COLDCARD vulnerability

Entropy is the measure of how much genuine unpredictability went into a secret. A 24-word BIP39 seed is meant to carry 256 bits of entropy, and a 12-word seed 128 bits. That number, not the length of the phrase, is what makes a seed infeasible to guess.

Coinkite describes the cause as a complex and subtle series of bugs that prevented the hardware random-number generator from contributing randomness in certain firmware versions. In 2021, COLDCARD moved its elliptic-curve operations to the same libsecp256k1 implementation used by Bitcoin Core, which required adding libNgU, an embedded MicroPython library. During that migration, seed generation moved from ckcc.rng_bytes() to ngu.random.bytes(). Coinkite states that the second path resolved to MicroPython’s software fallback rather than COLDCARD’s hardware implementation.

The build did not fail, because both implementations exposed the same function signature. Coinkite explains that MICROPY_HW_ENABLE_RNG was explicitly set to zero on the assumption that neither MicroPython implementation was needed, while the guard meant to catch a missing hardware generator used #ifndef, which tests only whether a macro is defined and not whether its value is non-zero. A macro defined as zero satisfied that test, so compilation proceeded with the software fallback linked in.

Coinkite notes that the MicroPython fallback itself was introduced upstream in May 2018, and did not enter COLDCARD wallet seed generation until the libNgU migration in March 2021. The eight-year figure that circulated describes the age of the upstream code, not the span of affected seed generation.

A predictable generator narrows the set of seeds that a device could possibly have produced. Coinkite estimates the effective search space at about 40 bits on the Mk3, and describes that as a preliminary figure under current attack assumptions that may change as analysis continues.

For the Mk4, Mk5 and Q, Coinkite explains that values from the secure elements were mixed into the generator state during Mk4 development as an additional layer, which materially improves the situation for those models. Coinkite estimates the effective search space at about 72 bits, short of the intended 128-bit target.

Hashing does not help. A hash can make output look statistically uniform, but it cannot increase the number of distinct inputs that could have produced it, so no amount of hashing after the fact restores unpredictability the generator never had. The BIP39 checksum adds no entropy either.

This is why the fix and the remedy are separate actions. Corrected firmware changes how the next seed is generated; it has no access to the randomness that produced a seed years ago.

Coinkite states that on affected firmware, COLDCARD hashed the device-generated seed together with every roll entered through Add Dice Rolls. The dice input is therefore an independent contribution rather than a cosmetic addition.

Coinkite quantifies it: 50 to 98 independent, private rolls contributed at least 128 bits from the dice alone, and 99 or more rolls contributed approximately 256 bits.

The qualifiers matter as much as the counts. The rolls must have been fair, independent and private. Coinkite is clear that if the rolls were recorded or exposed, or if you are uncertain how many you entered or which words you ended up using, the exception does not apply and you should migrate.

A dice-roll sequence is secret key material in its own right. Coinkite warns against photographing it, storing it digitally, or entering it into a networked computer.