The Coldcard RNG Vulnerability: When Randomness Becomes the Weakest Link
For years, Coldcard has been regarded as one of the most security focused Bitcoin hardware wallets on the market. Its Bitcoin only design, air gapped workflow, secure elements, and emphasis on self custody made it a favorite among Bitcoin power users.
That reputation was shaken recently after reports emerged that approximately 594 BTC had been stolen from hundreds of wallets. Initial discussions across social media quickly labeled the incident a “Coldcard hack.”
The reality is more nuanced.
According to research published by Block’s engineering team, the issue appears to stem from a flaw in how randomness was generated during wallet creation. If their findings are correct, some Coldcard devices may have generated wallet seeds with significantly less entropy than users expected, making it possible for attackers to recover private keys through large scale computation.
Why Randomness Matters
Every Bitcoin wallet begins with randomness.
When a hardware wallet generates a seed phrase, it is effectively creating a secret number that should be impossible to predict. The security of Bitcoin self custody depends on that number being truly random.
A standard Bitcoin seed contains 256 bits of entropy. That means there are 2²⁵⁶ possible combinations, a number so large that brute forcing it is practically impossible.
If the randomness used to create a seed is flawed, however, the number of possible combinations can shrink dramatically. Once that happens, attackers no longer need to break Bitcoin’s cryptography. They only need to search through a much smaller set of possibilities.
What Block's Researchers Found
According to Block’s investigation, certain Coldcard firmware versions relied on a library called libngu for random number generation.
The firmware was intended to use the STM32 hardware random number generator built into the device. Instead, due to an implementation issue, it fell back to a pseudo random number generator called Yasmarang.
Pseudo random generators can produce sequences that appear random but are ultimately determined by an internal state. If an attacker can recover or narrow down that state, future outputs become predictable.
Block’s researchers found that on Coldcard Mk2 and Mk3 devices running firmware versions between v4.0.0 and v4.1.9, seed generation may have depended entirely on this fallback mechanism rather than a cryptographically secure source of entropy.
In practical terms, some wallet seeds may have been generated from a dramatically smaller search space than intended.
The 32 Bit Reseed Problem
The researchers also examined newer Coldcard devices, including the Mk4, Q, and Mk5.
These devices introduced entropy from a secure element, which sounds reassuring at first glance. However, the analysis suggests that only 32 bits of that entropy were actually injected into the internal state of the random number generator during reseeding.
To understand why this matters, consider the scale involved.
A properly generated Bitcoin seed should have approximately 256 bits of entropy.
Thirty two bits represents just over four billion possibilities.
Four billion is still a large number, but it is many orders of magnitude smaller than the security level users expect when generating Bitcoin private keys.
The researchers argue that this limitation may have reduced the number of distinct random streams available during seed generation.
Why Funds Are Being Stolen Years Later
One of the most interesting aspects of the incident is timing.
Many affected wallets were created years ago, yet the thefts are only being observed now.
This makes sense if attackers spent years building tools to reconstruct possible RNG states and derive candidate wallet seeds.
Unlike a traditional hack where attackers immediately gain access, recovering weak seeds requires significant analysis and computation. Attackers would need to:
Collect wallet data.
Reconstruct potential RNG states.
Generate candidate seeds.
Check derived addresses against blockchain activity.
Monitor balances over time.
Sweep funds once a matching seed is found.
This process could take months or even years to perform at scale.
Was Coldcard Hacked?
The answer depends on how the word “hack” is defined.
There is currently no evidence that Bitcoin’s cryptography was broken.
There is no evidence that Coldcard’s secure elements were physically compromised.
There is no evidence that attackers remotely took control of Coldcard devices.
Instead, the reported vulnerability concerns seed generation. If the randomness used to create wallet seeds was weaker than intended, attackers may have been able to recover those seeds through computation.
That is not a failure of Bitcoin itself. It is a failure in one of the most fundamental assumptions behind cryptographic security: unpredictable randomness.
Lessons for Bitcoin Self Custody
The Coldcard incident highlights an important truth that often receives less attention than hardware design or user interfaces.
Security begins with entropy.
You can have secure elements, air gapped signing, open source firmware, and advanced security features. None of those protections matter if the underlying secret was generated from predictable randomness.
For Bitcoin users, this serves as a reminder that wallet security is only as strong as the randomness used to create private keys.
Conclusion
The story is still developing, and further analysis may change our understanding of what happened.
What we know today is that researchers identified flaws in the random number generation process used by certain Coldcard firmware versions. Those flaws may have reduced the entropy available during wallet creation, potentially making some wallet seeds recoverable by determined attackers.
If these findings hold up under continued scrutiny, this incident will likely be remembered as one of the most important lessons in Bitcoin wallet security.
Not because Bitcoin was broken.
Not because hardware wallets failed.
But because a subtle mistake in randomness may have undermined one of the most fundamental assumptions in modern cryptography.
Sources
This article is based on publicly available technical research, firmware documentation, and security disclosures.