Coldcard Bitcoin Exploit Explained: Entropy, How Keys Are Generated, and Why Bits Matter

Decrypt08-04 19:11

In brief A firmware bug meant Coldcard wallets generated seeds from a software pseudo-random generator instead of the hardware chip built to do the job. The bug effectively shrank the search space ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2657568566?lang=en_US&edition=fundamental","thumbnail":"https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2025/05/Bitcoin-decrypt-style-04-gID_7.png@webp","is_english":true,"pubTime":"2026-08-04 19:11","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2657568566","market":"nz","top_or_hot":-1,"title":"Coldcard Bitcoin Exploit Explained: Entropy, How Keys Are Generated, and Why Bits Matter","media":"Decrypt","content":"<div>\n<p>In brief\nA firmware bug meant Coldcard wallets generated seeds from a software pseudo-random generator instead of the hardware chip built to do the job.\nThe bug effectively shrank the search space ...</p>\n\n<a href=\"https://decrypt.co//374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits\">Source Link</a>\n\n</div>\n","source":"decrypt_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Coldcard Bitcoin Exploit Explained: Entropy, How Keys Are Generated, and Why Bits Matter</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nColdcard Bitcoin Exploit Explained: Entropy, How Keys Are Generated, and Why Bits Matter\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-08-04 19:11 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://decrypt.co//374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits><strong>Decrypt</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>In brief\nA firmware bug meant Coldcard wallets generated seeds from a software pseudo-random generator instead of the hardware chip built to do the job.\nThe bug effectively shrank the search space ...</p>\n\n<a href=\"https://decrypt.co//374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"BTRN","symbol_name":"比特币期货ETF-Global X","start_time":0,"source_url":"https://decrypt.co//374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits","article_id":"2657568566","we_media_id":null,"thumbnails":["https://img.decrypt.co/insecure/rs:fit:3840:0:0:0/plain/https://cdn.decrypt.co/wp-content/uploads/2025/05/Bitcoin-decrypt-style-04-gID_7.png@webp"],"rights":{"source":"decrypt_highlight","url":"https://decrypt.co//374916/coldcard-bitcoin-exploit-explained-entropy-keys-bits","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2657568566","pubTimestamp":1785841896,"columns":[],"sourceInfo":{"source_id":"decrypt_highlight","name":"Decrypt"},"weMediaInfo":null,"summary":"A flaw in Coldcard wallets cost Bitcoin holders more than $100 million—and reopened an old fight about whether you can trust dice.","collect":0,"end_time":0,"defaultTopTitle":"decrypt.co","property":[],"viewcount":null,"language":"en","relate_stocks":{"BTRN":"比特币期货ETF-Global X","YBTC":"比特币看涨期权ETF-Roundhill","BITI":"1倍做空比特币期货ETF-Proshares","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","BTCW":"比特币ETF-Wisdom Tree","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","BITO":"比特币期货ETF-ProShares","BCCC":"Global X Bitcoin Covered Call ETF","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","SBIT":"2倍做空比特币期货ETF-Proshares","BTC":"Grayscale Bitcoin Mini Trust","MAXI":"比特币期货ETF-Simplify","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","MNRS":"GRAYSCALE BITCOIN MINERS ETF","BTCC":"Grayscale Bitcoin Covered Call ETF","BITU":"2倍做多比特币期货ETF-Proshares","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","IBIT":"比特币ETF-iShares","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","BTCI":"NEOS Bitcoin High Income ETF","DEFI":"比特币期货ETF-Hashdex","BPI":"Grayscale Bitcoin Premium Income ETF","BETE":"等权重比特币&以太币期货ETF-ProShares","BTF":"比特币&以太币期货ETF-CoinShares","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","HODL":"比特币ETF-VanEck","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BRRR":"比特币ETF-CoinShares","BITX":"2倍比特币期货ETF-Volatility Shares","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","EZBC":"比特币ETF-Franklin","BETH":"比特币&以太币期货ETF-ProShares","BTFX":"比特币期货ETF-CoinShares","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","BTCO":"比特币ETF-Invesco Galaxy","GBTC":"比特币ETF-Grayscale","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","BITB":"比特币ETF-Bitwise","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October"},"translate_title":"Coldcard 比特币漏洞解释：熵、密钥如何生成以及为什么位很重要","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"XBTY":0.6,"MNRS":0.6,"BTCC":0.6,"BTRN":0.6,"CBXO":0.6,"BETE":0.6,"DFII":0.6,"CBXJ":0.6,"CBTA":0.6,"BTCW":0.6,"CBTO":0.6,"BTC":0.6,"BETH":0.6,"IBIT":0.6,"BTFX":0.6,"SBIT":0.6,"BAGY":0.6,"BTF":0.6,"CBOA":0.6,"CBOJ":0.6,"CBXY":0.6,"BTCI":0.6,"BTCL":0.6,"BTCO":0.6,"CBOY":0.6,"GBTC":0.6,"BRRR":0.6,"DEFI":0.6,"BPI":0.6,"CBTY":0.6,"CBXA":0.6,"BCCC":0.6,"BITO":0.6,"BITY":0.6,"BITB":0.6,"CBTJ":0.6,"MAXI":0.6,"BTCZ":0.6,"YBTC":0.6,"BITX":0.6,"BFJL":0.6,"BITI":0.6,"BFAP":0.6,"QBF":0.6,"EZBC":0.6,"BITU":0.6,"HODL":0.6,"CBOO":0.6},"content_text":"In brief\nA firmware bug meant Coldcard wallets generated seeds from a software pseudo-random generator instead of the hardware chip built to do the job.