COLDCARD Predictable RNG: From Seed Recovery to About $8.86M Bitcoin Theft

COLDCARD Predictable RNG: From Seed Recovery to About $8.86M Bitcoin Theft 1. Basic Information Article Title : COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft Source : BleepingComputer Publication Date : August 2, 2026 Severity : Urgent Original Link : https://www.bleepingcomputer.com/news/security/coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft/ Related Sources : Block Engineering "Predictable RNG Fallback and 32-Bit Reseed in COLDCARD Firmware": https://engineering.block.xyz/blog/predictable-rng-fallback-and-32-bit-reseed-in-coldcard-firmware Coinkite "Coldcard Security Advisory": https://blog.coinkite.com/coldcard-mk3-seed-generation-warning/ Related Malware / Threat Actors : Unknown. The attack may not require malware or phishing. CVE : None assigned at the time of publication Related Products : COLDCARD Mk2/Mk3 4.0.0–4.1.9, Mk4/Mk5 below fixed versions, Q below fixed versions. TAPSIGNER, OPENDIME, and SATSCARD are considered unaffected. Relation to Real Exploitation : Strongly suspected to be linked to the theft of a total of 1,367 BTC (approx. $88.6 million at the time of reporting) observed between July 30 and August 1, 2026. However, cryptographic or investigative confirmation of the attacker exploiting the vulnerability has not been officially established. 2. Executive Summary Due to a conditional branching error in the COLDCARD firmware, wallet seed randomness became deterministic or fell into a narrow candidate space. This may have allowed attackers to use public Bitcoin addresses as a verification oracle to offline-reproduce seeds and private keys, moving funds without ever breaking into the physical devices. 3. Attack Flow Chain A: Fund Theft from Existing Wallets (Chain Suspected to be Linked to Real Damage) A user generates a new seed, paper wallet, or related key material on an affected firmware version. The firmware uses the MicroPython Yasmarang fallback instead of the hardware RNG where it should use it. On