Coinkite Says Your Coldcard Seed Has 72 Bits. Block Says 32.

Between 01:31 and 01:56 UTC on Friday, roughly 594 BTC left about 500 Bitcoin addresses. CoinDesk valued the sweep near $38 million. The addresses shared one trait: every Coldcard seed behind them came out of a device whose hardware random number generator never ran. Bitcoin Magazine, writing later the same day, put the running total above 1,000 BTC as the sweep continued.

Block's Bitcoin engineering team published the root cause that morning. Coinkite, the Toronto company that builds the Coldcard, followed with its own technical backgrounder. Both documents describe the same broken line of build logic. They land on very different answers to the question every owner now cares about, which is how many guesses an attacker needs to reproduce a Coldcard seed. One says about 32 bits. The other says about 72.

A macro nobody switched on

Production Coldcard boards set MICROPY_HW_ENABLE_RNG to zero. That looks alarming and is not: the device carries its own wrapper around the STM32 hardware RNG, so MicroPython's built-in path stays out of the way on purpose. The problem sat one layer down. Block's write-up says the libngu library checked whether the macro had been declared at all, rather than whether it carried a nonzero value. Zero is still a value. The check passed.

So the firmware compiled cleanly and bound to Yasmarang, MicroPython's small deterministic fallback PRNG, instead of the silicon. Block traced the regression to commit b18723dd, dated March 1, 2021, which reached users in firmware v4.0.0 on March 17, 2021. Coinkite's own account adds that the two functions carried identical signatures, which is why nothing screamed during review. Five years of Coldcard seed generation ran on that fallback.

What feeds the fallback matters more than the fallback itself. Block lists four inputs: the low 32 bits of the chip UID, which never changes for a given device; SysTick, a boot-time counter; and two RTC time registers that track when the device woke up. On Mk2 and Mk3, SysTick spans roughly 80,000 plausible values, about 2^16.29. Current hardware spans around 120,000, about 2^16.87. None of that is secret. A serial number is printed on the box.

Forty bits, and then the two reports part ways

Coinkite puts the effective search space for an Mk3 Coldcard seed at about 40 bits, against a 128-bit design target. Block, working from unknown timer state on the same generation, arrives at roughly 2^40.7. On the older device the two teams agree, and 40 bits has been within reach of ordinary hardware for a long time.

The newer devices are where the accounts diverge. Coinkite estimates about 72 bits for Mk4, Q and Mk5. Block describes something narrower: boot adds entropy from the secure element, then hashes it and keeps only four bytes, and the reseed call overwrites a single 32-bit word of Yasmarang state. That caps the distinct output streams at 2^32, with an average of about 2^31 trials to find the right one.

Forty bits of disagreement is not a rounding error. It is a factor near 1.1 trillion. A 2^31 average search finishes on a laptop over a long weekend. A 2^72 search does not finish. Block flags the uncertainty itself, noting that practical cost depends on what an attacker knows about the UID, the boot timing and prior RNG calls, and pointing readers toward Coinkite's definitive report when it lands.

One detail got flattened in the first wave of coverage. Several outlets reported that Mk4, Q and Mk5 were clear. Neither primary document says that. Coinkite lists Mk4 and Mk5 before 5.6.0 and Q before 1.5.0Q as carrying the flaw, and Block describes the limited 32-bit reseed on exactly those boards.

Paper wallets sit in the worst position here

A Coldcard seed in BIP39 form at least passes through key stretching and derivation before it becomes an address. The paper wallet feature skips all of that. Block notes that the RNG output becomes the secp256k1 private key directly, with no BIP39 or BIP32 step in between, so an attacker can test candidates straight against any address that has ever appeared on chain.

The same generator also fed seed XOR masks, device cloning keys, USB and Key Teleport session keys, Web2FA material, Secure Notes passwords and HSM local codes. That list widens the blast radius well past the obvious case of a fresh wallet. A Coldcard seed exported years ago and loaded into some other software carries the weakness with it, because the weakness lives in the number, not the device holding it.

There is a long-running argument in Bitcoin about how much a visible public key costs you. Coinliva looked at it recently through the quantum lens, where 34% of supply has already shown its key to anyone watching. This bug turns the same exposure into something usable today rather than something to worry about in a decade. For scale on the other side of the market, Coinliva covered a single hacking unit taking $578 million from DeFi in 18 days in April.

Working out your own exposure

Start with the question of whether the fallback ever touched your Coldcard seed. Coinkite's guidance is blunt on the point that matters most: updating firmware does not change or repair a seed that already exists. The fix protects the next seed you generate, nothing earlier.

Dice change the arithmetic. Fifty independent rolls of a six-sided die contribute about 129 bits on their own, which clears the design target without any help from the chip, and Coinkite recommends at least 99 rolls for a new Coldcard seed. A BIP39 passphrase helps for a different reason: you supply it, so the generator never sees it, and a strong one keeps funds out of reach even when the underlying seed is weak. Owners who used either method sit in a much better place than owners who pressed the button and wrote down twelve words.

Multisig complicates the picture rather than solving it, since one weak signer in a quorum can still leak. Peter Todd raised the related problem of first-time address disclosure and pointed at MARA's Slipstream service for people moving funds without broadcasting early. If you are unsure how a quorum should be built in the first place, our guide to multisig wallets and when to use them covers the setup decisions.

NVK, Coinkite's co-founder, framed the discovery itself as the wider lesson, saying that AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts. Block published before finishing its exploitability testing, because the theft had already started.

Frequently asked questions

Does a firmware update rescue my existing coins? No. Coinkite states plainly that the update repairs the generator, not the seed. Moving funds to a wallet created on patched firmware is the only path that removes the risk.

My Coldcard is an Mk4 and the headlines said Mk4 was fine. Is it? Only if the seed came from firmware 5.6.0 or later. Both Block and Coinkite describe the flaw reaching Mk4, Q and Mk5 below the fixed versions, whatever the early headlines said.

Which number should I plan around for a Coldcard seed, 32 bits or 72? Plan around the smaller one until Coinkite publishes its definitive report. Block itself recommends that readers wait for that document, and treating a 2^31 average search as the working assumption costs you nothing except the effort of a migration.

I used a passphrase. Do I still need to move? The passphrase sits outside the broken generator, so the practical risk drops sharply, and Coinkite describes that group as facing minimal exposure. Migrating anyway removes the question, and it also gets you off a firmware branch that has now produced one five-year silent failure. The people most exposed remain those who generated a plain Coldcard seed on an Mk3 between March 2021 and this week, particularly anyone who also printed a paper wallet from the same device.