Earlier predictable-key incidents
Predictable key generation has several documented precedents. The mechanisms and measured impact differ, so the comparisons below are deliberately narrow.
No code. Written to be actionable.
Earlier incidents help identify recurring failure patterns, but they do not establish the attack cost or likely outcome of this incident. Each row below states the specific similarity and the important difference. One difference is worth flagging before the table: the precedents here concern key generation, whereas this incident additionally reaches device features that never touch the user's seed.
flowchart LR A["A cryptographic API requests random bytes"] --> B["A weak or improperly seeded generator supplies them"] B --> C["The output may still look statistically random"] C --> D["An attacker enumerates a much smaller candidate space"] D --> E["Affected keys or wallets must be replaced"]
A common pattern, not a claim that every incident followed the same code path or had the same candidate-space size.
Comparison register
| Incident | Affected period | Established mechanism | Relevant comparison and limit |
|---|---|---|---|
| Debian OpenSSLCVE-2008-0166 | Sep 2006 to May 2008 | A Debian-specific change made OpenSSL's generator predictable. Debian advised recreating affected cryptographic key material from scratch. | Like COLDCARD, a code change reduced the key-generation space without changing the caller's expectation of cryptographic randomness. The exact Debian key spaces depended on key type, size and architecture, so a single universal bit count is misleading. |
| Android PRNG | Disclosed Aug 2013 | Android reported improper initialization of the underlying PRNG for some Java Cryptography Architecture and OpenSSL uses. Bitcoin applications were among the affected software. | Both incidents involved a cryptographic-looking interface backed by insufficient initialization. Android's issue also affected per-signature randomness, so it is not a direct model for COLDCARD's seed generation. |
| RandstormBitcoinJS and derivatives | Wallets observed from 2011 to 2015 | Unciphered attributes vulnerable browser-generated wallets to BitcoinJS's use of JSBN SecureRandom() combined with weaknesses in browser Math.random() implementations. | Both cases concern long-lived wallet key material generated through a weak random path. Randstorm's attack work varies substantially by browser and date, unlike a single fixed entropy estimate. |
| Milk SadCVE-2023-39910 | Libbitcoin Explorer 3.x | bx seed used MT19937 with at most 32 bits of initial seeding input while allowing callers to request longer output. | This is a direct example of long output not adding entropy beyond a small seed space. Researchers attributed approximately 29.65 BTC in one July 2023 cluster and described their wider loss estimate as a lower bound with attribution caveats. |
| Trust WalletCVE-2023-31290 | Addresses created 14 to 23 Nov 2022 | The vulnerable wallet-generation code used MT19937 with a 32-bit seed. The NVD record reports exploitation in December 2022 and March 2023. A Trust Wallet postmortem quoted in the Milk Sad disclosure reported two exploits totalling approximately US$170,000. | The 32-bit generator resembles Milk Sad, but its output-consumption pattern produced a different key space. It is separate from Trust Wallet's unrelated 2025 browser-extension supply-chain incident. |
| COLDCARD | Mar 2021 to Jul 2026 | A #ifndef guard treated a macro defined as (0) as present, allowing the linked software generator. Mk4-class boot reseeding then reduced 40 secure-element bytes to one 32-bit value. The affected period starts from the March 2021 change that routed seed generation through that library; the board configuration itself is older, as the commit reconciliation sets out. | Published attack models differ by device class and assumptions. See the entropy model register; there is no single verified 2^n figure for all affected devices. |
What a 32-bit funnel does and does not mean
Milk Sad and the affected Trust Wallet implementation seeded MT19937 from a
32-bit value, so those generators had at most 2^32 initial states.
COLDCARD's Mk4-class path has a related but not identical property: 40 bytes
read from secure elements were hashed, then only four bytes were passed to
reseed(). That operation contributed at most 32 bits of
secure-element uncertainty.
It does not follow that every Mk4-class wallet had exactly a
2^32 total search space. The software generator also depended on
device and timing inputs, and the attack cost depends on what an attacker
knows or can enumerate. Published Mk4-class estimates therefore range
widely and require their assumptions to be stated.
A deterministic generator can produce output that passes common statistical tests even when it can start from only a small number of states. Output testing may detect some failures, such as a stuck source, but it cannot by itself establish the size or provenance of the seed space. Code-path review, state accounting and reproducible tests are also required.
Remediation evidence is incomplete
The Milk Sad team reported that it did not find substantial remaining Bitcoin
balances above US$5,000 in the bx 3.x ranges it analysed at the
time of disclosure. It also stated that its search was partial and could not
cover every derivation path, coin or passphrase-protected wallet. That result
is not a migration rate and does not distinguish every owner move from every
theft.
The corresponding denominator for COLDCARD is also unknown. Public sources do not provide the number of seeds generated on each affected firmware version, so neither the fraction already attacked nor the fraction already migrated could be calculated from public sources captured through 1 August 2026.