Coinkite, maker of the Coldcard hardware wallet, released firmware 5.6.1 (for Mk4 and Mk5) and 1.5.1Q (for the Q model) requiring users to manually supply randomness: at least 50 dice rolls, 128 coin flips, or 65 key presses for each new seed. This follows a random number generator flaw that exposed customer funds, allowing 594.5 BTC (over $100 million) to be swept from 500 addresses on July 30. The vulnerability stemmed from a build error that routed RNG calls to MicroPython’s Yasmarang PRNG instead of hardware, reducing entropy from 128 to 72 bits. The new firmware verifies the hardware RNG path at boot and replaces Yasmarang with a SHA-256 Hash_DRBG compliant with NIST SP 800-90A.
Source: Read the original article
