Coldcard RNG integration error tied to estimated $88.6M Bitcoin theft
Square Engineering says a deterministic MicroPython fallback may have weakened seed generation under specific conditions.
A Coldcard hardware wallet firmware randomness bug is being linked to an estimated $88.6 million Bitcoin theft affecting “thousands of wallets,” based on a security weekly recap published Aug. 3, 2026. The claim reframes the risk from device custody to seed creation, where a deterministic fallback can quietly narrow the search space for attackers.
Key Takeaways
- A Coldcard firmware vulnerability was described as being exploited to steal an estimated $88.6 million in Bitcoin from “thousands of wallets” whose seed phrases were generated with flawed randomness.
- Square Engineering traced the issue to an RNG integration error where `ngu.random` can route to MicroPython’s deterministic Yasmarang fallback instead of the STM32 hardware RNG.
- The same disclosure frames exploitability as conditional, with practical recovery cost depending on UID information, boot timing, prior RNG calls, and derivation cost.
- The weekly recap provides no on-chain attribution, victim list, theft timeframe, or independent confirmation for the $88.6 million estimate.
Coldcard RNG Bug Linked to Estimated $88.6M BTC Theft in Weekly Recap
A security weekly recap published Aug. 3, 2026 linked a Coldcard hardware wallet firmware flaw to an estimated $88.6 million Bitcoin theft, describing the incident as affecting “thousands of wallets” whose seed phrases were generated using a flawed random number generator.
The recap’s framing matters for how traders should interpret it. It presents the theft linkage as something that “is said to have been exploited,” but it does not include the primitives that would normally let the market independently sanity-check a claim of this size: no theft date range, no attacker identity, no address clusters, and no victim list.
That leaves two separate things on the table. One is the theft estimate, which is currently an unverified number in the provided material. The other is the underlying mechanism claim about seed-generation entropy, which is specific enough to be operationally actionable for anyone who used Coldcard to generate a seed phrase.
The Technical Failure: Deterministic Yasmarang Fallback vs STM32 Hardware RNG
Square Engineering described the root cause as an integration failure in the firmware’s randomness plumbing: “Coldcard firmware contains an RNG integration error that causes ngu.random to use MicroPython's deterministic Yasmarang fallback instead of the STM32 hardware RNG,” it said.
Mechanically, this is a seed-creation problem, not a custody problem. A seed phrase is the set of words encoding the master secret used to derive a wallet’s private keys. If the randomness used to generate that master secret is predictable or partially predictable, the seed can be weaker at birth even if the device is never physically compromised.
The distinction between the two RNG paths is the whole story. The STM32 hardware RNG is the microcontroller’s built-in entropy source, intended to provide non-deterministic randomness. A deterministic fallback, by definition, can produce outputs that are reproducible given enough information about its state and inputs. MicroPython is a lightweight Python implementation for microcontrollers, and in this case it provided the fallback path via Yasmarang.
If a wallet’s seed generation accidentally leans on a deterministic generator, the attacker’s job can shift from “steal the seed” to “reconstruct the seed,” which is a different threat model with different failure modes. The wallet can look perfectly secure in storage and still be brittle because the secret was generated from a narrower-than-assumed entropy pool.
Exploit Reality Check: What Square Engineering Says Attackers Still Need
Square Engineering also put guardrails around the most alarmist interpretation. “This does not mean every remote attacker can immediately recover every seed. Practical cost depends on available UID information, boot timing, prior RNG calls, and derivation cost.”
Each of those conditions narrows the implied attack surface. UID information refers to device-unique identifier data that could help an attacker constrain guesses about internal state. Boot timing and prior RNG calls matter because deterministic generators often evolve state over time, and the exact moment and sequence of calls can change what outputs are produced. Derivation cost is the brute-force budget required to turn “we can narrow the randomness” into “we can actually find the seed,” which can range from infeasible to practical depending on how much entropy was lost and what auxiliary information is available.
That caveat is also why the $88.6 million figure should not be treated as a blanket statement about Coldcard users. Even if the estimate is accurate, the disclosure itself implies the exploit is not a universal, instant seed-recovery button. It is a conditional weakness that may only bite for specific firmware versions, seed-generation flows, or device states, none of which are enumerated in the recap.
The annoying reality for self-custody is that this kind of bug is hard to reason about from the outside. Users can do everything “right” in terms of storage, air-gapping, and physical control, and still inherit risk if the entropy path at seed creation was not what they thought it was.
What to Monitor Next: Confirmation Signals, Wallet Guidance, and Forensic Breadcrumbs
The first confirmation signal that would move this from a scary mechanism to a tradable incident is forensic specificity. Any follow-up disclosure that adds a theft timeframe, attacker attribution, or on-chain clusters tied to the estimated $88.6 million would let the market test whether the number is a single event, a set of events, or a rough aggregation.
The second is versioned guidance. Coldcard or Square Engineering documentation that specifies which firmware versions, seed-generation flows, or device states could trigger the deterministic Yasmarang fallback would let users scope exposure without guessing. Without that, “thousands of wallets” is a headline descriptor, not a measurable population.
Independent reproduction is the third leg. Reports from incident responders or researchers that validate or dispute the “thousands of wallets” scope with reproducible technical evidence would clarify whether this is a narrow edge case or a broader operational footgun.
Finally, remediation needs to be explicit about the end state. User-facing steps should clarify whether funds must be migrated to wallets created with fresh seeds generated under verified entropy conditions, rather than implying that a firmware update alone retroactively fixes a weak seed.
My Take: Hardware Wallet Safety Is Only as Strong as the Entropy Path You Actually Used
The threshold that matters here is not whether hardware wallets are “safe” in the abstract. It is whether the seed phrase was generated with the entropy source the user believed they were relying on, because a deterministic fallback turns a custody product into a key-generation liability.
If the theft estimate stays uncorroborated, this looks more like a cautionary operational catalyst than a confirmed systemic compromise. If follow-up work pins down affected firmware versions and produces on-chain or incident-response breadcrumbs that match the $88.6 million claim, the practical implication is simple: seed-generation audits become as important as device custody for anyone treating self-custody as a core trading control.
