7月31日约500个Coldcard硬件钱包共计594枚比特币被盗价值约3800万美元。随后负责生产Coldcard钱包的公司Coinkite确认该产品在密钥生成环节存在安全漏洞涉及Coldcard Mk2、Mk3、Mk4、Q和Mk5等多代产品。目前针对此漏洞攻击造成的损失金额已超过8800万美元且攻击仍在持续Coldcard钱包用户应尽快将资金转移至其它地址。Beosin对本次漏洞的分析及相关被盗资金的追踪情况如下。一、漏洞分析分析Coldcard firmware代码的提交记录可以发现在此前的Commit 37e4af5451c260c1e7d429fe8972c4cb5e68ee59中开发团队更新了多个关于MK4配置的代码在mpconfigboard.h中包含// We have our own version of this code.#define MICROPY_HW_ENABLE_RNG (0)在 MicroPython STM32 端这个宏控制默认硬件随机数生成器 (RNG) 绑定和通用随机数实现的编译路径。将其设为 0 导致默认硬件 RNG 路径不会作为通用 rng_get() 的后端使用。其备注说明开发者会自行实现 RNG检查其自定义的rng.h发现只声明了两个 MicroPython 对象MP_DECLARE_CONST_FUN_OBJ_0(pyb_rng_get_obj);MP_DECLARE_CONST_FUN_OBJ_1(pyb_rng_get_bytes_obj);对应的实现为/// \function pyb_rng_get()///// Return a 30-bit hardware generated random number: or fail!//STATIC mp_obj_t pyb_rng_get(void){ // Get and return the new random number return mp_obj_new_int(rng_get_or_fault() 2);} /// \function rng_get_bytes()/// Fill a buffer with random bits; caller must provide sized buffer.STATIC mp_obj_t pyb_rng_get_bytes(mp_obj_t buffer_io) { mp_buffer_info_t bufinfo; mp_get_buffer_raise(buffer_io, bufinfo, MP_BUFFER_WRITE); mp_uint_t count bufinfo.len; if(count 1) { mp_raise_ValueError(NULL); } // Read 32-bit words and unpack into provided buffer random_buffer(bufinfo.buf, count); return mp_const_none;} MP_DEFINE_CONST_FUN_OBJ_0(pyb_rng_get_obj, pyb_rng_get);MP_DEFINE_CONST_FUN_OBJ_1(pyb_rng_get_bytes_obj, pyb_rng_get_bytes);rng_get_or_fault() 本身读取 STM32 RNG 外设static uint32_t rng_get_or_fault(void){ // Enable the RNG peripheral if its not already enabled rng_init(); // Wait for a new random number to be ready, takes on the order of 10us uint32_t start HAL_GetTick(); while (!(RNG-SR RNG_SR_DRDY)) { if (HAL_GetTick() - start RNG_TIMEOUT_MS) { // hardware failure... do not return anything! mp_raise_OSError(MP_EFAULT); } } // Get and return the new random number last_value RNG-DR; return last_value;}这说明 Coldcard 自定义代码确实想要使用硬件 RNG但它只保证调用 pyb_rng_get* 或其内部 random_buffer() 时使用该硬件函数。而在钱包创建时实际调用的是以下代码其中 shared/seed.py 中的钱包创建函数为async def make_new_wallet(nwords): # Pick a new random seed. await ux_dramatic_pause(Generating..., 3) seed generate_seed() words await approve_word_list(seed, nwords) if words: await commit_new_words(words)该调用首先进入 Coldcard 的 shared/random.py 模块。历史版本中random.py 明确依赖 ngu.random并保留# random.py - subset of random module, with no compat, and using crypto-quality rng# for bytes, use ngu.random.byte(len)#bytes ngu.random.bytes即钱包初始化所用的是 random.bytes不是 pyb.rng()自定义的 pyb_rng_get_obj 并未自动覆盖 random.bytes。由于 MICROPY_HW_ENABLE_RNG 被设为 0 钱包生成时并没有使用硬件 RNG而是调用了micropython/ports/stm32/rng.c的pyb_rng_yasmarang#if MICROPY_HW_ENABLE_RNG uint32_t rng_get(void) { // use STM32hardware RNG ...} #else // For MCUs that dont have an RNG we still need to provide a rng_get() function// A pseudo-RNG is not really ideal but we go with it for now. // Yasmarang random number generatorstatic uint32_t pyb_rng_yasmarang(void) { static bool seeded false; static uint32_t pad 0, n 0; ...} uint32_t rng_get(void) { return pyb_rng_yasmarang();} #endif而 pyb_rng_yasmarang 是伪随机数生成器作为硬件钱包种子生成是非常不安全的攻击者可以通过暴力破解获得密钥。目前Coinkite已在makefile文件中明确排除了 stm32/rng.c# Do not compile MicroPythons fallback PRNG. The board-specific rng.c # provides rng_get(), and this empty object satisfies the upstream object list. $(BUILD)/rng.o: CFLAGS -Dpyb_rng_yasmarangerror-do-not-want-this $(BUILD)/rng.o: $(ECHO) SKIP stm32/rng.c $(Q)$(CC) $(CFLAGS) -x c -c /dev/null -o $二、被盗资金追踪目前已有多个受害者钱包的资金被转移并完成归集存放在多个地址中还未做进一步的清洗。Beosin Trace通过威胁情报及链上行为分析监测到以下归集地址bc1qq85v2c926eg6pgxhwp6q7lf6cnsz80qs3fcu9r562 BTCbc1qx76cae2706qd5q576feh7xq8rfcsjpf2htfhe3398.47 BTC此外还有以下归集地址其资金流向图与上图类似目前并未有进一步的转移bc1q8jy96fe5lf8vfugydnte3cguk92gpev7kwtp3q 89.62 BTCbc1q0rvn88w08j75k4h48lf9fvhan7unjp7vjf5q6m64.9 BTCbc1qtfrwa4j6rmj9rsgspv6a0yjumkg39js2numu7545.9 BTCbc1qmd5m5ktv7m5ffujxv4248fxv36myvdx79n8jp630.18 BTC针对Coldcard钱包的攻击仍在进行Beosin团队正持续监测更多归集地址及分析相关资金流向。三、结语此次Coldcard硬件钱包的重大安全事故源于开发团队对于随机数生成的实现错误在关键的钱包种子生成环节使用了伪随机数生成。开发团队应对代码进行持续、全面的测试与审计而Coldcard钱包用户应尽快完成资产的转移并密切关注Coinkite后续的安全公告。