[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTeEdDAGKlgSgXzZvA36TPZLRKXRphzKOZMU_ec2xQlw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":62},"034deffb-df25-41a5-98da-8f3da3e44c01","firmware-prng-flaw-drains-70m-in-bitcoin-in-under-an-hour","0b69c263-226f-4cdd-9a79-7e23645c56af","Firmware PRNG Flaw Drains $70M in Bitcoin in Under an Hour","A firmware integration error introduced in March 2021 caused Coldcard hardware wallets to route seed generation through a weak software pseudorandom number generator (PRNG) instead of the dedicated hardware RNG, reducing cryptographic entropy from the required 128 bits down to as low as 40 bits. This drastically lowered the brute-force complexity of attacking wallet seeds, enabling an attacker to compromise 1,196 addresses and drain over $70 million in Bitcoin in just 41 minutes. The flaw went undetected for over five years, illustrating how a single misconfiguration in a cryptographic pipeline can silently undermine all downstream security guarantees. Critically, even after emergency patches were released, any wallet seed generated during the vulnerable firmware period remains permanently compromised — patching the software cannot retroactively strengthen entropy that was never there.","**Immediate actions:**\n- Apply Coinkite's emergency firmware update immediately and verify the installed version matches the official signed release.\n- Generate entirely new wallet seeds on patched devices and transfer all funds to the new addresses without reusing any previously generated keys.\n- Audit your wallet's firmware version history to determine whether seed generation occurred during the affected March 2021–July 2026 window.\n\n**Long-term improvements:**\n- Implement mandatory cryptographic self-tests that verify the entropy source (hardware RNG vs. software PRNG) at device boot and during seed generation.\n- Establish a formal firmware change-review process that includes dedicated cryptographic code audits before any RNG or key-generation pathway is modified.\n- Maintain a hardware wallet inventory with firmware version tracking so vulnerable devices can be identified and remediated within hours of a disclosure.\n\n**Detection measures:**\n- Subscribe to official vendor security advisories and configure automated alerts for firmware vulnerability disclosures affecting any hardware security device in use.\n- Periodically perform independent third-party audits of hardware wallet firmware, focusing specifically on entropy sources and cryptographic primitive integrations.\n- Monitor on-chain activity for unusual address sweeping patterns that may indicate seed-compromise campaigns targeting known vulnerable wallet models.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-90A: Recommendation for Random Number Generation Using Deterministic RBGs","NIST SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation","NIST CSF ID.RA-1: Asset vulnerabilities are identified and documented","NIST CSF PR.IP-1: A baseline configuration is created and maintained","NIST SP 800-193: Platform Firmware Resiliency Guidelines","FIPS 140-3: Security Requirements for Cryptographic Modules (entropy source validation)","ITIL Change Management: Standard change review and testing procedures for firmware updates","ISO\u002FIEC 27001 A.12.6.1: Management of technical vulnerabilities",{},"published","2026-08-01T18:20:22.733759+00:00","2026-08-01T18:20:22.606+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fcoldcard-hardware-wallet-flaw-linked-to.html","coldcard-hardware-wallet-flaw-linked-to-70-million-bitcoin-theft-in-41-minutes-33d64b","Coldcard Hardware Wallet Flaw Linked to $70 Million Bitcoin Theft in 41 Minutes",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":45,"name":46,"slug":47,"description":48,"color":49},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[51,57],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"4f80bb7f-65b1-4c71-9e56-2bc45783a413","2026-08-03","morning","ThreatNoir Morning Brief — August 3","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-03\u002Fthreatnoir-morning-brief-2026-08-03.mp3",{"id":58,"date":59,"edition":54,"title":60,"audio_url":61},"bd004071-9bf5-45f0-8ec9-b8639fffa05f","2026-08-02","ThreatNoir Weekend Brief — August 2","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-02\u002Fthreatnoir-morning-brief-2026-08-02.mp3",[63,66,69],{"slug":35,"name":64,"problem":65},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":47,"name":67,"problem":68},"Automated patch management","Known holes get closed in days, not months.",{"slug":70,"name":71,"problem":72},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]