← All topics

coldcard

2 captures, most recent first.

Andrew Curran @AndrewCurran_

— saved image

Andrew Curran @AndrewCurran_ · 7h
Update from r/Bitcoin. Claude Code can independently find the same wallet vulnerability used in this attack in eight minutes.

[embedded Reddit screenshot]
r/Bitcoin · 10h ago
Impressive-Gene-421
Are you kidding me? Claude Code found the catastrophe after being asked only to ""check for vulnerabilities and thinking for 8 minutes

1. ngu.random is wired to a software PRNG, not the hardware TRNG — CRITICAL

There are two independent RNG paths in the firmware, and only one of them reaches the STM32 TRNG.

Path A (correct). ckcc.rng_bytes() → stm32/COLDCARD_MK4/rng.c:131 random_buffer() → rng_get_or_fault() reads RNG->DR directly and raises OSError on timeout or repeats. This is what backups.py:337 uses for the backup-file password.

Path B (broken). ngu.random.* → external/libngu/ngu/random.c:73 CHIP_TRNG_32(), defined at line 24-26 as extern uint32_t rng_get(void).

It is unbelievable that some kid with an LLM just stole $100m+ because no one bothered to check the source code.

Also on GLM 5.2 (trained 16th June, no internet access).

[quoted tweet]
Andrew Curran @AndrewCurran_ · Aug 1
By the end of the year the tools available to anyone attempting this kind of attack will be vastly more capable across all devices. If there is a seam in any existing hardware, they will get their fingers in there. Attacks like this are about... [cut off]
Note from Claude Sonnet 5

X post by Andrew Curran about a Reddit r/Bitcoin post claiming Claude Code independently found, in eight minutes, the firmware RNG vulnerability (Coldcard hardware wallet, software PRNG vs hardware TRNG path confusion) reportedly used in a large ($100m+) cryptocurrency theft. Includes technical code-path details from the Reddit post and Curran's follow-up warning about future attack tooling capability.

twittercryptocurrencyhardware walletvulnerabilityclaude codecoldcardcybersecurity

Danielle Fong @DanielleFong

— reposted by Charles Rosenbauer, quoting @MedusaOnchain, quoting r/Bitcoin — saved image

Charles Rosenbauer reposted
Danielle Fong 🐦☀️ @DanielleFong · 6h
The secret is that people have been relying on security via obscurity for so many years. Obscurity that is rapidly more transparent as we have industrialized code reasoning agents.

[quoted tweet]
Medusa @MedusaOnchain · 12h
this is insane

claude code found the COLDCARD wallet vulnerability with a single prompt, in just 8 minutes of thinking...

[embedded screenshot, r/Bitcoin post by Impressive-Gene-421, 4h ago]
Are you kidding me? Claude Code found the catastrophe after being asked only to ""check for vulnerabilities and thinking for 8 minutes

1. ngu.random is wired to a software PRNG, not the hardware TRNG — CRITICAL

There are two independent RNG paths in the firmware, and only one of them reaches the STM32 TRNG.

Path A (correct). ckcc.rng_bytes() → stm32/COLDCARD_MK4/rng.c:131 random_buffer() → rng_get_or_fault() reads RNG->DR directly and raises OSError on timeout or repeats. This is what backups.py:337 uses for the backup-file password.

Path B (broken). ngu.random.* → external/libngu/ngu/random.c:73 CHIP_TRNG_32(), defined at line 24-26 as extern uint32_t rng_get(void).

It is unbelievable that some kid with an LLM just stole $100m+ because no one bothered to check the source code.

Also on GLM 5.2 (trained 16th June, no internet access).

486 upvotes, 230 comments, share
Note from Claude Sonnet 5

Chain of tweets/reposts about Claude Code allegedly finding a critical vulnerability in the COLDCARD hardware wallet's random number generator (a software PRNG path instead of hardware TRNG) after an 8-minute 'check for vulnerabilities' prompt, embedding an r/Bitcoin post with technical firmware code paths and a claim it enabled theft of $100m+; commentary from Danielle Fong on security-via-obscurity eroding as code-reasoning AI agents proliferate.

claude codesecurity vulnerabilitycoldcardcryptocurrencytwitterreddit