End-to-end reproduction of the affected generator

dk27ss-poc-readme

https://raw.githubusercontent.com/DK27ss/ColdCard-38M-PoC/main/README.md

Organisation

DK27ss

Evidence role

Independent primary analysis

Published

2026-08-01

Source changes

0

Detected differences

0

Unreviewed

0

Copies held

1

Reimplements the MicroPython fallback and the libngu mixer, generates a synthetic victim wallet through the affected path, then recovers its mnemonic by searching the timer and skip space. The victim is fabricated by the repository's own script, so the demonstration never requires anyone's recovery material and runs offline. Author is anonymous and the repository states no licence; the claims are checkable because the scripts and their target file are published.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked 2 Aug 2026, 01:00 UTC.

1. Earliest copy held Current
   seen 2 Aug 2026, 00:26 UTC · Captured here text sha256 9c91777ec8e15eb508a12ddb 16,312 chars
   Extracted text as captured

   # ColdCard-38M-PoC
   ---
   ## summary
   Between March 2021 (firmware 4.0.0) and July 2026, BIP39 seed generation on
   Coldcard devices **did not use the hardware true random number generator
   (TRNG)**. Following a cryptographic migration to `libsecp256k1` (commit
   `b18723dd`, "First pass w/ libNgU", 2021-03-01), the seed-generation path
   ended up wired — through link-time symbol resolution — to a **software
   fallback PRNG shipped with MicroPython**, seeded only from device and timing
   state.
   Consequence: the effective space of generated seeds collapses to a single
   universal **2³² space on Mk2/Mk3** (see [model](#model): `pad = UID ^
   SysTick` is one 32-bit word, and the RTC is static — no per-device knowledge
   is needed at all) and **~2⁷³ on Mk4/Mk5/Q** (Coinkite's tuple-counting
   estimate is ~2⁴⁰/~2⁷²; the structural ceilings are lower). An attacker who
   knows a wallet's public address can replay the PRNG state space, regenerate
   candidate seeds, and identify the right one by simple address comparison —
   without ever touching the device. One single sweep of the space, checked
   against every funded address on-chain, recovers **all** vulnerable wallets
   at once.
   This repository contains a complete reconstruction of the attack, validated
   end to end: mnemonic recovery in **under two minutes** on CPU, with a
   signature proof.
   ### Affected versions (source: Coinkite)
   | Firmware | Hardware | Status |
   |---|---|---|
   | 1.0.0 – 3.2.2 (→ Jan 14, 2021) | Mk1, Mk2, Mk3 | not affected |
   | 4.0.0 – 4.1.9 | Mk2, Mk3 | **affected — worst case** (~2⁴⁰) |
   | 5.0.0 – 5.5.1 | Mk4, Mk5 | affected (~2⁷²) |
   | 0.0.2Q – 1.4.1Q | Q | affected (~2⁷²) |
   | 6.x "X"/Edge | Mk4/Mk5/Q | affected (~2⁷²) |
   Fixes: 4.2.0 (Mk3), 5.6.0 (Mk4/Mk5), 1.5.0Q (Q), 6.6.0X / 6.6.0QX (Edge).
   **Updating does not repair an already-generated seed**: a new seed must be
   generated and funds migrated. Exception: seeds created with ≥ 50 independent
   dice rolls.
   ---
   ## Root cause
   The bug is not a single defect but a **chain of four flaws**, each harmless
   in appearance.
   <img width="1653" height="912" alt="diagram_rng_chain" src="https://github.com/user-attachments/assets/fcc4dee2-4f00-48b1-ad5e-e5b6906af14f" />

   Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.