[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGj1dx1T9ZEw9O6iF0D4KXRflc9RB1_a6eTUD0ae4ASk":3},{"article":4,"iocs":47,"watch_terms":52,"solutions":53,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"ca8e7f2c-1fcb-405b-8c08-b97bccbeb503","COLDCARD Seed Generation Flaw Linked to Nearly $89 Million Bitcoin Theft","coldcard-seed-generation-flaw-linked-to-nearly-89-million-bitcoin-theft-b0cdd0","Galaxy Research linked a suspected Bitcoin theft of 1,367.05 BTC to weak COLDCARD seeds. Coinkite says updates cannot repair seeds already generated on devices.","A firmware error in COLDCARD hardware wallets (Mk2, Mk3, Mk4, Mk5, Q models) weakened seed generation by routing to a deterministic software fallback instead of the hardware RNG, resulting in seeds with only 40–72 bits of entropy instead of 128. Galaxy Research linked three suspected Bitcoin thefts totaling 1,367.05 BTC (~$88.6M) across 4,585 addresses to exploitation of this flaw. Coinkite's firmware updates cannot repair seeds already generated; affected users must create entirely new seeds and migrate their funds.","COLDCARD firmware flaw in seed generation linked to $88.6M Bitcoin theft across 1,367 BTC.","https:\u002F\u002Fhackread.com\u002Fcoldcard-seed-generation-flaw-bitcoin-theft\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F08\u002Fcoldcard-seed-generation-flaw-bitcoin-theft.jpg","2026-08-03T17:52:36+00:00","2026-08-03T18:00:08.578341+00:00",9,[17,20,22,24,26,28],{"name":18,"type":19},"COLDCARD Mk2","product",{"name":21,"type":19},"COLDCARD Mk3",{"name":23,"type":19},"COLDCARD Mk4",{"name":25,"type":19},"COLDCARD Mk5",{"name":27,"type":19},"COLDCARD Q",{"name":29,"type":30},"Coinkite","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"0493c7e9-989a-4692-b4e6-136f5ec09675","Cryptography","cryptography",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[48],{"type":49,"value":50,"context":51},"malware","COLDCARD seed generation flaw (CVE pending)","Firmware vulnerability in COLDCARD hardware wallets affecting seed entropy generation",[29,18,21],{"controls":54,"vendors":142},[55,84,113],{"slug":56,"name":57,"problem":58,"products":59},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[60,68,76],{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":85,"name":86,"problem":87,"products":88},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[89,97,105],{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":114,"name":115,"problem":116,"products":117},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","incident-response","CrowdStrike Incident Response","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fservices\u002Fincident-response\u002F","Incident response services, available on retainer.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"truesec","Truesec","\u002Fvendor-logos\u002Ftruesec.png","truesec-incident-response","Truesec Incident Response","https:\u002F\u002Fwww.truesec.com\u002Fservice\u002Fincident-response","Incident response team with a retainer option.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","unit-42-retainer","Unit 42 Retainer","https:\u002F\u002Fwww.paloaltonetworks.com\u002Funit42\u002Fretainer","Incident response retainer with Unit 42, including preparation services.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":158},"coldcard-firmware-flaw-drains-89m-in-bitcoin-due-to-weak-seed-entropy","COLDCARD Firmware Flaw Drains $89M in Bitcoin Due to Weak Seed Entropy","A firmware bug in COLDCARD hardware wallets caused seed generation to fall back to a deterministic software routine instead of the hardware random number generator (RNG), reducing cryptographic entropy from a secure 128 bits down to just 40–72 bits. This weakness made wallet seeds computationally feasible to brute-force, allowing attackers to drain approximately 1,367 BTC across thousands of affected addresses. The critical distinction here is that unlike a software patch, the damage is irreversible — firmware updates cannot retroactively strengthen already-generated seeds, meaning affected users must migrate funds to entirely new wallets. This incident underscores that cryptographic key material is only as strong as the entropy source used to generate it, and hardware security devices must be rigorously validated for their core randomness functions.",[148,149,150,151,152,153,154,155,156,157],"NIST SP 800-90A – Recommendation for Random Number Generation Using Deterministic Random Bit Generators","NIST SP 800-57 – Key Management Guidelines (Part 1, Section 8: Key Generation)","NIST CSF ID.AM-2 – Software platforms and applications within the organization are inventoried","NIST CSF PR.IP-3 – Configuration change control processes are in place","CIS Control 7 – Continuous Vulnerability Management","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 10 – Malware Defenses (applied to firmware integrity)","NIST SP 800-193 – Platform Firmware Resiliency Guidelines","ISO\u002FIEC 19790 – Security Requirements for Cryptographic Modules (FIPS 140-3 equivalent)","FIPS 140-3 Section 9.3 – Entropy Sources and Random Bit Generation",{}]