COLDCARD flaw may have exposed Bitcoin wallet seeds for years

A firmware flaw affecting COLDCARD hardware wallets may have caused some devices to generate predictable Bitcoin wallet seeds, potentially putting users’ funds at risk years after the wallets were created.

It you aren’t familiar, COLDCARD is a Bitcoin-only hardware wallet made by Coinkite, a Canadian security company. The device is designed to keep private keys away from internet-connected computers and supports air-gapped signing, MicroSD transactions, multisignature wallets, secure elements, and dice-based seed generation.

Those protections depend on the wallet creating a secure seed in the first place. Block’s Bitcoin Engineering and Security teams, working with anonymous researchers, say they traced a serious random number generation problem to COLDCARD firmware. In its technical analysis, Block says affected firmware used a deterministic software generator instead of the STM32 processor’s hardware random number generator.

A Bitcoin seed is the master secret used to derive a wallet’s private keys and addresses. Anyone who can reproduce it can control the associated funds without possessing the COLDCARD, knowing its PIN, or seeing its recovery words.

Coinkite warns Mk3 users to move their Bitcoin

Coinkite has now published an Mk3 security advisory warning users who generated a seed on a COLDCARD Mk3 running firmware version 4.0.1 or later.

The issue remained present through firmware version 5.0.3, the final release supporting the Mk3, according to Coinkite. Exposure depends on the firmware installed when the seed was created, not when the device was manufactured.

Coinkite says affected users should migrate to a new seed generated on an unaffected device. The company recommends recording and verifying the new backup, checking a receive address on the COLDCARD screen, sending a small test transaction, and moving the remaining funds only after confirming everything works.

Installing newer firmware does not repair a seed that has already been generated. Importing the same recovery phrase into another hardware wallet or software wallet does not help either because the replacement device still uses the same underlying secret. Users must create an entirely new seed and transfer the funds to addresses derived from it.

The firmware reportedly used the wrong random generator

Block says the regression entered COLDCARD firmware in March 2021, when wallet generation moved away from the device’s separate hardware random number generator and began using a function that reached a software fallback called Yasmarang.

That generator initialized itself using part of the device’s fixed identifier and timer values. Those inputs may vary, but they are not proper sources of cryptographic randomness.

Block says wallet generation can become deterministic when the device identifier, timer state, and previous random number calls are known or sufficiently narrowed. An attacker could then generate possible seeds offline and compare the resulting addresses or public keys against the victim’s wallet.

The real-world cost of such an attack would depend on how much information the attacker has about the device and its state. Block also says it has not completed full empirical testing of every attack described in its report. The company nevertheless published its findings early because researchers believe active exploitation is underway.

Block and Coinkite disagree about newer models

Coinkite says the COLDCARD Mk4, Q, and Mk5 are not affected based on its early analysis. The company’s investigation remains ongoing, and it plans to publish a formal technical review.

Block takes a more cautious view of those newer devices. Its researchers say the Mk4, Q, and Mk5 add information from secure elements during startup, but reduce that material to four bytes before reseeding the software generator.

Four bytes provide no more than 32 bits of secure input. For a fixed generator state and call history, Block says this leaves no more than 2^32 securely distinguished output streams, with an attacker testing roughly 2^31 candidates on average.

That is far below the protection expected from a properly generated 256-bit wallet secret. Hashing the output afterward cannot restore randomness that was never present.

For now, claims involving the Mk4, Q, and Mk5 should remain attributed to Block. Coinkite disputes that those models are affected, while Block has not yet demonstrated a complete seed-recovery attack against each current device.

Passphrases may reduce the risk

Coinkite says Mk3 users who protected an affected seed with a strong BIP39 passphrase face minimal risk based on its early analysis. This refers to an additional passphrase used with the recovery words, not the COLDCARD PIN.

Every BIP39 passphrase creates a separate wallet, including a mistyped passphrase. Coinkite advises users to store it separately from the seed, confirm the wallet fingerprint after entering it, and never type it into a website or untrusted device.

For users unable to move immediately to a newer device, Coinkite suggests creating a strong and unique BIP39 passphrase on the Mk3 and transferring funds from the original wallet into the passphrase-protected wallet. The company describes this as an interim measure, not a permanent replacement for migrating to a newly generated seed.

Advanced users can also create a dice-only seed on an empty Mk3 running firmware 4.1.9. Coinkite says entering at least 99 independent rolls of a fair six-sided die through the dedicated import option bypasses the affected random number generator.

That process leaves little room for mistakes. Users must verify backups, wallet fingerprints, and receive addresses before erasing or replacing any seed.

More than wallet seeds may be affected

Block says the same random stream may also have been used for paper-wallet private keys, Seed XOR masks, cloning encryption, temporary encryption keys, Web2FA secrets, and generated passwords. The impact varies by feature, but the underlying problem is the same. Values expected to be secret may have come from a much smaller and more predictable set of possibilities than users believed.

Hardware wallets are supposed to protect private keys from attackers. Secure elements, air gaps, and isolated transaction signing cannot protect a key that was predictable from the moment it was created.

Coinkite has acknowledged the Mk3 risk and is telling affected users to migrate. The remaining question is whether the problem ends with that discontinued model or also reaches newer COLDCARD hardware, as Block’s researchers contend.