--- title: COLDCARD RNG flaw tied to $88M Bitcoin theft, Check... description: A firmware bug in COLDCARD hardware wallets disabled the STM32 hardware RNG and fell back to a deterministic PRNG, letting attackers reconstruct seeds offline... canonical: https://daily.dev/posts/coldcard-rng-flaw-tied-to-88m-bitcoin-theft-check-point-auth-bypass-under-active-attack-f58a3wdhy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: COLDCARD RNG flaw tied to $88M Bitcoin theft, Check Point auth bypass under active attack | daily.dev og:description: A firmware bug in COLDCARD hardware wallets disabled the STM32 hardware RNG and fell back to a deterministic PRNG, letting attackers reconstruct seeds offline... og:url: https://daily.dev/posts/coldcard-rng-flaw-tied-to-88m-bitcoin-theft-check-point-auth-bypass-under-active-attack-f58a3wdhy og:image: https://api.daily.dev/og/posts/f58a3wdhY.png og:image:alt: COLDCARD RNG flaw tied to $88M Bitcoin theft, Check Point auth bypass under active attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # COLDCARD RNG flaw tied to $88M Bitcoin theft, Check Point auth bypass under active attack **[Security Digest](https://daily.dev/sources/security_digest)** · 5 min read · 0 upvotes · 0 comments ## Summary A firmware bug in COLDCARD hardware wallets disabled the STM32 hardware RNG and fell back to a deterministic PRNG, letting attackers reconstruct seeds offline and drain $88.6M from 4,585 addresses. Separately, Check Point's SmartConsole has a CVSS 9.3 authentication bypass under active exploitation with a public PoC and a CISA three-day remediation deadline for federal agencies. A PipeWire sandbox escape (CVSS 8.8) lets Flatpak apps with only pulseaudio socket access achieve arbitrary code execution via an unverified auth cookie and unrestricted dlopen. Linux 7.2-rc6 landed unusually large, with AI-assisted bug discovery now a visible trend in the kernel patch cycle. ## Content **TLDR:** A firmware bug in COLDCARD hardware wallets disabled the STM32 hardware RNG and fell back to a deterministic PRNG, letting attackers reconstruct seeds offline and drain $88.6M from 4,585 addresses. Separately, Check Point's SmartConsole has a CVSS 9.3 authentication bypass under active exploitation with a public PoC and a CISA three-day remediation deadline for federal agencies. A PipeWire sandbox escape (CVSS 8.8) lets Flatpak apps with only pulseaudio socket access achieve arbitrary code execution via an unverified auth cookie and unrestricted dlopen. Linux 7.2-rc6 landed unusually large, with AI-assisted bug discovery now a visible trend in the kernel patch cycle. --- ## COLDCARD RNG flaw: $88.6M drained from 4,585 Bitcoin addresses A developer disabled the STM32 hardware RNG in COLDCARD firmware to silence a duplicate symbol compiler error, silently routing all entropy calls through the Yasmarang PRNG instead. Attackers could reconstruct wallet seeds offline, match them to on-chain addresses, and sweep funds. Affected firmware spans Mk2/Mk3 versions 4.0.1–4.1.9 and several Mk4, Mk5, and Q versions. Patches are available but don't fix already-generated seeds — anyone on affected firmware needs to generate new seeds and migrate funds. Seeds supplemented with at least 50 dice rolls are not considered at risk from this specific flaw. [Read more](https://daily.dev/feed-by-ids?id=Oiit2xkEc&id=IJ0LYEJly) ## Check Point SmartConsole CVE-2026-16232: CVSS 9.3, active exploitation, public PoC The flaw lets an unauthenticated attacker claim full administrator access by supplying an arbitrary distinguished name during login — the server accepts it without validating against the peer certificate. Rapid7 published a Python PoC that also doubles as a patch-status checker. CISA added it to the KEV catalogue with a three-day deadline for federal agencies. Emergency hotfixes are available for R81.20, R82, and R82.10. Restrict Trusted Clients to known IPs and keep management servers off the public internet while you patch. [Read more](https://daily.dev/posts/GYgBdB6P9) ## PipeWire CVE-2026-5674: Flatpak sandbox escape via unverified auth cookie and unrestricted dlopen Three chained flaws in PipeWire's PulseAudio compatibility layer: the auth cookie is read but never checked, module loading is on by default for 'authenticated' clients, and module-ladspa-sink calls dlopen() on arbitrary paths. A Flatpak app with only --socket=pulseaudio can write a malicious shared library to /tmp, send a junk cookie, and get arbitrary code execution as the logged-in user — no race condition required. Discovered via an AI-assisted research pipeline using Claude Code/Opus. Red Hat shipped RHSA-2026:47083 on July 28. Patch PipeWire and audit Flatpak apps requesting pulseaudio socket access alongside filesystem permissions. [Read more](https://daily.dev/posts/i32PfSskc) ## Linux 7.2-rc6 is unusually large, with AI-found bugs now a visible kernel trend At 537 non-merge commits since rc5, Linus Torvalds called it potentially the biggest rc6 by commit count