COLDCARD releases major security update after seed-generation hack

Coinkite, the Canadian company behind the COLDCARD hardware wallet, has shipped firmware version 5.6.1 for its Mk4 and Mk5 devices, along with version 1.5.1Q for its Q-series models. The updates arrive after attackers exploited a seed-generation vulnerability that drained approximately 1,816 BTC, worth roughly $114M to $116M, from affected wallets. The flaw wasn’t new. It had been sitting in COLDCARD’s code since firmware version 4.0.1, released back in March 2021. For more than five years, seeds generated on affected devices were predictably weak enough for attackers to reconstruct them. What went wrong with seed generation COLDCARD devices use a true random number generator, or TRNG, built into the hardware. A flaw introduced in the libngu library around March 2021 affected seed-generated randomness, weakening the TRNG. This defect led to significantly reduced entropy in Mk2/Mk3 units, down to approximately 40 bits, and lesser reductions in later COLDCARD models. The vulnerability affected a wide range of COLDCARD models, including the Mk2, Mk3, Mk4, Mk5, and Q devices. Anyone who generated a new seed on any of these models running the flawed firmware was potentially exposed. Att...