OAK — OnChain Attack Knowledge

Worked example · 2026-07

Coldcard — a 2021 library migration left an RNG config check that tested whether a setting existed but not whether it was on, silently dropping seed entropy from 128 bits to 40, and five years of seeds were swept — Coldcard / Coinkite (Bitcoin) — 2026-07-30/31 onward, ongoing

Loss
Escalating and not final. As of 2026-08-04, Galaxy Research puts confirmed losses at 1,596 BTC (~$100M) across roughly 7,300 addresses, with a further ~459 BTC (~$30M) suspected in an unconfirmed fourth wave — a total potential ~2,055 BTC (~$130M). The first wave alone took 594 BTC (~$38M) from about 500 wallets in 25 minutes, with broader activity across ~41 minutes reaching 1,083 BTC (~$70M) over ~1,196 addresses; the attacker prioritised the largest wallets, extracting about $30M in the first 10 minutes. Dating differs by outlet between 2026-07-30 and 2026-07-31 for the opening sweep. Approximately 90% of the stolen coins remain unmoved and traceable. Independently, TRM Labs put the total at ~1,816 BTC (~$116M) across more than 5,200 addresses as of 2026-08-05, counting four waves with the fourth still in the mempool at the time of its analysis — a figure between Galaxy's confirmed and total-potential bounds, from a separate methodology. TRM ranks the incident the third-largest crypto theft of 2026 against a year-to-date total exceeding $1.2B across 276 incidents. This entry documents a live incident and its figures will age.
OAK Techniques observed
OAK-T11.004 (Insufficient-Entropy Key Generation — primary, confirmed mechanism, and on loss alone the largest anchor this Technique has. During a 2021 software-library migration, Coinkite's random-number-generator configuration check verified only that a setting existed, not whether it was enabled. Seed generation silently fell back from the STM32 hardware RNG to a software PRNG seeded from predictable inputs — a chip identifier comparable to a serial number, plus internal clock values tied to startup timing. Effective entropy dropped to ~40 bits on Mk3 and ~72 bits on Mk4 / Mk5 / Q, against the 128-bit design floor. Seeds became reproducible offline, so keys could be precomputed and funds swept with no physical access to any device. See techniques/T11.004-insufficient-entropy-key-generation.md). OAK-T5.001 (Hard Drain — the on-chain manifestation: automated sweeps against precomputed key lists, draining addresses completely at elevated fixed fees). **Two neighbouring Techniques are explicitly not applicable and the distinction matters: OAK-T11.007 (Hardware-Wallet Supply-Chain / Physical-Access Compromise) does not hold — no device was touched, substituted, or physically attacked; and OAK-T11.002 (Wallet-Software Distribution Compromise) does not** hold — nobody compromised Coinkite's build or distribution. The firmware shipped was the firmware Coinkite intended to ship, and it was wrong.
Attribution
pseudonymous. Roughly 600 attacker addresses have been identified. Galaxy Research established the confirmed figures at high confidence from victim reports and on-chain analysis, and supplied information to U.S. federal law enforcement and to exchanges; 73 victims are actively assisting recovery. Galaxy's Head of Research characterised the sweeps as "programmatic" and "probably orchestrated with a large language model" — this is stated analysis, not established fact, and OAK records it as such. Separately, Coinkite acknowledged that its own AI-assisted code review had missed the flaw, and co-founder NVK stated that "AI-assisted code review can now find latent bugs at a speed that is outpacing even the industry's most seasoned experts." Whether an attacker actually used such tooling here is not demonstrated; what is on the record is the vendor's own account that AI-assisted review failed to catch it. TRM Labs, publishing on 2026-08-05, explicitly declined to attribute the theft to any actor, and added two observations that cut against a single-operator reading: transaction-construction differs across the waves, suggesting multiple attackers working the same disclosed keyspace, and the laundering is conspicuously unprofessional — one 64.9 BTC Wasabi deposit, 200 ETH to Tornado Cash, and otherwise a single consolidation hop with no layering. A disclosed weak-key population is a public resource, and OAK should expect its exploitation to be a race between unrelated parties rather than one operator's campaign.
Key teaching point
A key is generated once and is wrong forever — which is why this class has a blast radius measured in years rather than in transactions. Coldcard shipped the defect in firmware 4.0.1 in March 2021 and patched it on 2026-07-31: five years and four months during which every seed generated on an affected device was born weak. The single most important operational fact, and the one most likely to be misread, is that installing the fixed firmware does not repair an existing seed. A user who patched and did nothing else is exactly as exposed as before, because the entropy was consumed at generation time and cannot be retroactively added. Remediation is necessarily a migration: fixed firmware, an entirely new seed, fingerprint verification, a test transaction, then the full balance moved. Three defence-in-depth measures worked and are the reusable lesson — user-supplied dice rolls (≥50 independent rolls) folded into generation, a BIP-39 passphrase (which derives a different wallet entirely), and multisig where the weak seed is only one key of N. Each of these is normally sold as paranoia for the over-cautious; here each one was the difference between total loss and no loss. The structural point for defenders: entropy is the one property of a key that cannot be audited from the outside — a 40-bit seed and a 256-bit seed produce addresses and signatures that are indistinguishable at the consensus layer, which is why this class is invisible until someone brute-forces it and why it is discovered by disclosure rather than by monitoring.

