[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fBAddfMGT1k1X2jFACrv40qch8hs3qqEbJb4IanXA9kY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"33c028eb-9adc-4380-b8a1-6bab5c81dd59","coldcard-firmware-flaw-drains-89m-in-bitcoin-due-to-weak-seed-entropy","ca8e7f2c-1fcb-405b-8c08-b97bccbeb503","COLDCARD Firmware Flaw Drains $89M in Bitcoin Due to Weak Seed Entropy","A firmware bug in COLDCARD hardware wallets caused seed generation to fall back to a deterministic software routine instead of the hardware random number generator (RNG), reducing cryptographic entropy from a secure 128 bits down to just 40–72 bits. This weakness made wallet seeds computationally feasible to brute-force, allowing attackers to drain approximately 1,367 BTC across thousands of affected addresses. The critical distinction here is that unlike a software patch, the damage is irreversible — firmware updates cannot retroactively strengthen already-generated seeds, meaning affected users must migrate funds to entirely new wallets. This incident underscores that cryptographic key material is only as strong as the entropy source used to generate it, and hardware security devices must be rigorously validated for their core randomness functions.","**Immediate actions:**\n- Upgrade COLDCARD firmware to the latest patched version immediately and generate entirely new seeds on updated devices.\n- Migrate all funds from wallets whose seeds were created on Mk2, Mk3, Mk4, Mk5, or Q models before the fix to freshly generated, entropy-verified wallets.\n- Audit wallet creation logs or device history to identify whether seeds were generated during the vulnerable firmware period.\n\n**Long-term improvements:**\n- Require hardware security device vendors to publish verifiable entropy source validation reports and independent third-party firmware audits before release.\n- Establish a hardware wallet lifecycle policy that includes periodic re-keying of high-value wallets and firmware version attestation checks.\n- Maintain an asset inventory of all cryptographic hardware devices, including firmware versions, to enable rapid response when vulnerabilities are disclosed.\n\n**Detection measures:**\n- Monitor blockchain addresses associated with hardware wallets for anomalous or unauthorized transaction patterns using on-chain alerting tools.\n- Subscribe to vendor security advisories and CVE feeds for all hardware security modules and wallet devices in use.\n- Implement out-of-band verification of RNG output quality during device provisioning using entropy testing tools (e.g., NIST SP 800-22 test suite).",[12,13,14,15,16,17,18,19,20,21],"NIST SP 800-90A – Recommendation for Random Number Generation Using Deterministic Random Bit Generators","NIST SP 800-57 – Key Management Guidelines (Part 1, Section 8: Key Generation)","NIST CSF ID.AM-2 – Software platforms and applications within the organization are inventoried","NIST CSF PR.IP-3 – Configuration change control processes are in place","CIS Control 7 – Continuous Vulnerability Management","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 10 – Malware Defenses (applied to firmware integrity)","NIST SP 800-193 – Platform Firmware Resiliency Guidelines","ISO\u002FIEC 19790 – Security Requirements for Cryptographic Modules (FIPS 140-3 equivalent)","FIPS 140-3 Section 9.3 – Entropy Sources and Random Bit Generation",{},"published","2026-08-03T18:20:26.283844+00:00","2026-08-03T18:20:26.181+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fhackread.com\u002Fcoldcard-seed-generation-flaw-bitcoin-theft\u002F","coldcard-seed-generation-flaw-linked-to-nearly-89-million-bitcoin-theft-b0cdd0","COLDCARD Seed Generation Flaw Linked to Nearly $89 Million Bitcoin Theft",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":38,"name":39,"slug":40,"description":41,"color":42},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",{"id":44,"name":45,"slug":46,"description":47,"color":48},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"366b9095-a756-4506-865f-b4e0b20d8676","2026-08-04","morning","ThreatNoir Morning Brief — August 4","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-04\u002Fthreatnoir-morning-brief-2026-08-04.mp3",[57,60,64],{"slug":34,"name":58,"problem":59},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":61,"name":62,"problem":63},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",{"slug":65,"name":66,"problem":67},"incident-response-retainer","Incident response retainer","Experts are on call before the worst day, not searched for during it."]