COLDCARD seed flaw: why a firmware update is not enough | Magica
COLDCARD seed flaw leaves users facing a migration, not an update
Editorial Team
••📖6 min read
A Block technical analysis says a firmware path used to create some COLDCARD secrets could be reproducible; reported address sweeps make the risk urgent, but the analysis does not establish that every affected wallet can be recovered remotely.
A technical analysis says some COLDCARD firmware used a deterministic software random-number fallback while creating secrets.
The relevant question is which firmware generated a seed; an update cannot change that seed after the fact.
Address sweeps reportedly linked to the affected period raise the stakes, but neither the technical analysis nor the reported on-chain pattern proves that every wallet is recoverable.
COLDCARD users with a seed generated on affected firmware face a migration problem, not simply a patching problem. Block’s Bitcoin Engineering and Security teams, which say no Block products or customers are affected, conclude that a firmware integration error could make the randomness behind some secrets reproducible under constrained conditions.
COLDCARD is Coinkite’s Bitcoin hardware wallet, designed to sign transactions while offline, as the manufacturer described it when introducing the product. That design can protect a private key from an internet-connected computer. It cannot repair a secret that was insufficiently unpredictable when it was generated.
The consequence is urgent because an August 3 report described a possible fourth series of sweeps of addresses researchers linked to the relevant period. But the two bodies of evidence have different limits: Block calls its assessment an early, internal analysis without full empirical exploitability testing, while the reported sweep identification came from pattern matching rather than direct victim reports.
An early COLDCARD hardware-wallet illustration from Coinkite’s product announcement. Source: Coinkite Blog.
The defect is in the path that made the secret
The technical analysis traces the issue to ngu.random, an interface used in COLDCARD firmware. Production board settings disabled MicroPython’s hardware random-number generator, while a library test checked only whether that setting existed, not whether it was enabled. The library consequently used MicroPython’s deterministic Yasmarang software fallback instead of COLDCARD’s separate STM32 hardware-RNG wrapper, Block says.
GPT-Live lets ChatGPT listen and speak at once, and OpenAI says it can bring in GPT-5.5 for harder work without stopping the conversation. The launch’s real test is whether that experience holds up across long sessions, regional capacity and uneven networks—and whether its related WebRTC proposals become broadly deployed infrastructure rather than a company-specific advantage.
Editorial Team
That distinction is not a claim that every generated seed is instantly guessable. The fallback begins from device and timing state: a device identifier plus timer registers, followed by a deterministic stream. An attacker would need to determine or sufficiently constrain the device identifier, timer state and history of random-number calls. Block says it has not supplied an end-to-end brute-force benchmark; those facts determine the cost for a particular wallet.
The code history fixes the key boundary. Block says a March 1, 2021 change moved wallet generation to the library interface, and the path first shipped in v4.0.0 on March 17. The relevant firmware is the firmware that made the secret, not the model currently on a user’s desk.
Device and firmware when the secret was generated
Assessment in the technical analysis
Mk1 through v3.0.6; Mk2/Mk3 through v3.2.2
Outside this regression; the older Mk2/Mk3 path used the direct STM32 hardware RNG.
Mk2/Mk3 v4.0.0–v4.1.9
Confirmed vulnerable path with no secure reseed. Given the relevant state and call history, output is deterministic.
Mk4 production v5.0.0 onward, Q, and Mk5
The fallback remains, but boot reseeding contributes only 32 bits to one state word, according to Block’s review.
For the newer devices, Block says secure-element material is hashed but only four bytes feed reseed(). With a fixed fallback state and call history, that leaves at most 2^32 securely distinguished output streams—about 2^31 candidate trials on average. That is a ceiling on the cited secure reseed contribution, not a measured attack cost and not a declaration that every remote attacker can recover every seed.
Hashing the 32-byte output during wallet generation does not add possible inputs; it only transforms the available outputs. The report makes the same point about BIP39’s checksum.
Reported sweep rate in the possible fourth wave compared with CoinDesk’s pre-incident control window. Source: CoinDesk.
Reported sweeps raise the cost of waiting
The reported fourth wave was not a settled attribution. Alex Thorn, Galaxy Research’s head of firmwide research, flagged it from transaction patterns and said he had no direct victim report. If the pattern held, the report said, four waves since July 30 would total about 1,816 bitcoin from more than 5,200 addresses, worth roughly $114 million at the price cited at the time.
The reported pattern was unusually concentrated: 218 transactions reached 462 addresses across blocks 960,778 through 960,792, or roughly 14 sweeps per block, compared with 0.3 in a pre-incident control window. That comparison helps explain the warning, but it does not independently identify the attacker or prove that every address came from the same vulnerability.
The latest transactions reportedly opted into replace-by-fee. Before such a transaction confirms, a holder who sees it in Bitcoin’s mempool may be able to outbid it and move funds first. That is a narrow contingency, not a cure for a seed that may remain reproducible.
Block Engineering’s company-reported affected-products table, organized by firmware used when the secret was generated. Source: Block Engineering.
An update does not change an old seed
The report says Coinkite released emergency firmware and told people who generated a seed on the flawed software to move funds to an address made with a fresh seed. The technical analysis independently makes the crucial limitation clear: upgrading cannot retroactively repair—or further weaken—an existing seed, and importing that seed into another wallet carries its exposure with it.
The risk is not confined to ordinary BIP39 wallets. Block says the same random-number construction is used for paper-wallet private keys, random seed-XOR masks, and some cloning, USB-encryption, Key Teleport, Web2FA and Secure Notes material. The consequence varies. A recovered paper-wallet private key can be checked against its public address; a captured USB-encryption session would threaten that session’s confidentiality, not directly reveal the wallet signing key.