\nThe bug effectively shrank the search space from 128 bits to roughly 40 on older models. \nHere's what all that means, and how it led to over $130 million in Bitcoin stolen.\nSomebody has been emptying Bitcoin wallets that were never supposed to be reachable.The coins sat on Coldcard devices—hardware wallets from Canadian manufacturer Coinkite, the kind that never touch the internet. No phishing link. No malware. No stolen laptop. The attackers simply worked out what the private keys were.Galaxy Research has now tracked more than 1,596 BTC stolen across three confirmed waves, with a suspected fourth wave that would lift the total to roughly 2,055 BTC—about $130 million at current prices. One sweep moved $70 million in 41 minutes. Coinkite says at least 15 separate attackers have piled in.The company published a technical backgrounder on August 1 explaining what went wrong. It is an unusually candid document, and the short version is that the wallet was rolling loaded dice for eight years without anyone noticing.Zero is still somethingIn 2021, Coinkite moved Coldcard's cryptography onto libsecp256k1, the same library Bitcoin Core uses. Sound decision. The integration is where it fell apart.The migration quietly rerouted seed generation away from Coldcard's own hardware random number generator and onto MicroPython's software fallback—a small algorithm called Yasmarang that exists for devices with no randomness chip at all.\n🚨LOSSES FROM COLDCARD HACK EXCEED $100M \nHigh confidence 1,596 BTC has been stolen from ~7300 addresses across 3 confirmed waves + more 14 smaller incidents. \nIf we add suspected (but unconfirmed), the total balloons to $130m (2k BTC).\nMore in the thread below 👇 pic.twitter.com/RAl3ib67qa\n— Galaxy Research (@glxyresearch) August 3, 2026Coldcard has a randomness chip. It just stopped being asked.The reason is almost too small to believe. A build guard used #ifndef, which checks whether a setting exists rather than whether it's switched on. Coinkite had defined that setting as zero, meaning \"off.\" Because zero still counts as defined, the safety check passed and the build completed. Both versions of the function had identical signatures, so nothing looked wrong.\"The bulk of randomness on the COLDCARD was coming from a PRNG that I didn't know was actually in the source code base,\" Coinkite wrote, referring to a pseudo-random number generator—software that produces numbers that look random but follow a fixed recipe from a starting value.Feed the recipe the same starting value and you get the same output. Every time.On Mk2 and Mk3 devices running firmware 4.0.1 through 4.1.9, that starting value came from the chip's serial number and its clock. Coinkite estimates the resulting search space at about 40 bits. Newer models mixed in a little secure-element entropy, lifting them to roughly 72 bits.Neither is 128, the target.The gap matters more than it looks. Bits are exponents. A 128-bit search space holds more combinations than there are atoms in the observable universe, and nobody is searching it. Forty bits is about a trillion—a number a decent laptop can chew through. Each bit you lose halves the work.Block's engineering team, which published its own analysis, put the newer devices' effective secure-element search space at 2^32 candidates, averaging around 2^31 trials. Their assessment for the older boards is blunter: for a known device ID, timer state and call history, wallet generation is deterministic.And deterministic is the opposite of random, which is essential to cryptography.Not \"weak.\" Predictable.Coinkite suspects it was found by machine. \"We have to assume that someone used AI to review previous versions of our firmware and stumbled upon this issue,\" the company wrote, adding that it had recently run one of the best available AI models over the same code and turned up nothing. \"Both attackers and defenders have the same AI tools, but today it did not help us, and only helped the bad guys.\"Fixed firmware is out for every affected model. It does not repair existing seeds; those wallets have to be regenerated and the funds moved. Decrypt has covered how air-gapped storage changes after an exploit like this and tracked the losses climbing past $114 million.What entropy actually isEntropy is the measure of how much an attacker doesn't know.In other words, it's basically uncertainty, counted in bits. One bit is one coin flip: two outcomes, and a guesser gets it right half the time. Ten bits is 1,024 outcomes. Each bit doubles the guesser's workload.A Bitcoin wallet is a very large number kept secret. The address people send coins to is derived from it mathematically, and the derivation runs one way only—you can go from key to address, but never back.So the security of every wallet rests on one question: How many numbers would an attacker have to try?If the number was picked with 128 bits of entropy, the answer is \"more than physics permits.