Summary

Coldcard, made by Coinkite, is a widely used Bitcoin hardware wallet. Its security model rests on generating recovery seeds on-device using the STM32 hardware random number generator.

During a software-library migration in 2021, a configuration check regressed: the code verified that the RNG setting existed but not that it was enabled. Seed generation therefore fell back, silently and without any user-visible error, to a software PRNG seeded from predictable inputs — a chip identifier similar to a serial number, and internal clock values associated with startup timing.

The result was a catastrophic entropy collapse. Against a 128-bit design floor, effective entropy fell to approximately 40 bits on Mk3 and approximately 72 bits on Mk4, Mk5 and Q devices. At 40 bits, the seed space is small enough to enumerate offline; the attacker never needs the device.

The flaw entered with firmware 4.0.1 in March 2021 (Mk3 affected through 4.1.9) and persisted until Coinkite shipped fixes on 2026-07-31 at 09:33 EDT: Mk3 → 4.2.0+, Mk4 / Mk5 → 5.6.0+, Q → 1.5.0Q+. TAPSIGNER, OPENDIME and SATSCARD are unaffected, running a different codebase. Coinkite destroyed its remaining inventory of vulnerable devices.

Exploitation began on 2026-07-30/31. The opening sweep took 594 BTC (~$38M) from about 500 wallets in 25 minutes; across roughly 41 minutes the wave reached 1,083 BTC (~$70M) over ~1,196 addresses, with the attacker working largest wallets first — about $30M inside 10 minutes. Three waves were analysed after the fact. A fourth wave was detected while it was still running, on 2026-08-03, which allowed some victims to escape by fee replacement, outbidding the attacker's sweep transactions.

As of 2026-08-04, Galaxy Research reports 1,596 BTC (~$100M) confirmed stolen across ~7,300 addresses, plus **459 BTC ($30M)** suspected in the unconfirmed fourth wave. About 600 attacker addresses are identified, ~90% of the stolen coins remain unmoved, and 73 victims are assisting recovery. The exploit remains active.

Timeline (UTC)

When Event OAK ref
2021-03 Firmware 4.0.1 ships. A library migration leaves an RNG configuration check that tests whether the setting exists, not whether it is enabled; seed generation silently falls back from the STM32 hardware RNG to a software PRNG seeded on chip ID and startup clock values T11.004 defect introduced
2021-03 → 2026-07-31 Five years four months of seed generation at ~40 bits (Mk3) / ~72 bits (Mk4, Mk5, Q) effective entropy against a 128-bit floor (standing exposure)
2026-07-30/31 First sweep: 594 BTC (~$38M) from ~500 wallets in 25 minutes; 1,083 BTC ($70M) across ~1,196 addresses over ~41 minutes; largest wallets first, ~$30M in 10 minutes T11.004 → T5.001
2026-07-31 09:33 EDT Coinkite ships fixed firmware: Mk3 4.2.0+, Mk4/Mk5 5.6.0+, Q 1.5.0Q+; states that updating firmware does not change or repair an existing seed (vendor response)
2026-08-01 → 08-02 Waves 2 and 3, analysed after the fact T5.001
2026-08-03 Wave 4 detected while occurring; some victims escape by fee replacement, outbidding the attacker's sweeps (live contest)
2026-08-04 Galaxy Research: 1,596 BTC (~$100M) confirmed across ~7,300 addresses, 459 BTC ($30M) suspected in wave 4; ~600 attacker addresses; ~90% of coins unmoved; 73 victims assisting; information supplied to U.S. federal law enforcement and exchanges (analysis / enforcement)
2026-08-04 Attacker-side movement remains minimal: a single 64.9 BTC deposit to Wasabi and 200 ETH to Tornado Cash; beyond initial consolidation, TRM observes one further consolidation hop rather than any attempt at layering or mixing T7.001 (limited)
2026-08-05 TRM Labs publishes independent figures: 1,816 BTC ($116M) from 5,200+ addresses across four waves, fourth wave still in the mempool at analysis time; explicitly declines to attribute, noting that transaction-construction differences across waves suggest more than one attacker, and that the cautious laundering pattern does not match professional cybercriminal tradecraft (analysis)
ongoing Exploit remains active; every unmigrated seed generated on affected firmware stays at risk (open)

