of it survive. “An attacker who can determine or sufficiently constrain the device UID, timer state and RNG-call history can reproduce the fallback stream offline,” Block wrote, while cautioning that this doesn’t mean every attacker can immediately recover every seed. Coinkite puts the newer models at about 72 bits of entropy instead of the expected 128.
Affected seeds are those generated on Mk2 or Mk3 firmware 4.0.1 through 4.1.9, on Mk4 and Mk5 before 5.6.0 (Edge 6.6.0X), and on Q before 1.5.0Q (Edge 6.6.0QX). TAPSIGNER, OPENDIME and SATSCARD use different code and aren’t affected.
The thefts
Galaxy Research found that a sweep on July 30 drained more than 1,000 bitcoin from 1,196 wallets in 41 minutes, worth about $70 million, and later tied two more waves to the attack, bringing losses to nearly $89 million before the estimate rose to about $130 million, Fox Business reported.
“Perhaps the hardest part about this is that I did everything right,” Jonathan Goodman, who said he lost $1.6 million, wrote on X. “None of it mattered. All because the hardware that created the seed phrase originally had one line in their code from 2021 that had a vulnerability.”
Coinkite CEO Rodolfo Novak apologized on X. “I’m sorry and I’m devastated,” he wrote. “If you generated a seed using a Coldcard wallet, move your funds now, using our updated best practices, before reading further.” Novak said the company would publish a detailed explanation once its investigation is complete.
What owners need to do
Fixed firmware is out for every affected model, including 4.2.0 for the Mk2 and Mk3, but Coinkite says updating doesn’t repair a seed that was already generated. Owners need to install the fix, generate a new seed, verify its backup and move their funds. Coinkite doesn’t consider seeds at risk from this bug if they were created with at least 50 fair, independent, private dice rolls. A strong, unique BIP-39 passphrase adds a separate barrier, though Coinkite still advises passphrase users to migrate.
The thefts add to a heavy year for crypto crime: TRM Labs counts more than 200 hacks of cryptocurrency companies so far, with losses above $950 million.
WebProNews is an iEntry Publication