in years. The sound subsystem pull alone was 'far larger than wished,' covering device quirks for Corsair, Razer, HP, and Lenovo hardware alongside use-after-free, stack leak, and out-of-bounds fixes. Both Torvalds and sound maintainer Takashi Iwai flagged that a noticeable share of bugs this cycle were found by AI/LLM coding agents. Also fixed: AMD Zen 5 CPUs misidentified as Zen 6 due to an incorrect ID range, and an x86 memcmp() reordering bug causing unbootable Xen VMs. Stable 7.2 is expected in roughly two weeks. [Read more](https://daily.dev/posts/2vtR8A0UH) --- ## Also notable - **TP-Link TL-WR841N: hardcoded WPS credentials, ISP credentials surviving factory reset, CVE-2026-4346:** Firmware analysis of the TL-WR841N found hardcoded WPS credentials in plaintext, PPPoE ISP credentials from a previous owner that survive a full factory reset, a default admin:admin web UI login, and an unsalted MD5 admin password hash cracked to '1234' — CVE-2026-4346 covers cleartext credential storage on similar TP-Link devices. [Read more](https://daily.dev/posts/4dyZdMOxK) - **Smart TV proxy SDKs silently route third-party traffic through home IPs; LG bans them from webOS:** Thousands of smart TV apps were found embedding proxy SDKs that monetize users' home IP addresses by routing external traffic through them, with LG announcing a ban on such apps from its webOS store after the practice had already spread widely. [Read more](https://daily.dev/posts/HRfwXSj6A) - **California DROP enforcement starts August 1: 600 data brokers, $200/day fines per resident:** California's DELETE Request Opt-out Platform is now enforceable, requiring roughly 600 registered data brokers to honor deletion requests within 45 days of a single consumer submission, with non-compliance fines of $200 per day per affected resident. [Read more](https://daily.dev/posts/QsISwYQSR) - **Google's 2029 post-quantum deadline: 256-bit ECC may break with 20x fewer qubits than estimated:** Google revealed that 256-bit elliptic curve encryption may be breakable with 20 times fewer qubits than previously estimated, reinforcing the urgency of migrating to post-quantum cryptography before 2029. [Read more](https://daily.dev/posts/P71EquEOo) - **PyCon 2026 security track: num2words supply chain attack hit Hugging Face Transformers as a transitive dependency:** The first dedicated security track at PyCon US 2026 covered a real supply chain attack that compromised num2words, a transitive dependency of Hugging Face Transformers, alongside practical guidance on phishing-resistant auth, trusted publishing via OIDC, and running zizmor on GitHub Actions workflows. [Read more](https://daily.dev/posts/HHTzxERi5) ## Similar posts on daily.dev - [They Didn’t Steal Your Keys. They Regenerated Them.](https://daily.dev/posts/they-didn-t-steal-your-keys-they-regenerated-them--zeogglmg2) · Coins Bench · 3 upvotes · 1 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#vulnerability](https://daily.dev/tags/vulnerability), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/coldcard-rng-flaw-tied-to-88m-bitcoin-theft-check-point-auth-bypass-under-active-attack-f58a3wdhy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"DiscussionForumPosting","mainEntityOfPage":"https://daily.dev/posts/coldcard-rng-flaw-tied-to-88m-bitcoin-theft-check-point-auth-bypass-under-active-attack-f58a3wdhy","headline":"COLDCARD RNG flaw tied to $88M Bitcoin theft, Check Point auth bypass under active attack","text":"A firmware bug in COLDCARD hardware wallets disabled the STM32 hardware RNG and fell back to a deterministic PRNG, letting attackers reconstruct seeds offline and drain $88.6M from 4,585 addresses. Separately, Check Point's SmartConsole has a CVSS 9.3 authentication bypass under active exploitation with a public PoC and a CISA three-day remediation deadline for federal agencies. A PipeWire sandbox escape (CVSS 8.8) lets Flatpak apps with only pulseaudio socket access achieve arbitrary code execution via an unverified auth cookie and unrestricted dlopen. Linux 7.2-rc6 landed unusually large, with AI-assisted bug discovery now a visible trend in the kernel patch cycle.","url":"https://daily.dev/posts/coldcard-rng-flaw-tied-to-88m-bitcoin-theft-check-point-auth-bypass-under-active-attack-f58a3wdhy","datePublished":"2026-08-03T04:21:26.784Z","dateModified":"2026-08-03T04:21:47.363Z","author":{"@type":"Organization","name":"Security Digest","logo":"https://media.daily.dev/image/upload/s--m4ZKB_C0--/f_auto,q_auto/v1779959612/logos/security_digest","url":"https://daily.dev/sources/security_digest"},"interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"isPartOf":{"@type":"WebPage","url":"https://daily.dev/sources/security_digest","name":"Security Digest"}} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Security Digest","item":"https://daily.dev/sources/security_digest"},{"@type":"ListItem","position":3,"name":"COLDCARD RNG flaw tied to $88M Bitcoin theft, Check Point auth bypass under active attack"}]} ```