Hackers Steal Over $130M Exploiting RNG Vulnerability in Offline Coldcard Wallets
A critical firmware defect in Coinkite's Coldcard hardware devices allowed cybercriminals to brute-force seed phrases and drain air-gapped Bitcoin wallets globally.
Cybercriminals have stolen more than $130 million in Bitcoin by exploiting a fundamental flaw in the random number generator (RNG) of Coldcard hardware wallets, according to blockchain security monitoring firms and independent researchers.
The vulnerability compromises one of the crypto industry's primary security paradigms: using "air-gapped" offline hardware devices to keep private keys safe from remote internet attacks.
🔓 How the RNG Fallback Flaw Worked
Security researchers at Block revealed that the vulnerability stemmed from a predictable RNG fallback and 32-bit reseed flaw in Coldcard's device firmware.
Instead of generating cryptographically secure, unpredictable entropy for user seed phrases, the hardware device produced seed phrases with significantly reduced mathematical entropy under certain initialization states.
+-----------------------+ Predictable RNG Fallback +-----------------------+
| Coldcard Firmware | -----------------------------> | Low-Entropy Seed Pool |
| (Air-Gapped Device) | | (32-Bit Reseed Flaw) |
+-----------------------+ +-----------+-----------+
|
| Brute-Force Key Search
v
+-----------------------+
| Attackers Reconstruct |
| Private Seed Phrases |
+-----------+-----------+
|
| Drain Funds
v
+-----------------------+
| $130M+ Stolen On-Chain|
+-----------------------+
🚨 Devastating Impact on Cold Storage Security
Because the seed generation entropy was limited, hackers did not need to physically steal or compromise the hardware units. Instead, attackers pre-computed and brute-forced possible key combinations offline before submitting automated transaction requests directly to the Bitcoin network.
Key attack highlights include:
- Total Reported Losses: Exceeding $130 million across dozens of high-value wallets.
- Target Device: Coldcard hardware wallets manufactured by Coinkite.
- Attack Vectors: Pre-computation of low-entropy master seed phrases without physical device access.
- Victim Demographics: Individual holders storing funds in bank vaults and physical safes who followed standard security protocols.
🛑 Industry Reaction & Remediation
Galaxy Research noted that multiple threat groups are actively running automated scripts to drain vulnerable addresses. Security teams strongly urge all Coldcard users to audit when their seed phrases were generated, upgrade to patched firmware immediately, and migrate funds to fresh wallets generated with multi-source entropy.
🔮 What's Next for Hardware Security
The breach serves as a stark reminder that physical isolation (air-gapping) offers no protection if underlying cryptographic primitives are compromised during initial key generation. Moving forward, security experts advocate for multi-vendor multisig setups, requiring signatures from hardware devices produced by different manufacturers to prevent single points of failure.
🔗 Reference
- Original Article: Read the full story on TechCrunch
