Somewhere, a random number generator quietly stopped doing its one job back in March 2021, nobody noticed, and five years later an attacker cashed in the world's slowest-burning fuse — draining nearly 1,200 wallets in under an hour flat.
The Bug That Waited Five Years to Detonate
On July 30, an attacker drained 1,196 Bitcoin addresses generated by Coldcard hardware wallets, pulling out roughly 1,082 BTC — about $70.2 million at the time, with the running total since climbing past $88 million. The cause traces back to a March 2021 firmware update that broke the check meant to activate the device's hardware random number generator. Instead of failing loudly, it quietly fell back to a predictable substitute seeded from the chip's serial number and internal clock.
The practical effect: Mk3 devices generated recovery seeds with roughly 40 bits of entropy instead of the 128 bits a proper Bitcoin seed needs, with Mk4, Mk5, and Q models faring only somewhat better at around 72 bits. Every drained wallet was single-signature and created after that 2021 update — predictable enough, eventually, for someone to reconstruct the private keys without ever touching the physical device.
Cold Storage Isn't Supposed to Have a "Sort Of" Random Number
The entire premise of a hardware wallet is that it's the boring, offline, tamper-resistant vault your keys live in specifically so they can't be predicted or brute-forced. A silently degraded RNG doesn't just weaken that promise — it inverts it, turning the most trusted link in the chain into the weakest one, and nobody found out until real money walked out the door.
The one bit of good news: owners who added a BIP-39 passphrase, or rolled at least 50 physical dice during setup, injected enough outside randomness that the attacker can't rebuild their keys — a reminder that belt-and-suspenders security habits occasionally save the day precisely when the belt fails.
Five years is a long time for a "quiet fallback" to sit in production code unnoticed — which should terrify anyone who's never actually audited their own dependency chain.
If "when did anyone last actually review our code for silent failures like this" isn't a question you can answer confidently, that's worth fixing before it becomes expensive — let's talk.
Source: The Hacker News