Hardware wallet manufacturer Coinkite disclosed that some Coldcard devices used an incorrect random number source when generating seeds, resulting in insufficient randomness in the mnemonic phrase. The company estimates that this issue has been exploited, with approximately 594 bitcoins being transferred from about 500 wallets within 25 minutes.
The vulnerability lies in the random number call.
Coinkite stated that the firmware was supposed to call the hardware random number generator, but a software fallback implementation from MicroPython also existed in the codebase, and both had the same function signature. Because the preprocessing checks during the build only checked whether the setting existed and did not verify the value, the device ultimately went to the software fallback path without reporting an error.
The company stated that this issue has existed since a migration in March 2021. As a result, the seed entropy generated by the device is lower than the design target, making it easier for attackers to guess the private key through brute force.
Mk3 has the highest risk
Coinkite states that all current Coldcard devices are affected to varying degrees. Mk3's effective search space is approximately 40 bits, significantly lower than the required 128-bit strength for a seed. Mk4, Q, and Mk5, due to the added entropy from the secure element, can achieve a strength of approximately 72 bits, but still fall short of the target level.
- Mk3: Effective strength approximately 40 bits
- Mk4, Q, Mk5: Approximately 72 bits
- Tapsigner, OpenDime, and Satscard were unaffected.
You still need to change the seed after upgrading.
Coinkite has released an emergency hotfix, including version 5.6.0 for Mk4 and Mk5, and version 1.5.0Q for the Q model. However, the company emphasizes that upgrading the firmware will not fix previously generated torrents, and affected users will still need to regenerate new mnemonic phrases.
The company recommends that users migrate their funds after patching, and in conjunction with using a stronger BIP-39 passphrase, introducing additional entropy through at least 99 dice rolls, or both. Mk3, being no longer supported, requires a separate migration path.
The manufacturer mentioned that AI may be involved in discovering vulnerabilities.
Coinkite stated that the company can currently only assume that attackers discovered the issue by using AI to review its past open-source firmware versions. The company said it had also used a leading model to examine the same code a few weeks ago, but did not detect the vulnerability at that time.
Trezor subsequently reminded users that its products were unaffected, noting that even after restoring weak seeds generated on affected Coldcards to other brands of devices, the seeds themselves remained fragile. Block, after independent analysis, also stated that its products were unaffected by this incident.
