The Root Cause: MICROPY_HW_ENABLE_RNG (0) and Silent Degradation

The Coldcard vulnerability represents one of the most significant security events in hardware wallet history. At its core, the issue was not a failure of physical silicon or a cryptographic attack on elliptic curves, but a software compilation header oversight that bypassed hardware security mechanisms.

In MicroPython-based firmware, hardware peripheral drivers are enabled via preprocessor definition flags. In the build configuration for affected Coldcard firmware releases, the flag MICROPY_HW_ENABLE_RNG was set to 0.

When MICROPY_HW_ENABLE_RNG was set to 0, the underlying hardware True Random Number Generator (TRNG) peripheral was completely disabled at compile time. However, the higher-level code that generated wallet seeds was designed with a fallback mechanism: if the hardware TRNG was unavailable, execution fell back to a software PRNG known as Yasmarang.

Crucially, the system executed this fallback silently—without displaying an error message, warning the user, or halting the setup process. The user believed they were generating a high-entropy 24-word seed phrase backed by secure hardware TRNG chips, when in reality they were receiving output from a weak software generator seeded by low-entropy inputs like MCU clocks and device serial numbers.

Cryptographic Mechanics: 40-Bit Search Spaces vs. 256-Bit Security

Standard Bitcoin security relies on 128-bit (for 12-word seeds) or 256-bit (for 24-word seeds) entropy. A 256-bit key space contains 2^256 possible combinations—a number larger than the total number of atoms in the observable universe, making brute-force search mathematically impossible.

Because the Yasmarang software PRNG was initialized with highly predictable system state variables (such as fixed serial prefixes and narrow millisecond timer windows), the effective entropy space collapsed:

  • Mk3 Devices: Effective entropy dropped to approximately 40 bits (~1 trillion combinations). Modern GPUs can scan a 40-bit key space in hours.
  • Mk4, Mk5 & Q Series: Effective entropy dropped to around 72 bits. While larger than 40 bits, a 72-bit space is well within range for organized criminal groups utilizing dedicated cracking clusters or precomputed rainbow tables.

Once automated exploitation tools identified the deterministic generation patterns, attackers systematically regenerated all possible key combinations offline and queried the public Bitcoin blockchain.

Model Your Portfolio Contingency in Our Simulator →

Hardware Security Principles: Why Systems Must Fail Closed

The primary engineering lesson from the Coldcard exploit is the necessity of "Fail Closed" design in high-security systems.

In web development or consumer software, "Fail Soft" (degrading functionality gracefully) is often preferred to keep the user experience intact. However, in cryptographic hardware, a silent fallback is a vulnerability.

If a hardware security module cannot access its required TRNG or Secure Element entropy source, it must fail hard:

  1. Halt execution immediately.
  2. Render an unbypassable error on the display.
  3. Refuse to produce cryptographic seed material.

By allowing execution to proceed with degraded software randomness, the system prioritized user convenience over absolute security—violating core hardware wallet design principles.

Audit Blind Spots and Lessons for Open-Source Self-Custody

This vulnerability highlights a critical distinction in security auditing: the gap between source code logic and build pipeline artifacts.

Reviewers inspecting the high-level Python and C source files could see logic designed to call hardware RNG functions. However, unless the auditor inspected the exact build headers, preprocessor definitions, and compiled binaries, the disabled flag MICROPY_HW_ENABLE_RNG (0) remained invisible.

Key takeaways for the self-custody industry include:

  • Reproducible Builds: Firmware binaries must be verifiably reproducible so independent auditors can confirm that source configuration flags match published binaries.
  • Multi-Source Entropy: Hardware devices should blend multiple independent entropy sources (MCU TRNG, Secure Elements, and mandatory or optional user dice rolls) so that the failure of any single component cannot collapse total entropy.
  • Defense in Depth: Users managing substantial Bitcoin holdings should employ multisig configurations across hardware devices from different manufacturers, preventing single-vendor firmware bugs from compromising funds.

Build an Encrypted Backup Vault in ZeroLatch →