[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSa06QeWAgalBC3ie-KGIE0ZE-9lPowAb2mKLdYcfWWM":3},{"article":4,"iocs":54,"watch_terms":59,"solutions":60,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"0b69c263-226f-4cdd-9a79-7e23645c56af","Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes","coldcard-hardware-wallet-flaw-linked-to-70-million-bitcoin-theft-in-41-minutes-33d64b","An attacker drained 1,196 Bitcoin addresses in 41 minutes on July 30, taking 1,082.65 BTC worth about $70.2 million at the time. Galaxy Research mapped the sweep and tied it to a firmware flaw in Coldcard, the Bitcoin-only hardware wallet made by Canadian firm Coinkite. A March 2021 firmware integration error routed seed generation to a deterministic software pseudorandom number generator (PRNG","An attacker drained 1,196 Bitcoin addresses of 1,082.65 BTC ($70.2M) in 41 minutes on July 30, 2026, exploiting a March 2021 firmware integration error in Coldcard hardware wallets. The flaw routed seed generation to a weak software PRNG instead of the hardware RNG, reducing entropy to ~40 bits (Mk3) or ~72 bits (Mk4\u002FMk5\u002FQ) versus the required 128 bits. Coinkite released emergency firmware patches on July 31, but users with exposed seeds must generate new ones and move their coins, as patched firmware cannot repair an existing compromised seed.","Coldcard firmware flaw tied to $70.2M Bitcoin theft of 1,082.65 BTC in 41 minutes on July 30.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcoldcard-hardware-wallet-flaw-linked-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEiea5Kw_2TLtPI4Ts3s3anmPIQr3S8VxO0G9yL-UV1dSlRrW1Z_L41XoHcSFuk2ThCBDKLFy-xZl_y7DnA0FM2nWHk4G1TpV2iMx6-X6EDT3gK7s0pJu6e1wMUoEsuPifcXseXuqOIHL3W9voWoD_se5gKJPyii4X0mJY7sxJ3uOPlTWVfAyrKs4ixa-18\u002Fs1600\u002Fcoldcard.jpg","2026-08-01T17:17:22+00:00","2026-08-01T18:00:30.131126+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"Coldcard","product",{"name":21,"type":22},"Coinkite","vendor",{"name":24,"type":25},"BIP-39","technology",{"name":27,"type":25},"MicroPython",{"name":29,"type":19},"libngu library",{"name":31,"type":32},"Unknown (Coldcard sweep operator)","threat_actor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,49],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":45},{"id":46,"icon":35,"name":47,"slug":48},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":50},{"id":51,"icon":35,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":56,"value":57,"context":58},"malware","Coldcard firmware flaw (PRNG entropy weakness)","March 2021 firmware integration error in Coldcard hardware wallet seed generation",[21,18,29],{"controls":61,"vendors":148},[62,91,119],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":92,"product_name":116,"url":117,"description":118},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":120,"name":121,"problem":122,"products":123},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",[],{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":165},"firmware-prng-flaw-drains-70m-in-bitcoin-in-under-an-hour","Firmware PRNG Flaw Drains $70M in Bitcoin in Under an Hour","A firmware integration error introduced in March 2021 caused Coldcard hardware wallets to route seed generation through a weak software pseudorandom number generator (PRNG) instead of the dedicated hardware RNG, reducing cryptographic entropy from the required 128 bits down to as low as 40 bits. This drastically lowered the brute-force complexity of attacking wallet seeds, enabling an attacker to compromise 1,196 addresses and drain over $70 million in Bitcoin in just 41 minutes. The flaw went undetected for over five years, illustrating how a single misconfiguration in a cryptographic pipeline can silently undermine all downstream security guarantees. Critically, even after emergency patches were released, any wallet seed generated during the vulnerable firmware period remains permanently compromised — patching the software cannot retroactively strengthen entropy that was never there.",[154,155,156,157,158,159,160,161,162,163,164],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-90A: Recommendation for Random Number Generation Using Deterministic RBGs","NIST SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF PR.IP-1: A baseline configuration is created and maintained","NIST SP 800-193: Platform Firmware Resiliency Guidelines","FIPS 140-3: Security Requirements for Cryptographic Modules (entropy source validation)","ITIL Change Management: Standard change review and testing procedures for firmware updates","ISO\u002FIEC 27001 A.12.6.1: Management of technical vulnerabilities",{}]