What defenders observed

  • Pre-event (the config check tested existence, not state). The entire loss traces to a check that asked the wrong question. This is the highest-value generalisable finding: a configuration assertion must verify the effective runtime state, not the presence of a key in a config structure. A hardware-RNG health check that reads back and statistically tests actual output — rather than confirming a flag is set somewhere — would have failed loudly in March 2021 (M23).
  • Pre-event (silent fallback is the wrong failure mode for a security primitive). The device degraded from hardware to software entropy without any error, warning, or log. For a security-critical primitive the correct behaviour is to refuse to generate a seed at all rather than to generate a weak one. Fail-closed on entropy is a design rule this case argues for unusually strongly.
  • Pre-event (defence in depth actually decided outcomes here). Users who folded in ≥50 independent dice rolls, who set a BIP-39 passphrase, or who held funds in multisig where the weak seed was one key of N were protected. These are the measures normally dismissed as excessive; in this incident they were the whole difference. Guidance to high-value self-custody users should be revised on the strength of a real case rather than a hypothetical one (M11, M22).
  • Pre-event (entropy cannot be verified from outside). A weak key produces addresses and signatures indistinguishable from a strong key at the consensus layer. There is no on-chain monitoring, no analytics product, and no exchange screening that detects this before exploitation. That property is what makes T11.004 uniquely dangerous among custody classes, and it means the only real controls are at generation time.
  • At-event (largest wallets first, at elevated fixed fees). The sweep was automated against a precomputed key list, prioritised by balance, and used raised fixed fees for inclusion. Balance-ordered draining across thousands of unrelated addresses in minutes is a strong cohort signature and is precisely the shape a disclosure-triggered mass sweep takes.
  • At-event (fee replacement worked as a live defence). In wave 4, victims who were watching outbid the attacker's sweep transactions and rescued funds. This is a genuinely novel and reusable observation: during an active mass-sweep against known-weak keys, RBF contention is a real-time mitigation for anyone monitoring their own addresses, and it argues for at-risk users to be watching mempool activity against their addresses rather than only their balances.
  • Response (patching is not remediation, and the gap is dangerous). "Update your firmware" is the instruction users are conditioned to follow and it does nothing here. Vendors disclosing a key-generation defect must lead with migration, not patching, because the natural user response closes no exposure at all.
  • Response (traceability is the residual lever). ~90% of proceeds unmoved, ~600 attacker addresses mapped, and material handed to federal law enforcement and exchanges. As with several July cases, prevention failed and attribution infrastructure held.

Public references

Discussion

Coldcard displaces Wintermute/Profanity as T11.004's most consequential anchor, and it does so by extending the class into territory the Technique's existing examples do not cover. Every prior anchor in OAK — Profanity, Ether.fi, SecondFi's Cardano web wallet — involved an off-chain software generator: a vanity-address tool, a web wallet, a library. Coldcard is a purpose-built hardware security device whose entire value proposition is that it generates keys better than software can, and it failed by silently becoming software. That is the sharpest available demonstration that T11.004 is not a property of amateur tooling but of any generation path where the entropy source can degrade without saying so.

The case also completes a three-case cohort of the same defect class in three years, which OAK now documents in full: Milk Sad (CVE-2023-39910, Libbitcoin Explorer's bx seed, Mersenne Twister seeded on 32 bits of clock time), Ill Bloom (2026, mobile software wallets with insecure PRNG-derived recovery phrases), and Coldcard. Read together at examples/2023-08-milk-sad-libbitcoin-bx-mersenne-twister-entropy-collapse.md and examples/2026-05-ill-bloom-mobile-wallet-weak-prng-recovery-phrase-sweep.md, the pattern is consistent and worth stating as a rule: the defect is always introduced quietly, always persists for years, and is always discovered by a third party rather than by the vendor. Milk Sad ran from 2017 to 2023, Coldcard from 2021 to 2026. Nobody's internal review found either one.

That last point is where the AI thread belongs, handled carefully. Two separate claims circulate and only one is established. What Coinkite itself put on the record is that its own AI-assisted code review did not catch the flaw — a vendor statement about its own process, and the more useful of the two. The other, that the attacker likely used a large language model to find or orchestrate the exploitation, is Galaxy's characterisation of an observed pattern, not a demonstrated finding, and OAK should not harden it into fact through repetition. What can be said without overreaching is narrower and still significant: this is the first major case in the corpus where the vendor's stated defensive tooling and the suspected offensive tooling are the same category of tool, and where the vendor's own framing is that such tooling now surfaces latent bugs faster than expert human review. If that framing is even partly right, the operative risk is not that AI finds bugs, but that latent defects sitting quietly in shipped code for years are now discoverable on a timescale far shorter than the years-long exposure windows this class creates — which shifts where the danger sits from generation-time to disclosure-time, and makes fail-closed entropy design and defence-in-depth measurably more valuable than they were.

Techniques demonstrated (4)