[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fLykuMvgux3zVyue16REV2G3U1rGK7w-UEJAxu9Aovew":3},{"article":4,"iocs":51,"watch_terms":58,"solutions":59,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"f7741958-2544-4695-a08c-eaea3dacc795","COLDCARD wallet RNG flaw likely linked to $88 million Bitcoin theft","coldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft-b4f28f","A vulnerability in COLDCARD hardware wallet firmware allowed attackers to steal an estimated $88.6 million in Bitcoin from thousands of wallets whose seeds were generated using a flawed random number generator. [...]","A vulnerability in COLDCARD hardware wallet firmware allowed attackers to steal approximately $88.6 million in Bitcoin from thousands of wallets. The flaw stemmed from an integration error in the random number generation (RNG) code, causing the device to use a deterministic software generator instead of a hardware RNG. Attackers could reconstruct wallet seeds offline, identify affected wallets, and steal funds.","COLDCARD wallet RNG flaw exploited, leading to $88.6M Bitcoin theft.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcoldcard-wallet-rng-flaw-likely-linked-to-88-million-bitcoin-theft\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F07\u002F10\u002FCryptocurrency-bitcoin-theft.jpg","2026-08-02T21:14:29+00:00","2026-08-02T22:00:12.558132+00:00",9,[17,20,22,24,26],{"name":18,"type":19},"COLDCARD","product",{"name":21,"type":19},"Mk2",{"name":23,"type":19},"Mk3",{"name":25,"type":19},"Mk4",{"name":27,"type":19},"Mk5","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41,46],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,55],{"type":45,"value":53,"context":54},"deterministic software generator","Flawed RNG used by COLDCARD firmware",{"type":45,"value":56,"context":57},"Yasmarang fallback","Deterministic RNG used instead of hardware RNG",[18,21,23],{"controls":60,"vendors":144},[61,90,118],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":50,"name":91,"problem":92,"products":93},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"reliaquest","ReliaQuest","\u002Fvendor-logos\u002Freliaquest.png","greymatter-digital-risk-protection","GreyMatter Digital Risk Protection","https:\u002F\u002Freliaquest.com\u002Fsecurity-operations-platform\u002Fdark-web-and-digital-risk-protection\u002F","Watches the open, deep and dark web for threats aimed at an organisation and alerts its security team in real time.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"slug":119,"name":120,"problem":121,"products":122},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":140,"product_name":141,"url":142,"description":143},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",[],{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":161},"coldcard-rng-flaw-exposes-88m-bitcoin-loss-from-deterministic-seed-generation","COLDCARD RNG Flaw Exposes $88M Bitcoin Loss from Deterministic Seed Generation","A critical integration error in COLDCARD hardware wallet firmware caused the device to silently fall back to a deterministic software-based random number generator (RNG) instead of the intended hardware RNG, fundamentally breaking the cryptographic security of wallet seed generation. Because the seeds were no longer truly random, attackers could reconstruct them offline by iterating through predictable values — enabling mass theft across thousands of wallets without ever physically accessing the devices. This incident highlights how a single low-level implementation bug in cryptographic infrastructure can have catastrophic, irreversible financial consequences. Hardware wallet users, who often place implicit trust in the device's secure element, had no practical way to detect the flaw themselves. The irreversibility of blockchain transactions means that once funds were stolen, recovery was impossible, making prevention and rapid disclosure the only viable defenses.",[150,151,152,153,154,155,156,157,158,159,160],"NIST SP 800-90A – Recommendation for Random Number Generation Using Deterministic RBGs","NIST SP 800-90B – Recommendation for the Entropy Sources Used for Random Bit Generation","NIST CSF DE.CM-4 – Malicious code detection","NIST CSF RS.CO-2 – Incidents are reported consistent with established criteria","CIS Control 2 – Inventory and Control of Software Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 16 – Application Software Security","ISO\u002FIEC 19790 – Security requirements for cryptographic modules","FIPS 140-3 – Security Requirements for Cryptographic Modules (RNG requirements)","NIST SP 800-193 – Platform Firmware Resiliency Guidelines","ITIL Change Management – Emergency change procedures for critical security patches",{}]