Block's Bitcoin Engineering team published a technical analysis on July 30 describing an RNG integration error in Coldcard firmware. The library libngu incorrectly checked whether a hardware RNG macro was defined rather than enabled, causing it to bind to MicroPython's deterministic Yasmarang fallback instead of the STM32 hardware RNG. On Mk2 and Mk3 v4 devices, no cryptographic entropy was added to ngu.random, making wallet generation deterministic for a known MCU UID, timer state, and call history. On Mk4, Q, and Mk5, secure-element entropy is added at boot but hashed to only four bytes, and a 32-bit reseed replaces just one Yasmarang state word, limiting securely distinguished output streams to at most 2^32.
Coinkite has not confirmed a direct causal link between the firmware flaw and the 594 BTC sweep. CEO Rodolfo Novak (NVK) stated on X that the sweep involved compromised or weak seeds across keys from different wallets and rejected claims of a device-wide cryptographic breach. The company characterized its advisory as precautionary and based on early findings, promising a formal technical review.
For affected users, Coinkite recommends generating a new seed on an unaffected device, verifying the backup and receive address, sending a small test transaction, and then moving the remaining funds. The company's preliminary assessment indicates that seeds protected with a BIP-39 passphrase face minimal risk, emphasizing that this refers to a passphrase distinct from the device PIN. Experienced users may also employ a dice-roll seed generation method that bypasses the Mk3's RNG entirely.