9Arm exposes Coldcard hardware wallet security failure

MGR Online•Economy•7d ago

Reader Briefing

Technology YouTuber 9Arm analyzed a critical security flaw in Coinkite's Coldcard hardware wallet that led to losses of 220 million USD.

•Coinkite's Coldcard hardware wallet suffered a security breach due to a coding error regarding random number generation.
•The flaw allowed hackers to calculate possible seed phrases using basic computers and public blockchain data.
•Total losses are estimated at 220 million USD (over 6,000 million Baht) concentrated in three accounts.
•The vulnerability occurred because the system used a weak backup random function called Yasmarang instead of the intended hardware function.

•Coinkite replaced Trezor's GPL-licensed code with its own library named NGU to avoid open-source requirements.
•A naming conflict between Coinkite's hardware function and MicroPython's library caused the linker to ignore Coinkite's secure code.
•Coinkite developers misunderstood the MICROPY_HW_ENABLE_RNG variable, believing setting it to 0 would force the use of the hardware function.
•The device defaulted to the Yasmarang algorithm, restricting entropy to only 80,000 possible values per chip.
•Hackers used home computers to calculate these values and query the Bitcoin blockchain, stealing 220 million USD.
•Users who utilized the Dice Roll mode or BIP-39 Passphrase remained unaffected by this vulnerability.
•9Arm noted that Coinkite had previously ignored a warning from a user regarding the unusual behavior of the random number system.
•9Arm criticized Coinkite for a lack of integration testing and code audits for a device managing billions in assets.

Full article content is available on the original source.

Thanon Patinyasakulkul(นายธนนท์ ปฏิญญาศักดิ์กุล)

A technology YouTuber known as 9Arm who analyzed the Coldcard security vulnerability.

Coinkite

The company that produces the Coldcard hardware wallet.

Trezor

A competitor in the hardware wallet market whose GPL-licensed code was originally used by Coldcard.

The General Public License governing the requirement to disclose modified source code.