Coldcard RNG bug weakens keys to brute‑force attacks

Maybe I just missed it, but I haven’t seen any explanations of the Coldcard vulnerability, so here goes.

In March 2021, when Coldcard updated firmware to version 4.0.0, they replaced the built‑in random number generator in MicroPython with their own RNG. To disable MicroPython’s RNG, they set the parameter MICROPY_HW_ENABLE_RNG to 0.

The problem is that this parameter wasn’t validated by checking its value, only by checking whether it existed. So the RNG they thought they had replaced with their own implementation was actually still the original MicroPython RNG all along.

As a result, key generation up to now has used a pseudorandom number generator called Yasmarang (not true random). It takes only three inputs: the chip ID, a timer register, and the internal clock.

Devices that should have had 128 bits of difficulty ended up with 40 bits for older models and 72 bits for newer ones. Even on newer models, the size of the possible private‑key pool shrank to just a few billion.

So attacks against Coldcard right now are simple brute force. If you moved your funds out before being targeted, you might be fine, but Bitcoin maxis mainly keep BTC parked and rarely move it, so I suspect the response was slow.

Problematic commit: https://github.com/Coldcard/firmware/commit/37e4af5451c260c1e7d429fe8972c4cb5e68ee59