Coldcard's Five-Year Vulnerability: RNG Failure, Four Suspected Attack Waves, and the Self-Custody Debate

§ 01 Executive Snapshot

• What: Coldcard has experienced a critical vulnerability in its random number generation (RNG) that has lasted five years, affecting the security of mnemonic phrases.
• Who: The incident involves Coldcard, Coinkite, Galaxy Research, and affected Bitcoin users.
• Why it matters: This vulnerability raises significant concerns about the reliability of hardware wallets and the broader implications for self-custody practices in the Bitcoin community.

§ 02 Key Developments

• A firmware migration error routed wallet seed generation through a software pseudorandom number generator instead of the intended hardware RNG, significantly lowering security.
• Galaxy Research identified four attack waves involving 5,294 addresses and an estimated total of approximately 1,815.75 BTC, worth around $118.4 million at the time.
• The latest wave, identified on August 3, involved approximately 448.7 BTC across 709 addresses, further highlighting the ongoing security risks associated with Coldcard devices.

§ 03 Strategic Context

• The vulnerability has persisted since a 2021 code migration that inadvertently compromised the RNG process, raising historical concerns regarding software updates and device security.
• This incident fits into the larger narrative of scrutiny over self-custody solutions in the cryptocurrency space, which is critical for user trust and adoption of hardware wallets.

§ 04 Strategic Implications

• Immediate market consequences include increased scrutiny of hardware wallet security and potential shifts in user trust towards centralized platforms for custody.
• Long-term implications may involve stricter regulations and standards for hardware wallets to ensure user security and prevent similar vulnerabilities in the future.

§ 05 Risks & Constraints

• Potential regulatory risks may arise as users demand accountability and transparency from hardware wallet manufacturers following this incident.
• The ongoing competition between centralized exchanges and self-custody solutions could be impacted, particularly if users feel unsafe with hardware wallets.

§ 06 Watchlist / Forward Signals

• Future firmware updates and security advisories from Coinkite will be critical in assessing the response to this vulnerability and restoring user confidence.
• The emergence of any further attack waves or verified exploitation of the RNG flaw would signal a heightened risk environment for Coldcard users.