Analysis of the Coldcard Security Incident
What can this incident teach us?
A firmware flaw put thousands of private keys at risk. A small error with a major impact that reduced the security of the generated keys.
A small error. A major impact.
The flaw remained undetected for approximately 5 years.
of effective entropy
compromised addresses
stolen
Security does not depend on a single control
This case demonstrates the importance of:
-
Defining verifiable security requirements.
-
Reviewing and validating code.
-
Managing changes properly.
-
Continuously detecting vulnerabilities.
-
Applying a defence-in-depth strategy.
Turn lessons into controls
ISO/IEC 27001 helps organisations manage information security risks through controls, processes and continuous improvement.
How did the incident happen?
A flaw remained hidden for years. In 2021, a firmware change caused key generation to use a predictable software generator instead of the intended hardware random number generator. The issue remained undetected until 2026.
The attacker did not need:
- Physical access to the device.
- Phishing.
- Social engineering.
The keys were reconstructed through computation.
What did the analysis reveal?
The randomness was much lower than expected. This made it computationally feasible to search the space of possible keys until public matches were found on the blockchain. An apparently robust protection mechanism became predictable because of a single flaw.
128 bits
The system was designed to generate keys with approximately 128 bits of entropy.
40 bits
But in the most affected models, this was reduced to 40 bits of effective entropy.
