The Coldcard Flaw Traces to One Disabled Build Flag

The full technical account of the Coldcard hardware wallet failure, published on 1 August, comes down to a single configuration flag left switched off. A firmware integration error made in March 2021 set MICROPY_HW_ENABLE_RNG to zero in the production build, so the wallet's cryptographic library never bound to the chip's hardware random number generator and fell back to a general-purpose pseudorandom one. Every seed generated on affected devices was therefore drawn from a far smaller pool than the design intended. Roughly 40 bits of effective entropy on the Mk2 and Mk3, about 72 bits on the Mk4, Mk5 and Q, against a 128-bit target. That gap is what an attacker turned into the first sweep of vulnerable wallets at the end of July, which took 1,082.65 BTC, about $70.2 million, from 1,196 addresses in 41 minutes on 30 July.

A fallback generator that never collected fresh entropy

Coldcard's firmware uses a library called libngu for its cryptographic primitives, and libngu is meant to draw randomness from the STM32 hardware RNG, a dedicated circuit that derives unpredictable bits from physical noise. With the flag off, that binding never happened. The library used MicroPython's Yasmarang fallback instead, a pseudorandom generator that, in the researchers' description, initialized from the chip's unique identifier and timer registers and collected no fresh entropy afterward. A pseudorandom generator is deterministic by construction: the same starting state produces the same output forever, so its quality is entirely the quality of that state. Chip identifiers and timer values are neither secret nor widely varied. That left a starting state an attacker could enumerate. A build-process safeguard was meant to catch this class of mistake, but it only verified that the setting was present, not that it was switched on.

The arithmetic: why 40 bits is catastrophic and 72 is not safe

Entropy measures how many equally likely values a secret could have taken, expressed in bits, and for a seed phrase it is the only thing standing between a wallet and anyone willing to guess. A 128-bit seed, the industry target, has a search space no amount of computing power can traverse. At 40 bits the space is around a trillion candidates, small enough to enumerate on commodity hardware in hours, and that is how the July sweep cleared more than a thousand addresses in 41 minutes rather than over years. Each extra bit doubles the work. So 72 bits is vastly harder than 40, but it remains 56 doublings short of the target and inside the reach of a well-resourced adversary. Block's security team put the entropy that actually reached the final seed as low as 32 bits, and it cautioned that the upper bounds it calculated were conditional ceilings, not cryptographic security.

Generation, not behavior

Because the defect sits at the moment of key creation, no later care could compensate for it. A device kept offline and never used to sign an unfamiliar transaction is protected against the threats hardware wallets are built for, and none of that helps when the key was drawn from an enumerable set the day it was made. The affected builds are 4.0.0 through 4.1.9 on Mk2 and Mk3, fixed in 4.2.0; anything before 5.6.0 on Mk4 and Mk5; anything before 1.5.0Q on the Q; and Edge builds before 6.6.0X and 6.6.0QX. SATSCARD, OPENDIME and TAPSIGNER are not affected. The exceptions are seeds that did not rely on the device alone: users who added their own dice rolls during generation, or layered a BIP39 passphrase on top, sit outside the at-risk set.

The fix does not reach existing keys

Firmware updates stop the wallet producing weak keys. They do nothing for keys already produced, because a seed is not stored in a form software can strengthen after the fact. That makes this a migration problem instead of an update problem, scaled by the more than five years the flag went unnoticed. Publishing source code is not the same as having it read: this is the kind of open-source software most people run without ever reading it, and the flaw was one zero in a build configuration, not anything subtle in the cryptography.