What happened
On July 30, 2026, Coinkite disclosed that a COLDCARD firmware build-integration error had weakened seed generation in affected releases. Attackers could regenerate vulnerable seeds' private keys offline and steal funds; Coinkite says the devices themselves were not remotely accessed or taken over. Updating firmware fixes future seed generation but does not repair an existing affected seed.
How it happened
- A firmware build and link integration error resolved the seed-generation
rng_get()call to MicroPython's Yasmarang software PRNG instead of COLDCARD's intended hardware TRNG path. - Seeds generated through the affected path had a reduced search space.
- Attackers regenerated the corresponding private keys offline and used them to spend funds from affected wallets.
- Coinkite released fixed firmware and advised affected users to migrate funds to a newly generated seed, because an update alone does not change an existing seed.
Protocol details
Classification
Other / Key Compromise
Protocol Type
Exploit/Other
Implementation language
C++
Protocol links
Website
@COLDCARDwallet
Evidence
- report @COLDCARDwallet incident report x.com
- report @PeckShieldAlert incident report x.com
- report @glxyresearch incident report x.com
- analysis Adding to the Public Record on Our Ongoing Investigation blog.coinkite.com
- analysis COLDCARD Security Disclosure History coinkite.com
- analysis Current COLDCARD Security Status coldcard.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