\" If it was picked with 40, the answer is \"give me some time.\"This is the same property that makes the quantum computing threat worth arguing about—a quantum machine would attack the math that links key to address. The Coldcard bug never needed to. It made the keys guessable before that math got involved.This is where the vocabulary gets slippery. A pseudo-random generator produces output that passes statistical tests for randomness, so basically nothing a spreadsheet would flag. That output is still fully determined by its seed value. It looks random but isn't.Statistical randomness and cryptographic unpredictability are different properties, and Coldcard's output would have sailed through the first test while failing the second completely.True randomness has to come from physical noise: electrical jitter in a circuit, thermal fluctuation, radioactive decay. That's what the hardware chip on the Coldcard was for. That's the chip the build flag disconnected.Then Luke Dashjr brought up the diceAs users scrambled to regenerate seeds, many reached for the obvious low-tech fix. Coldcards let you roll physical dice and feed the results in as entropy. Coinkite's own guidance treats seeds made with at least 50 independent, private dice rolls as not at risk from the bug.It may sound stupid, but the company actually sells a bag with \"100 cute and tiny little dice\" to make the whole process easier for you.On July 31, Bitcoin Core developer Luke Dashjr posted a warning: \"Quite a few people suggesting/using dice to mitigate the Coldcard vulnerability. Note that common dice are not designed to be cryptographically secure. If you are going to do this, you probably should buy precision casino dice. And even then, have another source of entropy.\"Bitcoin Twitter did not take it calmly.\"lol now you can't even roll dice,\" one user wrote. \"Self custody is done for…\" Another asked whether he should hire someone with Parkinson's to throw them. (Not nice.)\nshould I hire someone with parkinsons to throw the dice?\n— Murern (@Bitcoin_Murern) July 31, 2026Probably the most useful reply came with arithmetic. Developer Justin Sharp ran the numbers on exactly how much a bad die costs you:\"Overkill. A perfect d6 gives 2.585 bits per roll. A noticeably biased die, e.g. with one face landing 20% of the time instead of 16.7%, still gives about 2.55 bits. Across 99 rolls that's the difference between ~256 bits and ~252 bits of entropy.\"Four bits out of 256. That's the whole penalty for a visibly unfair die.Dashjr isn't wrong that cheap dice have measurable bias—injection-molded pips remove slightly different amounts of plastic from each face, which is precisely why casinos use flush-filled precision dice. He's right about the physics and wrong about the stakes. Losing four bits from 256 leaves you at 252. Coldcard's bug left users at 40.There's a sharper argument buried in his advice, though, and it isn't about manufacturing tolerance. It's about not trusting any single source. Coldcard's failure wasn't that its entropy was slightly biased—it was that one component silently stopped contributing and nothing caught it.What to do about itIf you generated a seed on an affected Coldcard without dice rolls (really) or a strong BIP-39 passphrase, that seed is compromised.Update the firmware, generate a new seed, verify the fingerprint, send a test transaction, then move everything. Coinkite's advisory walks through it model by model. Exported seeds carry the flaw with them—moving a bad seed into a different wallet app doesn't solve anything.For everyone else, the takeaway isn't that hardware wallets are broken or that dice are a trap.It's that \"random\" is a claim, and claims need checking. Coldcard's source code was public the entire time. The intended hardware RNG was sitting right there in the binary. Reviewers confirmed it existed and never confirmed the seed generator actually called it.Eight years of audits looked at the right code. Nobody checked whether it ran.Daily Debrief NewsletterStart every day with the top news stories right now, plus original features, a podcast, videos and more.Your EmailGet it!Get it!","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":false,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"isLaohu8Offline":false,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.47.0","shortVersion":"4.47.0","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2657568566","isCrawlerRequest":true}