Coldcard Firmware Açığıyla 70 Milyon Dolar Çalındı: 41 Dakikada 1.196 Cüzdan Boşaltıldı

A separate earlier wave of the same exploit swept 594 BTC (~$38 million) from about 500 single-signature wallets in a 25-minute burst around 01:31 UTC . Galaxy Research, Chainalysis, and Block's engineering team all independently linked the thefts to the same Coldcard vulnerability .

How the Attacker Used a Blockchain Analytics Service

Block's Bitcoin Engineering and Security team, led by engineer Clay Garrett, identified that the attacker used a paid account at a well-known blockchain-services provider to efficiently identify and query vulnerable addresses . The attacker's on-chain pattern — unusually rapid, sequential sweeps of addresses sharing the same weakness — tipped off investigators. Block confirmed trace evidence connecting the operator's activity directly to that provider's infrastructure .

Block's investigation found what Garrett described as "extraordinary specificity, down to the account level" . The analytics service effectively served as a reconnaissance tool, letting the attacker quickly map which addresses were generated on vulnerable firmware and prioritize the richest targets .

Root Cause: A Single Preprocessor Mistake

The bug was introduced in a March 2021 firmware commit (beginning with Mk3 firmware version 4.0.1) during a migration to Bitcoin Core's libsecp256k1 library . A build-configuration macro error caused the firmware to bypass the device's dedicated STM32 hardware random number generator (TRNG) and instead fall back to MicroPython's deterministic Yasmarang software RNG .

The production board configuration set MICROPY_HW_ENABLE_RNG to zero because Coldcard had a separate hardware-RNG wrapper. But the libngu library failed to call that wrapper correctly: its guard condition (#ifndef MICROPY_HW_ENABLE_RNG) tested only whether the macro was defined, not whether its value was non-zero . Because the macro was defined (set to zero), libngu silently concluded the hardware path was available and bound to MicroPython's software-based rng_get() function .

This reduced effective entropy to roughly 32–40 bits (down from the intended 128+ bits), meaning only about 4 billion possible seed values — trivially brute-forceable with modern hardware . Seeds generated without user-added dice rolls or a BIP 39 passphrase were fully exposed .

Coinkite CEO Rodolfo Novak (NVK) later acknowledged the error: "I explicitly set MICROPY_HW_ENABLE_RNG to zero, thinking we didn't need either version, but that's not what it does" .

Affected Devices and Firmware

Coinkite later expanded its advisory to include certain Mk4, Mk5, and Q firmware versions after further analysis, and released emergency firmware updates for all affected models .

Implications for Affected Users

• Funds are unrecoverable. The stolen bitcoin has been consolidated and is likely being laundered through standard mixing services .
• Even after applying the firmware patch, old seeds remain compromised. Users must generate an entirely new seed on patched firmware and sweep all funds to new addresses .
• Users who generated seeds on Mk3 between March 2021 and July 2026 must treat those seeds as burned, even if they haven't lost funds yet — their wallets remain exposed to the same attack .
• Extra passphrases or user-supplied dice rolls mitigated the bug and protected some users even on vulnerable firmware .

Implications for the Self-Custody Debate

This exploit has shaken one of the core promises of self-custody — that a hardware wallet's secure element guarantees cryptographic safety regardless of software bugs .

• Cold storage is not failsafe. Binance founder Changpeng Zhao (CZ) publicly warned that even air-gapped hardware wallets can be rendered insecure by firmware flaws .
• The debate is now pivoting toward whether self-custody is worth the operational risk for average investors. Some analysts predict a shift back toward regulated custodians and Bitcoin ETFs as a result .
• The bug sat undetected in open-source code for over five years, showing that open-source transparency alone does not guarantee security. Some researchers now argue that AI-driven automated auditing — rather than human-only code review — is needed to catch subtle RNG integration errors before they are exploited .
• The incident also highlights a single point of failure: if a hardware vendor makes one entropy mistake, every wallet generated on that firmware is simultaneously vulnerable — a systemic risk that custodial solutions partially hedge through key-splitting and multi-party computation.

For a detailed technical breakdown, see Block's engineering report and Coinkite's technical backgrounder .