Predictable RNG Fallback and 32-Bit Reseed in Coldcard Firmware
6 hours ago
- Block's Bitcoin Engineering and Security teams identified vulnerabilities in COLDCARD firmware allowing Bitcoin theft.
- Vulnerability stems from an RNG integration error where ngu.random uses a deterministic Yasmarang fallback instead of the hardware RNG.
- Affected devices include Mk2/Mk3 v4 (no secure reseed), Mk4/Q/Mk5 (limited 32-bit reseed), while Mk1 and older firmware are unaffected.
- Exposure depends on firmware used during secret generation; upgrading does not retroactively fix existing seeds.
- Attackers with knowledge of device UID, timer state, and RNG call history can reproduce wallet seeds offline.
- For Mk2/Mk3 v4, deterministic output; for current devices, search space is at most 2^32 due to limited reseed.
- Impact includes theft of wallet seeds, paper wallet private keys, seed XOR masks, and other cryptographic material.
- Block recommends referring to Coinkite's definitive report for full details.