Multisignature is also not a blanket exemption. The reported first three waves did not touch multisignature arrangements, a pattern consistent with a single-key weakness. But Block says multisig protects against this particular problem only if the required signing quorum includes secure devices; a quorum made entirely of vulnerable seeds recreates the same failure.
What evidence would settle the remaining question
For a holder with a potentially exposed single-key seed, the immediate decision described by the available reporting is to move funds to a newly generated seed rather than rely on a firmware update. Anyone confronting an unconfirmed sweep may have only the replace-by-fee window to act.
The larger unresolved question is practical scope. Reproducible hardware testing and end-to-end recovery benchmarks would need to show which device identifiers, boot timings and call histories can be reconstructed at scale, for which models and workflows. That evidence would distinguish a demonstrated design weakness from a quantified recovery risk for an individual wallet.
Five states enacted AI mental-health restrictions in 2026, but the laws regulate different conduct: Tennessee targets representations that a system is a qualified professional, while Colorado and Maine restrict how licensed clinicians can use AI in therapy.
Xero's survey of 1,081 New Zealand SME customers finds 61% are proactively using AI, but most users are learning by experimentation. Its new 12-week bootcamp with ASB is a response to that confidence gap; it is not yet evidence of a productivity gain.
Apple alleges that OpenAI and former Apple employees sought confidential hardware information through recruiting, supplier contacts and a former engineer’s post-employment system access. The complaint has not been tested in court, and OpenAI says it is unaware of evidence that it has merit.
Amazon’s market value passed $3 trillion after AWS revenue accelerated and the company raised its 2026 capital-spending plan to $220 billion. The rally reflects confidence in Amazon’s cloud demand, but the company’s own capacity forecast, the broad uses of its budget and strong rival cloud growth leave the return on that spending unproven.
The Trump administration says it has completed a voluntary framework for testing the cyber capabilities of the most advanced U.S. AI models and will discuss it with major developers Tuesday. The key scope, testing and disclosure rules have not been made public.
MediaTek now says its second custom cloud AI accelerator is on track for high-volume production in 2028, later than its April goal of entering production by the end of 2027. The company is betting that supply-chain coordination and advanced packaging can support a much larger cloud-chip business, but it has not disclosed a customer, package supplier, cost comparison or 2028 revenue guide.
A Nvidia stockholder’s derivative complaint seeks to make directors and senior officers answer for alleged copyright and biometric-data violations in the company’s AI work. The immediate question is not whether those underlying allegations are true, but whether the suit can clear the procedural and factual hurdles for a board-level claim.
Dongfang Suanxin says its planned 14nm DF2000 will use stacked near-memory computing to reach 15 TB/s of bandwidth. The company’s system-level comparison with NVIDIA highlights an architectural bet, but it does not establish a performance win or answer the questions of yield, cost and software adoption.
Mexico’s exports of computer equipment have surged as U.S. data-center construction and tariff differences reshape trade. The figures point to a bigger role in assembling and shipping equipment, but imported components, near-full factories and limited investment leave the higher-value parts of the chain elsewhere.
Bayreuth Festival says its anniversary Ring uses AI to recombine 150 years of Wagner imagery into a different visual experience at each performance. Early reviews and boos after Götterdämmerung do not settle the experiment, but they focus attention on the people choosing and deploying the system when its projections compete with singers and drama.
Honolulu’s state-run airport has added 17 AI-generated songs to its hourly sound system. The available reporting does not show that they replaced the licensed music already played there, but it has prompted local curator Roger Bong to argue that a public gateway should be more transparent about who decides what Hawaiʻi sounds like.
Trump Media's Truth API offers licensed, machine-readable delivery of selected Truth Social posts to institutional customers. Its commercial appeal rests on the speed with which traders receive communications from President Donald Trump and other officials, but the available accounts leave unresolved exactly what advantage buyers receive.
OpenAI and Anthropic both support disclosure, incident reporting and outside scrutiny for the largest frontier-AI developers. Their proposals—and Illinois’ new law—show that the more consequential unresolved question is whether an evaluator or government agency can decide when a model’s risk is too high for deployment.
AMD’s Kria AI system-on-module and robotics developer platform combine an X100 processor, FPGA-equipped carrier board and open software stack. But the headline 3.4x real-time result comes from an AMD-commissioned simulation run on a Strix Halo mini PC configured as an X100 proxy—not on the forthcoming Kria hardware—and its public descriptions contain methodological differences that make independent reproduction the next test.
A Manhattan federal judge allowed Reddit’s core DMCA and conspiracy claims against Perplexity and SerpApi to proceed over alleged scraping through Google results. The ruling accepts a plausible theory tied to Reddit’s Google license, but leaves unresolved whether Reddit can prove authorization, protected works and actual circumvention.
MediaTek says its AI ASIC business could contribute about $2 billion in the fourth quarter of 2026. That is a company target for one unnamed US hyperscaler project, distinct from its longer-term market-share goal and a separate report on revenue mix.
OpenAI says it closed a $122 billion funding round at an $852 billion post-money valuation. Amazon’s filing sets out three linked elements: $15 billion already invested in OpenAI, a $35 billion share-purchase commitment, and an AWS commercial commitment expanded by $100 billion over eight years.
Two House committee chairs have asked DoorDash to identify the Chinese AI models it uses and the security testing behind them. DoorDash’s public benchmark shows Kimi K2.6 in one experimental code-review configuration, while its stated production reviewer used Claude models—leaving deployment scope and data controls unresolved.
Hank Green says he will reduce or pause work on several YouTube channels after acknowledging that he had leaned too heavily on ChatGPT-generated research notes. He maintains that the disputed line in an Ask Hank Anything episode was an ad-lib, not chatbot text; the unanswered question is how an education creator will make its AI-assisted research process legible to viewers.
