How Hackers Swept $38 Million Using a “Seed Lottery” Tool: In‑Depth Coldcard RNG Vulnerability Analysis

Event Overview

On 30 July 2026 an attacker swept ~500 Coldcard wallets, moving ~594 BTC (≈ $38 M) in 25‑41 minutes. Galaxy Research later revised the total to 1,082.65 BTC (≈ $70 M) across 1,196 addresses. Transactions used a single‑output, no‑change P2WPKH format with ~30 sat/vB fee to blend with normal consolidations.

Root‑cause – macro‑comparison bug

Firmware flow

Coldcard firmware (MicroPython) should call the hardware TRNG via CHIP_TRNG_32() → STM32 RNG. In practice the call goes to rng_get() → pyb_rng_yasmarang(), a software PRNG seeded with the chip UID and SysTick.

First error – Coinkite macro

Coinkite disables the built‑in hardware RNG by defining #define MICROPY_HW_ENABLE_RNG (0). This is correct for their own RNG wrapper.

Second error – libngu guard

libngu checks only #ifndef MICROPY_HW_ENABLE_RNG, which is true when the macro is defined as 0, so compilation continues without error. The intended check should be #if !MICROPY_HW_ENABLE_RNG or #ifndef MICROPY_HW_ENABLE_RNG == 0.

Third error – MicroPython fallback

Because the macro evaluates to 0, MicroPython selects the software fallback path, returning pyb_rng_yasmarang() (a deterministic linear‑congruential generator) instead of the true hardware RNG.

Yasmarang seed composition

The PRNG pads its state with pad = UID_low32 ^ SysTick->VAL plus RTC registers. UID_low32 is fixed and observable; SysTick at cold start ranges 0‑80 000 (≈2^16.3). The effective search space is about 2^32 for Mk3 devices, reducible to 2^16‑2^20 with a measured SysTick distribution model.

Double PRNG XOR

Coldcard XORs the output of the MicroPython Yasmarang instance with a second Yasmarang instance initialized with constant values ( pad = 0x0a8ce26f, n = 69, d = 233). Both outputs are deterministic, so the final seed is fully predictable given the inputs.

Entropy loss

The 32‑byte seed contains only ~40 bits of entropy; hashing with SHA‑256 cannot increase entropy, so the resulting BIP‑39 seed inherits the same limitation.

Entropy space of Mk3

Best‑case (UID known, SysTick unknown): ~2^16.3 possibilities. Reasonable constraint (UID known, SysTick ≈2^20): ~2^20. Upper bound (UID and RTC unknown): ~2^40. BIP‑39 expects 2^128 entropy, a loss of ~88 bits.

“Seed lottery” tool

Core logic

beacon302 describes the attack as a “seed lottery”: enumerate the entire seed space, derive addresses, and check the blockchain for balances. The tool consists of four modules: space‑enumeration engine, seed generator, address‑matching oracle, and automated fund transfer.

Target address acquisition

The attacker gathers all addresses funded by vulnerable Coldcard wallets (e.g., 501 inbound transactions to bc1qnk4…), corresponding to ~500 distinct wallets.

Performance data

Single‑card throughput: 0.14 Mcand/s (RTX PRO 6000)

Full space (2^32 × 8 skip variants): ~34 h per card

20‑card cluster: ~1.7 h

50‑card cluster: ~40 min

The attack cost is negligible compared with the multi‑million‑dollar reward.

Fee choice

Using ~30 sat/vB hides the transaction among normal consolidations, does not require fast confirmation, and minimizes cumulative fees across hundreds of outputs.

Affected firmware versions

Mk1 – all versions (128‑bit entropy, safe). Mk2/Mk3 – versions ≤3.2.2 (128‑bit entropy, safe). Mk2/Mk3 v4.0.1‑v4.1.9 and Mk3 v5.0.1‑v5.0.3 have ~40 bits of entropy (critical). Mk4/Q/Mk5 v5.0.0‑v5.5.x have ~72 bits (high risk). All models fixed in v4.2.0 / v5.6.0 / v1.5.0Q+. The risk depends on the firmware used at wallet creation; upgrading does not retroactively protect existing seeds. Using >50 high‑quality dice rolls as seed input bypasses the vulnerable path.

Partial fixes in Mk4/Q/Mk5

Mk4 adds a security element that reseeds the PRNG with only 32 bits, leaving other state unchanged and not resetting the MicroPython fallback. Consequently, an attacker who knows the UID and SysTick can still reduce the search space to 2^32, enumerable in hours on modern GPUs.

Reproduction guide (research only)

Disclaimer: The following steps are for security research and learning only. Attacking vulnerable firmware wallets may be illegal.

Environment

Hardware: Coldcard Mk3 with vulnerable firmware v4.0.1‑v4.1.9.

Software: libngu (commit 537519a), MicroPython fork, Python 3.x, bip39, coincurve.

Steps

Extract the list of target addresses from the blockchain.

Measure SysTick distribution on a trusted Mk3 to build a timing model.

Enumerate possible pad = UID_low32 ^ SysTick_candidate, initialize Yasmarang, generate 32‑byte seeds, derive BIP44/49/84 addresses, and compare against the target set.

When a match is found, derive the private key, construct a single‑output transaction with ~30 sat/vB fee, sign and broadcast.

Key challenges are obtaining the device UID, constraining SysTick, and handling “skip” variants caused by uniform() retries.

Defense and mitigation

Immediate actions for affected users

Flash the repaired firmware (Mk3 → v4.2.0, Mk4/Mk5 → v5.6.0, Q → v1.5.0Q).

Generate a new seed on the updated device.

Verify the new receiving address on‑screen.

Test with a small transfer before moving the full balance.

Temporary mitigations

Use a strong BIP‑39 passphrase; PBKDF2‑HMAC‑SHA512 adds cost to bulk attacks.

Configure multi‑signature wallets that include at least one unaffected device.

Why the bug persisted for five years

The issue is a single‑character macro mistake ( #ifndef vs #if) that passed every code review and release. The open‑source firmware was examined many times, but the check only verified macro definition, not its value, so the hardware TRNG was never invoked. BIP‑39 compliance tests do not assess seed entropy, allowing the flaw to remain unnoticed.

Conclusion

The Coldcard RNG flaw reduced entropy from 128 bits to ~40 bits (Mk3) or ~72 bits (Mk4). The resulting search space (2^32‑2^40) is trivial for modern GPUs, enabling an attacker to enumerate seeds and steal millions of dollars without a zero‑day exploit or physical access.