End-to-end reproduction of the affected generator

dk27ss-poc-readme

https://raw.githubusercontent.com/DK27ss/ColdCard-38M-PoC/main/README.md

Organisation: DK27ss
Evidence role: Independent primary analysis
Published: 2026-08-01
Source changes: 0
Detected differences: 0
Unreviewed: 0
Copies held: 1

Reimplements the MicroPython fallback and the libngu mixer, generates a synthetic victim wallet through the affected path, then recovers its mnemonic by searching the timer and skip space. The victim is fabricated by the repository's own script, so the demonstration never requires anyone's recovery material and runs offline. Author is anonymous and the repository states no licence; the claims are checkable because the scripts and their target file are published.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 15 Aug 2026, 12:26 UTC.

Earliest copy held Current

seen 2 Aug 2026, 00:26 UTC · Captured here 16,312 chars

What changed from the previous capture 0 lines

Extracted text as captured

# ColdCard-38M-PoC
---
## summary
Between March 2021 (firmware 4.0.0) and July 2026, BIP39 seed generation on
Coldcard devices **did not use the hardware true random number generator
(TRNG)**. Following a cryptographic migration to `libsecp256k1` (commit
`b18723dd`, "First pass w/ libNgU", 2021-03-01), the seed-generation path
ended up wired — through link-time symbol resolution — to a **software
fallback PRNG shipped with MicroPython**, seeded only from device and timing
state.
Consequence: the effective space of generated seeds collapses to a single
universal **2³² space on Mk2/Mk3** (see [model](#model): `pad = UID ^
SysTick` is one 32-bit word, and the RTC is static — no per-device knowledge
is needed at all) and **~2⁷³ on Mk4/Mk5/Q** (Coinkite's tuple-counting
estimate is ~2⁴⁰/~2⁷²; the structural ceilings are lower). An attacker who
knows a wallet's public address can replay the PRNG state space, regenerate
candidate seeds, and identify the right one by simple address comparison —
without ever touching the device. One single sweep of the space, checked
against every funded address on-chain, recovers **all** vulnerable wallets
at once.
This repository contains a complete reconstruction of the attack, validated
end to end: mnemonic recovery in **under two minutes** on CPU, with a
signature proof.
### Affected versions (source: Coinkite)
| Firmware | Hardware | Status |
|---|---|---|
| 1.0.0 – 3.2.2 (→ Jan 14, 2021) | Mk1, Mk2, Mk3 | not affected |
| 4.0.0 – 4.1.9 | Mk2, Mk3 | **affected — worst case** (~2⁴⁰) |
| 5.0.0 – 5.5.1 | Mk4, Mk5 | affected (~2⁷²) |
| 0.0.2Q – 1.4.1Q | Q | affected (~2⁷²) |
| 6.x "X"/Edge | Mk4/Mk5/Q | affected (~2⁷²) |
Fixes: 4.2.0 (Mk3), 5.6.0 (Mk4/Mk5), 1.5.0Q (Q), 6.6.0X / 6.6.0QX (Edge).
**Updating does not repair an already-generated seed**: a new seed must be
generated and funds migrated. Exception: seeds created with ≥ 50 independent
dice rolls.
---
## Root cause
The bug is not a single defect but a **chain of four flaws**, each harmless
in appearance.
<img width="1653" height="912" alt="diagram_rng_chain" src="https://github.com/user-attachments/assets/fcc4dee2-4f00-48b1-ad5e-e5b6906af14f" />

Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.

Held captures