COLDCARD Entropy Failure: How Four Lines of Code Cost More Than 1,596 BTC

Full incident report · 13 sources · Anzen LabTwo files, four lines, five years unnoticed. This is the COLDCARD entropy failure taken apart step by step — what the defect was, how attackers found the wallets, what affected owners should do — and the four checks OneKey runs so the same thing cannot happen here quietly.One overlooked setting, measured5 yearsthe flaw sat in fully public code, unnoticed11,596+ BTCconfirmed stolen from about 7,300 addresses — and still rising741 minthe largest single sweep — 1,083 BTC, around $70 million at the time91 in a trillionthe odds an attacker had to beat on a Mk3 — the design called for one chance in a number with 78 digits1What went wrongA safety check that was there, and did nothingSix steps, no jargon. The note beside each one is the precise technical version, for anyone who wants to check the work.01Everything else assumes this one numberA hardware wallet does several jobs. It shows you what you are actually signing rather than asking you to trust the screen of an infected computer, and it keeps your key inside a chip built to resist being opened. Every one of those defences assumes the same thing: that the number your key was derived from could not have been guessed. If it could, an attacker never has to get past any of them. The pool a 24-word phrase is supposed to be drawn from holds roughly one number for every thousand atoms in the observable universe. The point was never that your phrase is hidden. It is that the pool cannot be searched.Technical detail12 words carry 128 bits of entropy, 24 carry 256, plus a checksum from the SHA-256 of that entropy. BIP-39 stretches the result into the BIP-32 master key.Technical detail12 words carry 128 bits of entropy, 24 carry 256, plus a checksum from the SHA-256 of that entropy. BIP-39 stretches the result into the BIP-32 master key.02COLDCARD stopped drawing from that poolA 2021 firmware change quietly stopped the wallet asking its dedicated randomness chip for that number, and had ordinary software calculate one instead. Side by side, this is the entire incident:It is tempting to read that as security cut by two thirds. It is not. Each bit doubles the work, so losing 88 of them does not shrink the job by a factor of three — it shrinks it by a factor of 2⁸⁸. A trillion is still a large number to a person; it is not a large number to someone renting high-performance machines to work through it one at a time.Technical detailSeed generation moved from ckcc.rng_bytes() to ngu.random.bytes(). Coinkite estimates about 40 bits of remaining search space on Mk3 and about 72 on Mk4/Mk5/Q, against a 128-bit target. Independent analysis by Block reaches the same order — under 2⁴⁰·⁷ and under 2⁷³·³ — and finds narrower conditions where far less is left.2Technical detailSeed generation moved from ckcc.rng_bytes() to ngu.random.bytes().