On Mk2 and Mk3 devices, no cryptographic entropy was added to the output; for a known UID, timer state, and call history, wallet generation became deterministic. Newer Mk4, Mk5, and Q models added secure-element entropy but hashed it down to four bytes and replaced only one 32-bit Yasmarang state word on reseed, limiting securely distinguished output streams to at most 2^32 — about 72 bits of effective entropy, still well below the design target.
The attack required no phishing, no physical device access, and no user error. Victims' keys were reconstructed offline by attackers who exploited the reduced entropy space. Every transaction in the first wave used an identical hardcoded fee rate of 30 sat/vB — 30 to 75 times the median that week — and left no change output, indicating automated spending of pre-held private keys. Chainalysis found the attacker prioritized high-value wallets, stealing approximately $30 million in the first ten minutes and $1.8 million from a single victim.
Coinkite CEO Rodolfo Novak acknowledged that AI-assisted code review can now find hidden bugs faster than even the industry's most experienced experts, and noted that if firmware is open source or has ever been public, it should be assumed to be read by both attackers and defenders alike. Independent researchers subsequently demonstrated that Anthropic's Claude identified the same vulnerability within eight minutes of code analysis.